fix sym_val() buffer overrun fix
Fix a mistake in commit 74de7d31e0.
Copy+paste error resulted in 'strval + 1' when 'strval' is required.
This commit is contained in:
@@ -6202,6 +6202,7 @@ const char *strval; /* up to 4*BUFSZ-1 long; only first few chars matter */
|
|||||||
} else {
|
} else {
|
||||||
char *p;
|
char *p;
|
||||||
|
|
||||||
|
/* +1: skip opening single quote */
|
||||||
(void) strncpy(tmp, strval + 1, sizeof tmp - 1);
|
(void) strncpy(tmp, strval + 1, sizeof tmp - 1);
|
||||||
tmp[sizeof tmp - 1] = '\0';
|
tmp[sizeof tmp - 1] = '\0';
|
||||||
if ((p = rindex(tmp, '\'')) != 0) {
|
if ((p = rindex(tmp, '\'')) != 0) {
|
||||||
@@ -6210,7 +6211,7 @@ const char *strval; /* up to 4*BUFSZ-1 long; only first few chars matter */
|
|||||||
} /* else buf[0] stays '\0' */
|
} /* else buf[0] stays '\0' */
|
||||||
}
|
}
|
||||||
} else { /* not lone char nor single quote */
|
} else { /* not lone char nor single quote */
|
||||||
(void) strncpy(tmp, strval + 1, sizeof tmp - 1);
|
(void) strncpy(tmp, strval, sizeof tmp - 1);
|
||||||
tmp[sizeof tmp - 1] = '\0';
|
tmp[sizeof tmp - 1] = '\0';
|
||||||
escapes(tmp, buf);
|
escapes(tmp, buf);
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user