Author: pfg
Date: Fri Dec 2 16:41:08 2016
New Revision: 309418
URL: https://svnweb.freebsd.org/changeset/base/309418
Log:
indent(1): Avoid out-of-bound accesses of arrays.
ps.paren_indents:
When ps.paren_level was 0, this was accessing paren_indents[-1].
in_buffer:
This fragment checks if "*/" was read, but there's no guarantee that there
is more than one byte in the array (actually, this happens frequently for
the "{" in things like "int main(void) {").
Submitted by: Piotr Stefaniak
Modified:
head/usr.bin/indent/io.c
Modified: head/usr.bin/indent/io.c
==============================================================================
--- head/usr.bin/indent/io.c Fri Dec 2 16:32:14 2016 (r309417)
+++ head/usr.bin/indent/io.c Fri Dec 2 16:41:08 2016 (r309418)
@@ -278,7 +278,8 @@ inhibit_newline:
*(e_com = s_com = combuf + 1) = '\0';
ps.ind_level = ps.i_l_follow;
ps.paren_level = ps.p_l_follow;
- paren_target = -ps.paren_indents[ps.paren_level - 1];
+ if (ps.paren_level > 0)
+ paren_target = -ps.paren_indents[ps.paren_level - 1];
not_first_line = 1;
}
@@ -371,7 +372,7 @@ fill_buffer(void)
}
buf_ptr = in_buffer;
buf_end = p;
- if (p[-2] == '/' && p[-3] == '*') {
+ if (p - in_buffer > 2 && p[-2] == '/' && p[-3] == '*') {
if (in_buffer[3] == 'I' && strncmp(in_buffer, "/**INDENT**", 11) == 0)
fill_buffer(); /* flush indent error message */
else {
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
