svn commit: r1544785 - /subversion/trunk/subversion/libsvn_subr/config_file.c

[rh...@apache.org]

Author: rhuijben
Date: Sat Nov 23 13:07:34 2013
New Revision: 1544785

URL: http://svn.apache.org/r1544785
Log:
* subversion/libsvn_subr/config_file.c
  (skip_to_eoln): Following up on r1544716, document an assumption and
    avoid reading after the buffer.

The out of bounds problem was
Found by: danielsh

Modified:
    subversion/trunk/subversion/libsvn_subr/config_file.c

Modified: subversion/trunk/subversion/libsvn_subr/config_file.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_subr/config_file.c?rev=1544785&r1=1544784&r2=1544785&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_subr/config_file.c (original)
+++ subversion/trunk/subversion/libsvn_subr/config_file.c Sat Nov 23 13:07:34 2013
@@ -187,9 +187,13 @@ skip_to_eoln(parse_context_t *ctx, int *
   while (ch != '\n' && ch != EOF)
     {
       /* This is much faster than checking individual bytes.
-       * We use this function a lot when skipping comment lines. */
-      const char *newline = memchr(ctx->parser_buffer + ctx->buffer_pos,
-                                   '\n', ctx->buffer_size);
+       * We use this function a lot when skipping comment lines.
+       *
+       * This assumes that the ungetc buffer is empty, but that is a
+       * safe assumption right after reading a character (which would
+       * clear the buffer. */
+      const char *newline = memchr(ctx->parser_buffer + ctx->buffer_pos, '\n',
+                                   ctx->buffer_size - ctx->buffer_pos);
       if (newline)
         {
           ch = '\n';