svn commit: r309418 - head/usr.bin/indent

[Pedro F. Giffuni]

Author: pfg
Date: Fri Dec  2 16:41:08 2016
New Revision: 309418
URL: https://svnweb.freebsd.org/changeset/base/309418

Log:
  indent(1): Avoid out-of-bound accesses of arrays.
  
  ps.paren_indents:
  When ps.paren_level was 0, this was accessing paren_indents[-1].
  
  in_buffer:
  This fragment checks if "*/" was read, but there's no guarantee that there
  is more than one byte in the array (actually, this happens frequently for
  the "{" in things like "int main(void) {").
  
  Submitted by:	 Piotr Stefaniak

Modified:
  head/usr.bin/indent/io.c

Modified: head/usr.bin/indent/io.c
==============================================================================
--- head/usr.bin/indent/io.c	Fri Dec  2 16:32:14 2016	(r309417)
+++ head/usr.bin/indent/io.c	Fri Dec  2 16:41:08 2016	(r309418)
@@ -278,7 +278,8 @@ inhibit_newline:
     *(e_com = s_com = combuf + 1) = '\0';
     ps.ind_level = ps.i_l_follow;
     ps.paren_level = ps.p_l_follow;
-    paren_target = -ps.paren_indents[ps.paren_level - 1];
+    if (ps.paren_level > 0)
+	paren_target = -ps.paren_indents[ps.paren_level - 1];
     not_first_line = 1;
 }
 
@@ -371,7 +372,7 @@ fill_buffer(void)
     }
     buf_ptr = in_buffer;
     buf_end = p;
-    if (p[-2] == '/' && p[-3] == '*') {
+    if (p - in_buffer > 2 && p[-2] == '/' && p[-3] == '*') {
 	if (in_buffer[3] == 'I' && strncmp(in_buffer, "/**INDENT**", 11) == 0)
 	    fill_buffer();	/* flush indent error message */
 	else {