From 20be63fe71466524c6110fcf02fb604a4010e1e0 Mon Sep 17 00:00:00 2001 From: Denis Vlasenko Date: Wed, 30 Jul 2008 22:58:18 +0000 Subject: [PATCH] tr: fix yet another access past the end of a string (bug 4374) --- coreutils/tr.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/coreutils/tr.c b/coreutils/tr.c index 860b8122b..c736c716b 100644 --- a/coreutils/tr.c +++ b/coreutils/tr.c @@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer) arg--; /* points to x */ continue; /* copy all, including eventual ']' */ } - /* [x-y...] */ - arg++; + /* [x-z] */ + arg++; /* skip - */ + if (arg[0] == '\0' || arg[1] != ']') + bb_show_usage(); ac = *arg++; while (i <= ac) *buffer++ = i++; - arg++; /* skip the assumed ']' */ + arg++; /* skip ] */ continue; } *buffer++ = *arg++;