[src/trunk]: src/lib/libedit PR/54400: S?ren Tempel: out-of-bounds read in li...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/fb986734da25
branches:  trunk
changeset: 457849:fb986734da25
user:      christos <christos%NetBSD.org@localhost>
date:      Tue Jul 23 09:47:16 2019 +0000

description:
PR/54400: S?ren Tempel: out-of-bounds read in libedit c_delbefore

diffstat:

 lib/libedit/chared.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r fecf45616a8c -r fb986734da25 lib/libedit/chared.c
--- a/lib/libedit/chared.c      Tue Jul 23 09:38:53 2019 +0000
+++ b/lib/libedit/chared.c      Tue Jul 23 09:47:16 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: chared.c,v 1.57 2017/10/11 06:49:03 abhinav Exp $      */
+/*     $NetBSD: chared.c,v 1.58 2019/07/23 09:47:16 christos Exp $     */
 
 /*-
  * Copyright (c) 1992, 1993
@@ -37,7 +37,7 @@
 #if 0
 static char sccsid[] = "@(#)chared.c   8.1 (Berkeley) 6/4/93";
 #else
-__RCSID("$NetBSD: chared.c,v 1.57 2017/10/11 06:49:03 abhinav Exp $");
+__RCSID("$NetBSD: chared.c,v 1.58 2019/07/23 09:47:16 christos Exp $");
 #endif
 #endif /* not lint && not SCCSID */
 
@@ -174,7 +174,7 @@
                wchar_t *cp;
 
                for (cp = el->el_line.cursor - num;
-                   cp <= el->el_line.lastchar;
+                   &cp[num] <= el->el_line.lastchar;
                    cp++)
                        *cp = cp[num];