From e962b4a97a2542561009ec20ccfbd6c912e3f88c Mon Sep 17 00:00:00 2001 From: Thomas Roessler Date: Tue, 15 Jan 2002 18:22:05 +0000 Subject: [PATCH] Avoid reading past the end of ta string when handling \ or ^ sequences. From Michael Elkins. --- init.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/init.c b/init.c index 534709919..a96bc049a 100644 --- a/init.c +++ b/init.c @@ -135,10 +135,14 @@ int mutt_extract_token (BUFFER *dest, BUFFER *tok, int flags) qc = ch; else if (ch == '\\' && qc != '\'') { + if (!*tok->dptr) + return -1; /* premature end of token */ switch (ch = *tok->dptr++) { case 'c': case 'C': + if (!*tok->dptr) + return -1; /* premature end of token */ mutt_buffer_addch (dest, (toupper (*tok->dptr) - '@') & 0x7f); tok->dptr++; break; @@ -172,6 +176,8 @@ int mutt_extract_token (BUFFER *dest, BUFFER *tok, int flags) } else if (ch == '^' && (flags & M_TOKEN_CONDENSE)) { + if (!*tok->dptr) + return -1; /* premature end of token */ ch = *tok->dptr++; if (ch == '^') mutt_buffer_addch (dest, ch); -- 2.40.0