From: logical-misha <220645577+logical-misha@users.noreply.github.com>
Date: Tue, 21 Jul 2026 04:55:43 +0000 (+0000)
Subject: pg: fix out-of-bounds access past wbuf on a trailing tab
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4c10a9aa6310c7a97cfc695c6a2f603cb24633ff;p=thirdparty%2Futil-linux.git

pg: fix out-of-bounds access past wbuf on a trailing tab

endline_for_mb() and its single-byte twin endline() advance the scan
pointer twice when the last character of a buffer-filling line is a tab
(once in the tab branch, once via the shared *++p) with no terminator
re-check in between. A full line (wl == READBUF-1) ending in a tab makes
*++p read wbuf[READBUF] and the following *end = L'\0' write it -- one
element past the wbuf[READBUF] array.

Re-check for the terminator before the second advance.

Closes #4495

Signed-off-by: logical-misha <220645577+logical-misha@users.noreply.github.com>
---

diff --git a/text-utils/pg.c b/text-utils/pg.c
index 2e3a03981..29a2bb983 100644
--- a/text-utils/pg.c
+++ b/text-utils/pg.c
@@ -444,7 +444,7 @@ static char *endline_for_mb(unsigned col, char *s)
 				 * Assume the terminal will print the
 				 * entire character onto the next row. */
 				p--;
-			if (*++p == L'\n')
+			if (*p != L'\0' && *++p == L'\n')
 				p++;
 			end = p;
 			goto ended;
@@ -499,7 +499,7 @@ static char *endline(unsigned col, char *s)
 		if (pos > col) {
 			if (*s == '\t')
 				s++;
-			if (*++s == '\n')
+			if (*s != '\0' && *++s == '\n')
 				s++;
 			t = s;
 			goto cend;