This function looks for '(?{' style strings in a pattern. If the last char
in the pattern was '(', it could read a couple of bytes off the end of
the pattern. This is harmless from a logic and security viewpoint since
false positives are ok; but I'm still fixing it for correctness's sake.
}
/* TODO ideally should handle [..], (#..), /#.../x to reduce false
* positives here */
- if (pat[s] == '(' && pat[s+1] == '?' &&
- (pat[s+2] == '{' || (pat[s+2] == '?' && pat[s+3] == '{'))
+ if (pat[s] == '(' && s+2 <= plen && pat[s+1] == '?' &&
+ (pat[s+2] == '{'
+ || (s + 2 <= plen && pat[s+2] == '?' && pat[s+3] == '{'))
)
return 1;
}