Wed Feb 3 05:32:14 2016 UTC ()

PR/50750: David Binderman: Check bounds before dereference


(christos)

diff -r1.14 -r1.15 src/usr.bin/unexpand/unexpand.c

--- src/usr.bin/unexpand/unexpand.c 2008/12/21 02:33:13	1.14
+++ src/usr.bin/unexpand/unexpand.c 2016/02/03 05:32:14	1.15

 @@ -1,14 +1,14 @@
-/*	$NetBSD: unexpand.c,v 1.14 2008/12/21 02:33:13 christos Exp $	*/
+/*	$NetBSD: unexpand.c,v 1.15 2016/02/03 05:32:14 christos Exp $	*/
 /*-
  * Copyright (c) 1980, 1993
  *	The Regents of the University of California.  All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
 @@ -29,27 +29,27 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifndef lint
 __COPYRIGHT("@(#) Copyright (c) 1980, 1993\
  The Regents of the University of California.  All rights reserved.");
 #endif /* not lint */
 #ifndef lint
 #if 0
 static char sccsid[] = "@(#)unexpand.c	8.1 (Berkeley) 6/6/93";
 #endif
-__RCSID("$NetBSD: unexpand.c,v 1.14 2008/12/21 02:33:13 christos Exp $");
+__RCSID("$NetBSD: unexpand.c,v 1.15 2016/02/03 05:32:14 christos Exp $");
 #endif /* not lint */
 /*
  * unexpand - put tabs into a file replacing blanks
  */
 #include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 #include <errno.h>
 #include <err.h>
 #include <util.h>
 @@ -144,50 +144,50 @@ tabify(const char *line, size_t len)
 	dcol = ocol = 0;
 	limit = nstops == 0 ? UINT_MAX : tabstops[nstops - 1] - 1;
 	e = line + len;
 	for (p = line; p < e; p++) {
 		if (*p == ' ') {
 			dcol++;
 			continue;
 		} else if (*p == '\t') {
 			if (nstops == 0) {
 				dcol = (1 + dcol / DSTOP) * DSTOP;
 				continue;
 			} else {
-				for (n = 0; tabstops[n] - 1 < dcol &&
+				for (n = 0; n < nstops &&
-				    n < nstops; n++)
+				    tabstops[n] - 1 < dcol; n++)
 					continue;
 				if (n < nstops - 1 && tabstops[n] - 1 < limit) {
 					dcol = tabstops[n];
 					continue;
+				}
+			}
+		}
 		/* Output our tabs */
 		if (nstops == 0) {
 			while (((ocol + DSTOP) / DSTOP) <= (dcol / DSTOP)) {
 				if (dcol - ocol < 2)
 					break;
 				if (putchar('\t') == EOF)
 					goto out;
 				ocol = (1 + ocol / DSTOP) * DSTOP;
+			}
 		} else {
-			for (n = 0; tabstops[n] <= ocol && n < nstops; n++)
+			for (n = 0; n < nstops && tabstops[n] <= ocol; n++)
 				continue;
-			while (tabstops[n] <= dcol && ocol < dcol &&
+			while (n < nstops && tabstops[n] <= dcol && ocol < dcol
-			    n < nstops && ocol < limit) {
+			    && ocol < limit) {
 				if (putchar('\t') == EOF)
 					goto out;
 				ocol = tabstops[n++];
+			}
+		}
 		/* Output remaining spaces */
 		while (ocol < dcol && ocol < limit) {
 			if (putchar(' ') == EOF)
 				goto out;
 			ocol++;
+		}