From c83204c09df1d86c3a453d9f812695de1f7f559c Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Sat, 18 Feb 2012 11:01:11 -0800 Subject: [PATCH] sys-file-reader: Avoid read past end of buffer. The "unexpected label source in mrsets" test caused a read past the end of the input buffer in text_parse_counted_string(). This fixes the problem. Found by Valgrind. Reported-by: John Darrington --- src/data/sys-file-reader.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/data/sys-file-reader.c b/src/data/sys-file-reader.c index 7e8bcf0de3..07471e8831 100644 --- a/src/data/sys-file-reader.c +++ b/src/data/sys-file-reader.c @@ -2439,7 +2439,7 @@ text_parse_counted_string (struct sfm_reader *r, struct text_record *text) start = text->pos; n = 0; - for (;;) + while (text->pos < text->buffer.length) { int c = text->buffer.string[text->pos]; if (c < '0' || c > '9') @@ -2447,7 +2447,7 @@ text_parse_counted_string (struct sfm_reader *r, struct text_record *text) n = (n * 10) + (c - '0'); text->pos++; } - if (start == text->pos) + if (text->pos >= text->buffer.length || start == text->pos) { sys_warn (r, text->start, _("Expecting digit at offset %zu in MRSETS record."), -- 2.30.2