From: Ben Pfaff <blp@cs.stanford.edu>
Date: Sat, 9 Oct 2021 16:13:40 +0000 (-0700)
Subject: segment: Fix read past end of buffer when input ends in '-'.
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?p=pspp;a=commitdiff_plain;h=4ec7a639f968227b4be247d21b2c1e46743411db

segment: Fix read past end of buffer when input ends in '-'.

Thanks to John Darrington for reporting this.
Found by Address Sanitizer.
---

diff --git a/src/language/lexer/segment.c b/src/language/lexer/segment.c
index 4a6fefb4c2..e5d0af2352 100644
--- a/src/language/lexer/segment.c
+++ b/src/language/lexer/segment.c
@@ -943,9 +943,9 @@ segmenter_parse_mid_command__ (struct segmenter *s,
       ofs = skip_spaces (input, n, eof, 1);
       if (ofs < 0)
         return -1;
-      else if (c_isdigit (input[ofs]))
+      else if (ofs < n && c_isdigit (input[ofs]))
         return segmenter_parse_number__ (s, input, n, eof, type, ofs);
-      else if (input[ofs] == '.')
+      else if (ofs < n && input[ofs] == '.')
         {
           if (ofs + 1 >= n)
             {