[src/trunk]: src/usr.bin/make ParseTrackInput: do not access beyond end of bu...

[sjg <sjg%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d97189b905d7
branches:  trunk
changeset: 811992:d97189b905d7
user:      sjg <sjg%NetBSD.org@localhost>
date:      Thu Nov 26 00:23:04 2015 +0000

description:
ParseTrackInput: do not access beyond end of buffer.

Detected by Address Sanitizer - dim at FreeBSD.org

diffstat:

 usr.bin/make/parse.c |  10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diffs (46 lines):

diff -r 7bb84d98dff4 -r d97189b905d7 usr.bin/make/parse.c
--- a/usr.bin/make/parse.c      Thu Nov 26 00:06:59 2015 +0000
+++ b/usr.bin/make/parse.c      Thu Nov 26 00:23:04 2015 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: parse.c,v 1.205 2015/10/11 04:51:24 sjg Exp $  */
+/*     $NetBSD: parse.c,v 1.206 2015/11/26 00:23:04 sjg Exp $  */
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1993
@@ -69,14 +69,14 @@
  */
 
 #ifndef MAKE_NATIVE
-static char rcsid[] = "$NetBSD: parse.c,v 1.205 2015/10/11 04:51:24 sjg Exp $";
+static char rcsid[] = "$NetBSD: parse.c,v 1.206 2015/11/26 00:23:04 sjg Exp $";
 #else
 #include <sys/cdefs.h>
 #ifndef lint
 #if 0
 static char sccsid[] = "@(#)parse.c    8.3 (Berkeley) 3/19/94";
 #else
-__RCSID("$NetBSD: parse.c,v 1.205 2015/10/11 04:51:24 sjg Exp $");
+__RCSID("$NetBSD: parse.c,v 1.206 2015/11/26 00:23:04 sjg Exp $");
 #endif
 #endif /* not lint */
 #endif
@@ -2380,15 +2380,19 @@
 ParseTrackInput(const char *name)
 {
     char *old;
+    char *ep;
     char *fp = NULL;
     size_t name_len = strlen(name);
     
     old = Var_Value(MAKE_MAKEFILES, VAR_GLOBAL, &fp);
     if (old) {
+       ep = old + strlen(old) - name_len;
        /* does it contain name? */
        for (; old != NULL; old = strchr(old, ' ')) {
            if (*old == ' ')
                old++;
+           if (old >= ep)
+               break;                  /* cannot contain name */
            if (memcmp(old, name, name_len) == 0
                    && (old[name_len] == 0 || old[name_len] == ' '))
                goto cleanup;