From 3badbc50e0d1c45ebfca2d2d1fad059a055584a5 Mon Sep 17 00:00:00 2001
From: nicm <nicm>
Date: Sat, 4 Apr 2026 11:32:05 +0000
Subject: [PATCH] Do not read off end of buffer if it ends in \ when expanding
 \c, found by ossfuzz.

---
 regsub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/regsub.c b/regsub.c
index 91be3994..a863f9fd 100644
--- a/regsub.c
+++ b/regsub.c
@@ -41,7 +41,7 @@ regsub_expand(char **buf, ssize_t *len, const char *with, const char *text,
 	u_int		 i;
 
 	for (cp = with; *cp != '\0'; cp++) {
-		if (*cp == '\\') {
+		if (cp[0] == '\\' && cp[1] != '\0') {
 			cp++;
 			if (*cp >= '0' && *cp <= '9') {
 				i = *cp - '0';