parse.y: string buffer (`tokbuf`) can overflow.

Check if `esclen` is smaller than `len` (original string length).
parent adb50df7
......@@ -4682,6 +4682,7 @@ heredoc_remove_indent(parser_state *p, parser_heredoc_info *hinf)
start = 0;
while (start < len) {
end = escaped ? (size_t)escaped->car : len;
if (end > len) end = len;
spaces = (size_t)nspaces->car;
size_t esclen = end - start;
heredoc_count_indent(hinf, str + start, esclen, spaces, &offset);
......
......@@ -10718,6 +10718,7 @@ heredoc_remove_indent(parser_state *p, parser_heredoc_info *hinf)
start = 0;
while (start < len) {
end = escaped ? (size_t)escaped->car : len;
if (end > len) end = len;
spaces = (size_t)nspaces->car;
size_t esclen = end - start;
heredoc_count_indent(hinf, str + start, esclen, spaces, &offset);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment