diff options
| author | Jun-ichi Takimoto <takimoto-j@kba.biglobe.ne.jp> | 2021-07-19 09:13:03 +0900 |
|---|---|---|
| committer | Jun-ichi Takimoto <takimoto-j@kba.biglobe.ne.jp> | 2021-07-19 09:13:03 +0900 |
| commit | 9b3a2924101c4e17dbb9c0b8745dc4eb9cdca910 (patch) | |
| tree | 3f4d761057c404c135d6a3fbb110409834c7e48c /Src/subst.c | |
| parent | 6e10067ffd3d2ede3e0a59c36e03d00cee5d9ad1 (diff) | |
| download | zsh-9b3a2924101c4e17dbb9c0b8745dc4eb9cdca910.tar.gz zsh-9b3a2924101c4e17dbb9c0b8745dc4eb9cdca910.zip | |
49166: fix coredump in ${name:offset:length} with ill-formatted length
Diffstat (limited to 'Src/subst.c')
| -rw-r--r-- | Src/subst.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/Src/subst.c b/Src/subst.c index 87a56c3c6..465fe970f 100644 --- a/Src/subst.c +++ b/Src/subst.c @@ -3362,13 +3362,15 @@ colonsubscript: return NULL; } if (*check_offset2) { + char *nextp; check_offset = check_colon_subscript(check_offset2 + 1, - &check_offset2); - if (*check_offset2 && *check_offset2 != ':') { - zerr("invalid length: %s", check_offset); - return NULL; - } + &nextp); if (check_offset) { + check_offset2 = nextp; + if (*check_offset2 && *check_offset2 != ':') { + zerr("invalid length: %s", check_offset); + return NULL; + } length = mathevali(check_offset); length_set = 1; if (errflag) |