Avoid incrementing a pointer past the end
The ‘end’ parameter to ‘strtaglen’ might point past the end of an allocation. Therefore, if ‘start’ becomes equal to ‘end’, exit the loop without calling ‘memchr’ on it.
This commit is contained in:
parent
210198b180
commit
165330b7bf
|
@ -412,10 +412,8 @@ static inline int strtaglen(const char *str, rpm_count_t c, const char *end)
|
|||
const char *s;
|
||||
|
||||
if (end) {
|
||||
if (str >= end)
|
||||
return -1;
|
||||
while ((s = memchr(start, '\0', end-start))) {
|
||||
if (--c == 0 || s > end)
|
||||
while (end > start && (s = memchr(start, '\0', end-start))) {
|
||||
if (--c == 0)
|
||||
break;
|
||||
start = s + 1;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue