aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenis Vlasenko <vda.linux@googlemail.com>2008-07-30 22:58:18 +0000
committerDenis Vlasenko <vda.linux@googlemail.com>2008-07-30 22:58:18 +0000
commit20be63fe71466524c6110fcf02fb604a4010e1e0 (patch)
tree34c5185efa22c3f8f2c7b9659dd28993b3b44275
parentb35714986721a6f36ecb87034e6024138f6c0b6e (diff)
downloadbusybox-20be63fe71466524c6110fcf02fb604a4010e1e0.tar.gz
tr: fix yet another access past the end of a string (bug 4374)
-rw-r--r--coreutils/tr.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/coreutils/tr.c b/coreutils/tr.c
index 860b8122b..c736c716b 100644
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer)
arg--; /* points to x */
continue; /* copy all, including eventual ']' */
}
- /* [x-y...] */
- arg++;
+ /* [x-z] */
+ arg++; /* skip - */
+ if (arg[0] == '\0' || arg[1] != ']')
+ bb_show_usage();
ac = *arg++;
while (i <= ac)
*buffer++ = i++;
- arg++; /* skip the assumed ']' */
+ arg++; /* skip ] */
continue;
}
*buffer++ = *arg++;