[Pcsclite-cvs-commit] r6131 - /trunk/PCSC/src/tokenparser.l

[rousseau at users.alioth.debian.org]

Author: rousseau
Date: Mon Dec  5 15:21:17 2011
New Revision: 6131

URL: http://svn.debian.org/wsvn/pcsclite/?sc=1&rev=6131
Log:
eval_value(): avoid a buffer read overflow in & management

We shall stop the loop when we find a \0 in the source, not in the
destination (4 characters later)

Modified:
    trunk/PCSC/src/tokenparser.l

Modified: trunk/PCSC/src/tokenparser.l
URL: http://svn.debian.org/wsvn/pcsclite/trunk/PCSC/src/tokenparser.l?rev=6131&op=diff
==============================================================================
--- trunk/PCSC/src/tokenparser.l (original)
+++ trunk/PCSC/src/tokenparser.l Mon Dec  5 15:21:17 2011
@@ -114,7 +114,7 @@
 		char *p;
 
 		/* just skip "amp;" substring (4 letters) */
-		for (p = amp+1; *p; p++)
+		for (p = amp+1; *(p+4); p++)
 		{
 			*p = *(p+4);
 		}