Author: pfg Date: Fri Dec 2 16:41:08 2016 New Revision: 309418 URL: https://svnweb.freebsd.org/changeset/base/309418
Log: indent(1): Avoid out-of-bound accesses of arrays. ps.paren_indents: When ps.paren_level was 0, this was accessing paren_indents[-1]. in_buffer: This fragment checks if "*/" was read, but there's no guarantee that there is more than one byte in the array (actually, this happens frequently for the "{" in things like "int main(void) {"). Submitted by: Piotr Stefaniak Modified: head/usr.bin/indent/io.c Modified: head/usr.bin/indent/io.c ============================================================================== --- head/usr.bin/indent/io.c Fri Dec 2 16:32:14 2016 (r309417) +++ head/usr.bin/indent/io.c Fri Dec 2 16:41:08 2016 (r309418) @@ -278,7 +278,8 @@ inhibit_newline: *(e_com = s_com = combuf + 1) = '\0'; ps.ind_level = ps.i_l_follow; ps.paren_level = ps.p_l_follow; - paren_target = -ps.paren_indents[ps.paren_level - 1]; + if (ps.paren_level > 0) + paren_target = -ps.paren_indents[ps.paren_level - 1]; not_first_line = 1; } @@ -371,7 +372,7 @@ fill_buffer(void) } buf_ptr = in_buffer; buf_end = p; - if (p[-2] == '/' && p[-3] == '*') { + if (p - in_buffer > 2 && p[-2] == '/' && p[-3] == '*') { if (in_buffer[3] == 'I' && strncmp(in_buffer, "/**INDENT**", 11) == 0) fill_buffer(); /* flush indent error message */ else { _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"