Re: Possible NULL deref in cfp_matcher_range?

[Mikael Magnusson <mikachu@xxxxxxxxx>]

On Sun, Jul 5, 2015 at 7:34 PM, Peter Stephenson
<p.w.stephenson@xxxxxxxxxxxx> wrote:
> On Sun, 5 Jul 2015 16:52:19 +0200
> Mikael Magnusson <mikachu@xxxxxxxxx> wrote:
>> Checking some stuff with clang, and it complained here;
>>
>>         addc = (wchar_t)(*p == Meta ? p[1] ^ 32 : *p);
>>
>> First run through this code p is NULL, and the other places all (at
>> least the ones I looked at) protect accesses to p by "if (ret)" (which
>> is set at the same time as p). Should this do that, and/or do
>> something clever with len at the same time? Is there any way to
>> actually trigger addc to be WEOF here? Presumably if it is WEOF on the
>> second run when  is set, then it was also WEOF the first time.
>
> Actually, I suspect it's supposed to do this with the input chaaracter,
> not the output...

That makes even more sense. :)

-- 
Mikael Magnusson