Avoid buffer overrun when the string does not end in a newline.

diff --git a/gettext-tools/libgrep/ChangeLog b/gettext-tools/libgrep/ChangeLog
index ff9be005cbd73f4d50fa0b5890fe405ed6f28579..37bc9d27027c718223aeb204ce132f62674593da 100644 (file)
--- a/gettext-tools/libgrep/ChangeLog
+++ b/gettext-tools/libgrep/ChangeLog
@@ -1,3 +1,8 @@
+2005-02-03  Bruno Haible  <bruno@clisp.org>
+
+       * dfa.c (dfaexec): Avoid continuing the loop past the end of the
+       string.
+
 2005-01-27  Bruno Haible  <bruno@clisp.org>
 
        * dfa.c (parse_bracket_exp_mb): Don't confuse wctype_t with wchar_t.

diff --git a/gettext-tools/libgrep/dfa.c b/gettext-tools/libgrep/dfa.c
index cf949f8480a5b62bbf50e67a6b16252a9b64e074..b52ed633343899aa876ba9610eeecfd188127298 100644 (file)
--- a/gettext-tools/libgrep/dfa.c
+++ b/gettext-tools/libgrep/dfa.c
@@ -2802,6 +2802,12 @@ dfaexec (struct dfa *d, char const *begin, size_t size, int *backref)
       if (MB_CUR_MAX > 1)
        while ((t = trans[s]))
          {
+           if (p == end)
+             {
+               free(mblen_buf);
+               free(inputwcs);
+               return (size_t) -1;
+             }
            if (d->states[s].mbps.nelem != 0)
              {
                /* Can match with a multibyte character( and multi character
@@ -2826,7 +2832,11 @@ dfaexec (struct dfa *d, char const *begin, size_t size, int *backref)
       else
 #endif /* MBS_SUPPORT */
         while ((t = trans[s]))
-         s = t[*p++];
+         {
+           if (p == end)
+             return (size_t) -1;
+           s = t[*p++];
+         }
 
       if (s < 0)
        {