[hackers] [sbase][PATCH] tr gets stuck in infinite loop

From: Pieter Kockx <pieterkockx_AT_gmail.com>
Date: Wed, 04 Oct 2017 00:52:25 +0000

Hello hackers

tr '[a-z].' '[a-z]!'

The salient feature here is that the square bracket part is followed by at
least one extra character.

This extra character will involve makeset in an infinite loop:

// str = "[a]b"
for (i = 0; i < len; i++) {
  if (rstr[i] == '[') {
    j = i;
nextbrack:
    if (j == len) // (3) j==3 but len==4
                  // (6) INFINITE LOOP
      goto literal;
    for (m = j; m < len; m++) // (4) mlen
      if (rstr[m] == ']') {
        j = m; // (1) j==2 and m==2
        break;
      }

    // all conditions in between are false

    j = m + 1; // (2) j == 3
               // (5) j == len+1
    goto nextbrack;
}

literal:
  // not reached

Changing j == len to j >= len feels like sweeping the bug under the carpet.

Thoughts?

-- Pieter

Received on Wed Oct 04 2017 - 02:52:25 CEST