d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tr: Fix '[=]=]' equivalence class.

Browse Source 
A closing bracket immediately after '[=' should not be treated as special.

Different from the submitted patch, a string ending with '[=' does not cause
access beyond the terminating '\0'.

PR:		bin/150384
Submitted by:	Richard Lowe
MFC after:	2 weeks
This commit is contained in:
Jilles Tjoelker 2010-09-29 22:24:18 +00:00
parent 2280c16b56
commit 88deede54a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=213284
4 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
tools/regression/usr.bin/tr/regress.0c.out Normal file
View File

@ -0,0 +1 @@
[[[[

1
tools/regression/usr.bin/tr/regress.0d.out Normal file
View File

@ -0,0 +1 @@

4
tools/regression/usr.bin/tr/regress.sh
View File

@ -1,6 +1,6 @@
# $FreeBSD$
echo 1..12
echo 1..14
REGRESSION_START($1)
@ -16,5 +16,7 @@ REGRESSION_TEST(`08', `tr "[[:upper:]]" "[[:lower:]]" < regress2.in | tr -d "[^[
REGRESSION_TEST(`09', `printf "\\f\\r\\n" | tr "\\014\\r" "?#"')
REGRESSION_TEST(`0a', `printf "0xdeadbeef\\n" | tr "x[[:xdigit:]]" "?\$"')
REGRESSION_TEST(`0b', `(tr -cd "[[:xdigit:]]" < regress2.in ; echo)')
REGRESSION_TEST(`0c', `echo "[[[[]]]]" | tr -d "[=]=]"')
REGRESSION_TEST(`0d', `echo "]=[" | tr -d "[=]"')
REGRESSION_END()

2
usr.bin/tr/str.c
View File

@ -156,7 +156,7 @@ bracket(s)
s->str = p + 1;
return (1);
case '=': /* "[=equiv=]" */
if ((p = strchr(s->str + 2, ']')) == NULL)
if (s->str[2] == '\0' || (p = strchr(s->str + 3, ']')) == NULL)
return (0);
if (*(p - 1) != '=' || p - s->str < 4)
goto repeat;