From 03afb27c83d9a684953d8135a6317228ad0c1cf8 Mon Sep 17 00:00:00 2001
From: "Jordan K. Hubbard" <jkh@FreeBSD.org>
Date: Sun, 14 Nov 2004 05:15:25 +0000
Subject: [PATCH] tr(1) attempts to convert \n[n][n] sequences into octal
 digits, but doesn't check to see that a given digit is actually an octal
 digit.  This leads to unusual consequences if passed in values like \9.

Reported by:	Joseph Davison (OpenDarwin project)
MFC after:	1 week
---
 usr.bin/tr/str.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr.bin/tr/str.c b/usr.bin/tr/str.c
index f28b243d2ec5..c023fea66a24 100644
--- a/usr.bin/tr/str.c
+++ b/usr.bin/tr/str.c
@@ -358,7 +358,7 @@ backslash(STR *s, int *is_octal)
 		*is_octal = 0;
 	for (cnt = val = 0;;) {
 		ch = (u_char)*++s->str;
-		if (!isdigit(ch))
+		if (!isdigit(ch) || ch > '7')
 			break;
 		val = val * 8 + ch - '0';
 		if (++cnt == 3) {