svn commit: r324431 - head/usr.bin/patch

[Kyle Evans]

Author: kevans
Date: Mon Oct  9 14:50:02 2017
New Revision: 324431
URL: https://svnweb.freebsd.org/changeset/base/324431

Log:
  patch(1): Don't overrun line buffer in some cases
  
  Patches like file.txt attached to PR 190195 with a final line formed
  like ">(EOL)" could cause a copy past the end of the current line buffer. In the
  case of PR 191641, this caused a duplicate line to be copied into the resulting
  file.
  
  Instead of running past the end, treat it as if it were a blank line.
  
  PR:		191641
  Reviewed by:	cem, emaste, pfg
  Approved by:	emaste (mentor)
  Differential Revision:	https://reviews.freebsd.org/D12609

Modified:
  head/usr.bin/patch/pch.c

Modified: head/usr.bin/patch/pch.c
==============================================================================
--- head/usr.bin/patch/pch.c	Mon Oct  9 13:53:41 2017	(r324430)
+++ head/usr.bin/patch/pch.c	Mon Oct  9 14:50:02 2017	(r324431)
@@ -1135,7 +1135,12 @@ hunk_done:
 			if (*buf != '>')
 				fatal("> expected at line %ld of patch\n",
 				    p_input_line);
-			p_line[i] = savestr(buf + 2);
+			/* Don't overrun if we don't have enough line */
+			if (len > 2)
+				p_line[i] = savestr(buf + 2);
+			else
+				p_line[i] = savestr("");
+
 			if (out_of_mem) {
 				p_end = i - 1;
 				return false;