tr: fix "access past the end of a string" bug 4354

diff --git a/coreutils/tr.c b/coreutils/tr.c
index e439fcb5b03a792a7b1385298e2acb374f90df5a..28798fe4ff5d0c0ddbec58a2d3ffd3fc6b286d8f 100644 (file)
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@@ -138,7 +138,7 @@ static unsigned int expand(const char *arg, char *buffer)
                                arg += 3;       /* skip CHAR=] */
                                continue;
                        }
-                       if (*arg != '-') { /* not [x-...] - copy verbatim */
+                       if (i == '\0' || *arg != '-') { /* not [x-...] - copy verbatim */
                                *buffer++ = '[';
                                arg--; /* points to x */
                                continue; /* copy all, including eventual ']' */