Add additional check to prevent going before start of buffer (cisco#446)

p is a pointer that iterates over path, which is buffer. We should not try to get to an address preceding its start. Since there was an execution path that leads to that, guard against it with an additional check. Signed-off-by: Alexander Shopov <ash@kambanaria.org>
gongchengra · Jul 25, 2019 · de8d0e7 · de8d0e7
1 parent e962a03
commit de8d0e7
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/LOG b/LOG
@@ -1387,3 +1387,5 @@
     expeditor.ss
 - fix ee_read_char to handle ^@ properly
     expeditor.c
+- prevent access before start of array
+    scheme.c
diff --git a/c/scheme.c b/c/scheme.c
@@ -530,7 +530,7 @@ static IBOOL next_path(path, name, ext, sp, dsp) char *path; const char *name, *
   /* unless entry was null, append name and ext onto path and return true with
    * updated path, sp, and possibly dsp */
     if (s != *sp) {
-      if (!DIRMARKERP(*(p - 1))) { setp(PATHSEP); }
+      if ((p > path) && !DIRMARKERP(*(p - 1))) { setp(PATHSEP); }
       t = name;
       while (*t != 0) setp(*t++);
       t = ext;