From 4ec7a639f968227b4be247d21b2c1e46743411db Mon Sep 17 00:00:00 2001
From: Ben Pfaff <blp@cs.stanford.edu>
Date: Sat, 9 Oct 2021 09:13:40 -0700
Subject: [PATCH] segment: Fix read past end of buffer when input ends in '-'.

Thanks to John Darrington for reporting this.
Found by Address Sanitizer.
---
 src/language/lexer/segment.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/language/lexer/segment.c b/src/language/lexer/segment.c
index 4a6fefb4c2..e5d0af2352 100644
--- a/src/language/lexer/segment.c
+++ b/src/language/lexer/segment.c
@@ -943,9 +943,9 @@ segmenter_parse_mid_command__ (struct segmenter *s,
       ofs = skip_spaces (input, n, eof, 1);
       if (ofs < 0)
         return -1;
-      else if (c_isdigit (input[ofs]))
+      else if (ofs < n && c_isdigit (input[ofs]))
         return segmenter_parse_number__ (s, input, n, eof, type, ofs);
-      else if (input[ofs] == '.')
+      else if (ofs < n && input[ofs] == '.')
         {
           if (ofs + 1 >= n)
             {
-- 
2.30.2