[7639] read_quoted_string

[gavinsmith0123]

Revision: 7639
          http://svn.sv.gnu.org/viewvc/?view=rev&root=texinfo&revision=7639
Author:   gavin
Date:     2017-01-21 09:40:01 -0500 (Sat, 21 Jan 2017)
Log Message:
-----------
read_quoted_string

Modified Paths:
--------------
    trunk/ChangeLog
    trunk/info/info-utils.c

Modified: trunk/ChangeLog
===================================================================
--- trunk/ChangeLog     2017-01-21 13:54:06 UTC (rev 7638)
+++ trunk/ChangeLog     2017-01-21 14:40:01 UTC (rev 7639)
@@ -1,3 +1,10 @@
+2017-01-21  Gavin Smith  <address@hidden>
+
+       * info/info-utils.c (read_quoted_string): If no 177 byte is
+       found to close a string, return 0 as intended.  This is intended 
+       to avoid reading past the end of allocated memory, which could 
+       happen for malformed input.  (Hanno B\xF6ck, bug-texinfo 2016-10-18.)
+
 2017-01-21  Jason Hood  <address@hidden>  (tiny change)
 
        * info/infomap.c (fetch_user_maps) [__MINGW32__]: Try to get

Modified: trunk/info/info-utils.c
===================================================================
--- trunk/info/info-utils.c     2017-01-21 13:54:06 UTC (rev 7638)
+++ trunk/info/info-utils.c     2017-01-21 14:40:01 UTC (rev 7639)
@@ -188,6 +188,7 @@
 
       if (*terminator && !(start + 1)[len])
         {
+          /* No closing 177 byte. */
           len = 0;
           *output = 0;
         }
@@ -196,9 +197,9 @@
           *output = xmalloc (len + 1);
           strncpy (*output, start + 1, len);
           (*output)[len] = '\0';
+          len += 2; /* Count the two 177 bytes. */
         }
 
-      len += 2;
     }
 
   if (nl)