34543: Prevent crash on garbage bytes inside $(...)

Garbage input (nul bytes, etc.) can cause the $(...) parser to become
confused during look-ahead and attempt to back up the input too far.
This commit catches the error but does not fix the underlying cause.

1 files changed, 4 insertions, 2 deletions

diff --git a/Src/lex.c b/Src/lex.c
index 433c27fbb..91628d4c2 100644
--- a/Src/lex.c
+++ b/Src/lex.c
@@ -503,13 +503,15 @@ cmd_or_math(int cs_type)
     /* else unsuccessful: unget the whole thing */
     hungetc(c);
     lexstop = 0;
-    while (lexbuf.len > oldlen) {
+    while (lexbuf.len > oldlen && !errflag) {
 	lexbuf.len--;
 	hungetc(itok(*--lexbuf.ptr) ?
 		ztokens[*lexbuf.ptr - Pound] : *lexbuf.ptr);
     }
+    if (errflag)
+	return 2;
     hungetc('(');
-    return 0;
+    return errflag ? 2 : 0;
 }