From: Denis Vlasenko <vda.linux@googlemail.com>
Date: Wed, 30 Jul 2008 22:58:18 +0000 (-0000)
Subject: tr: fix yet another access past the end of a string (bug 4374)
X-Git-Tag: 1_12_0~60
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=20be63fe71466524c6110fcf02fb604a4010e1e0;p=oweals%2Fbusybox.git

tr: fix yet another access past the end of a string (bug 4374)
---

diff --git a/coreutils/tr.c b/coreutils/tr.c
index 860b8122b..c736c716b 100644
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer)
 				arg--; /* points to x */
 				continue; /* copy all, including eventual ']' */
 			}
-			/* [x-y...] */
-			arg++;
+			/* [x-z] */
+			arg++; /* skip - */
+			if (arg[0] == '\0' || arg[1] != ']')
+				bb_show_usage();
 			ac = *arg++;
 			while (i <= ac)
 				*buffer++ = i++;
-			arg++;	/* skip the assumed ']' */
+			arg++;	/* skip ] */
 			continue;
 		}
 		*buffer++ = *arg++;