diff options
| author | Pedro F. Giffuni <pfg@FreeBSD.org> | 2023-08-07 03:27:27 +0000 |
|---|---|---|
| committer | Pedro F. Giffuni <pfg@FreeBSD.org> | 2023-08-07 03:27:27 +0000 |
| commit | 9610cbc09e72c370369b5cc0e165542a2c5fdca7 (patch) | |
| tree | aec6e46cdd18b9d85a1bede4fc228165cfbc6e8f | |
| parent | 395b9c9977c521a4565e9898299a6abfbf54127c (diff) | |
| download | src-9610cbc09e72c370369b5cc0e165542a2c5fdca7.tar.gz src-9610cbc09e72c370369b5cc0e165542a2c5fdca7.zip | |
patch: don't run off the end of path if it ends in '/'.
Found by fuzzing (afl) in OpenBSD.
Obtained from: OpenBSD (CVS 1.65)
| -rw-r--r-- | usr.bin/patch/pch.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/usr.bin/patch/pch.c b/usr.bin/patch/pch.c index d1d71f95644c..e180c7075712 100644 --- a/usr.bin/patch/pch.c +++ b/usr.bin/patch/pch.c @@ -1618,7 +1618,8 @@ num_components(const char *path) size_t n; const char *cp; - for (n = 0, cp = path; (cp = strchr(cp, '/')) != NULL; n++, cp++) { + for (n = 0, cp = path; (cp = strchr(cp, '/')) != NULL; n++) { + cp++; while (*cp == '/') cp++; /* skip consecutive slashes */ } |