segment: Fix read past end of buffer when input ends in '-'.

Thanks to John Darrington for reporting this.
Found by Address Sanitizer.

diff --git a/src/language/lexer/segment.c b/src/language/lexer/segment.c
index 4a6fefb4c25d1e7c1441cd1a6a8d43f5b76b1873..e5d0af235213443ada5b2df9994e78eeaae97373 100644 (file)
--- a/src/language/lexer/segment.c
+++ b/src/language/lexer/segment.c
@@ -943,9 +943,9 @@ segmenter_parse_mid_command__ (struct segmenter *s,
       ofs = skip_spaces (input, n, eof, 1);
       if (ofs < 0)
         return -1;
-      else if (c_isdigit (input[ofs]))
+      else if (ofs < n && c_isdigit (input[ofs]))
         return segmenter_parse_number__ (s, input, n, eof, type, ofs);
-      else if (input[ofs] == '.')
+      else if (ofs < n && input[ofs] == '.')
         {
           if (ofs + 1 >= n)
             {