diff --git a/usr.bin/sed/compile.c b/usr.bin/sed/compile.c index e14666883d06..c7fbe21f9d28 100644 --- a/usr.bin/sed/compile.c +++ b/usr.bin/sed/compile.c @@ -558,7 +558,7 @@ compile_flags(char *p, struct s_subst *s) { int gn; /* True if we have seen g or n */ unsigned long nval; - char wfile[_POSIX2_LINE_MAX + 1], *q; + char wfile[_POSIX2_LINE_MAX + 1], *q, *eq; s->n = 1; /* Default */ s->p = 0; @@ -611,9 +611,12 @@ compile_flags(char *p, struct s_subst *s) #endif EATSPACE(); q = wfile; + eq = wfile + sizeof(wfile) - 1; while (*p) { if (*p == '\n') break; + if (q >= eq) + err(1, "wfile too long"); *q++ = *p++; } *q = '\0';