Fix UB in ebrowse

* lib-src/ebrowse.c (matching_regexp): Avoid writing beyond the
limits of 'matching_regexp_buffer'.  Patch by Jan Stranik
<jan@stranik.org>.  (Bug#53333)

Copyright-paperwork-exempt: yes

diff --git a/lib-src/ebrowse.c b/lib-src/ebrowse.c
index 04ae018464e9fe60891ca15a28c1cb4db0823e6a..ac7e790187814c12b00267bb5265447f51585b25 100644 (file)
--- a/lib-src/ebrowse.c
+++ b/lib-src/ebrowse.c
@@ -1925,7 +1925,15 @@ matching_regexp (void)
       *--s = *--t;
 
       if (*s == '"' || *s == '\\')
-        *--s = '\\';
+       {
+         if (s > matching_regexp_buffer)
+           *--s = '\\';
+         else
+           {
+             s++;
+             break;
+           }
+       }
     }
 
   *(matching_regexp_end_buf - 1) = '\0';