diff options
| author | Eli Zaretskii | 2022-01-20 13:42:56 +0200 |
|---|---|---|
| committer | Eli Zaretskii | 2022-01-20 13:42:56 +0200 |
| commit | 11ea45c9e47d13e13e3e539551e2df300f995c11 (patch) | |
| tree | 63a2fadec28d1f47a2ccb9a05abde73cd4b89ca1 /lib-src/ebrowse.c | |
| parent | ba57b78064830caaa253e56decf9686a48fade78 (diff) | |
| download | emacs-11ea45c9e47d13e13e3e539551e2df300f995c11.tar.gz emacs-11ea45c9e47d13e13e3e539551e2df300f995c11.zip | |
Fix UB in ebrowse
* lib-src/ebrowse.c (matching_regexp): Avoid writing beyond the
limits of 'matching_regexp_buffer'. Patch by Jan Stranik
<jan@stranik.org>. (Bug#53333)
Copyright-paperwork-exempt: yes
Diffstat (limited to 'lib-src/ebrowse.c')
| -rw-r--r-- | lib-src/ebrowse.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/lib-src/ebrowse.c b/lib-src/ebrowse.c index 04ae018464e..ac7e7901878 100644 --- a/lib-src/ebrowse.c +++ b/lib-src/ebrowse.c | |||
| @@ -1925,7 +1925,15 @@ matching_regexp (void) | |||
| 1925 | *--s = *--t; | 1925 | *--s = *--t; |
| 1926 | 1926 | ||
| 1927 | if (*s == '"' || *s == '\\') | 1927 | if (*s == '"' || *s == '\\') |
| 1928 | *--s = '\\'; | 1928 | { |
| 1929 | if (s > matching_regexp_buffer) | ||
| 1930 | *--s = '\\'; | ||
| 1931 | else | ||
| 1932 | { | ||
| 1933 | s++; | ||
| 1934 | break; | ||
| 1935 | } | ||
| 1936 | } | ||
| 1929 | } | 1937 | } |
| 1930 | 1938 | ||
| 1931 | *(matching_regexp_end_buf - 1) = '\0'; | 1939 | *(matching_regexp_end_buf - 1) = '\0'; |