From: Eli Zaretskii <eliz@gnu.org>
Date: Thu, 20 Jan 2022 11:42:56 +0000 (+0200)
Subject: Fix UB in ebrowse
X-Git-Tag: emacs-28.0.92~91
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=11ea45c9e47d13e13e3e539551e2df300f995c11;p=emacs.git

Fix UB in ebrowse

* lib-src/ebrowse.c (matching_regexp): Avoid writing beyond the
limits of 'matching_regexp_buffer'.  Patch by Jan Stranik
<jan@stranik.org>.  (Bug#53333)

Copyright-paperwork-exempt: yes
---

diff --git a/lib-src/ebrowse.c b/lib-src/ebrowse.c
index 04ae018464e..ac7e7901878 100644
--- a/lib-src/ebrowse.c
+++ b/lib-src/ebrowse.c
@@ -1925,7 +1925,15 @@ matching_regexp (void)
       *--s = *--t;
 
       if (*s == '"' || *s == '\\')
-        *--s = '\\';
+	{
+	  if (s > matching_regexp_buffer)
+	    *--s = '\\';
+	  else
+	    {
+	      s++;
+	      break;
+	    }
+	}
     }
 
   *(matching_regexp_end_buf - 1) = '\0';