Do not read off end of buffer if it ends in \ when expanding \c, found

by ossfuzz.
2026-05-23 13:20:14 +00:00 · 2026-04-04 11:32:05 +00:00
parent cd60de443e
commit 3badbc50e0
1 changed files with 1 additions and 1 deletions
--- a/regsub.c
+++ b/regsub.c
@@ -41,7 +41,7 @@ regsub_expand(char **buf, ssize_t *len, const char *with, const char *text,
 	u_int		 i;

 	for (cp = with; *cp != '\0'; cp++) {
-		if (*cp == '\\') {
+		if (cp[0] == '\\' && cp[1] != '\0') {
 			cp++;
 			if (*cp >= '0' && *cp <= '9') {
 				i = *cp - '0';