tr: fix "access past the end of a string" bug 4354

2008-07-26 19:34:00 +00:00 · 2008-07-26 19:34:00 +00:00 · 5e40070d38
parent df96df9c7c
commit 5e40070d38
1 changed files with 1 additions and 1 deletions
--- a/coreutils/tr.c
+++ b/coreutils/tr.c
@ -138,7 +138,7 @@ static unsigned int expand(const char *arg, char *buffer)
 				arg += 3;	/* skip CHAR=] */
 				continue;
 			}
-			if (*arg != '-') { /* not [x-...] - copy verbatim */
+			if (i == '\0' || *arg != '-') { /* not [x-...] - copy verbatim */
 				*buffer++ = '[';
 				arg--; /* points to x */
 				continue; /* copy all, including eventual ']' */