From 20be63fe71466524c6110fcf02fb604a4010e1e0 Mon Sep 17 00:00:00 2001
From: Denis Vlasenko
Date: Wed, 30 Jul 2008 22:58:18 +0000
Subject: tr: fix yet another access past the end of a string (bug 4374)

---
 coreutils/tr.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'coreutils')

diff --git a/coreutils/tr.c b/coreutils/tr.c
index 860b812..c736c71 100644
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer)
 				arg--; /* points to x */
 				continue; /* copy all, including eventual ']' */
 			}
-			/* [x-y...] */
-			arg++;
+			/* [x-z] */
+			arg++; /* skip - */
+			if (arg[0] == '\0' || arg[1] != ']')
+				bb_show_usage();
 			ac = *arg++;
 			while (i <= ac)
 				*buffer++ = i++;
-			arg++;	/* skip the assumed ']' */
+			arg++;	/* skip ] */
 			continue;
 		}
 		*buffer++ = *arg++;
-- 
cgit v1.1