Buffer 'new_argv' is accessed without bound check after accessing with bound check via 'new_argc' index.
Showing the changes to scripts (1 of 1 file). Show all
Unified · Split
| @@ -396,6 +396,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[]) · 395 unmodified lines | |||
| 396 | 396 | ||
| 397 | p++; | 397 | p++; |
| 398 | } | 398 | } |
| 399 | |||
| 400 | if (new_argc >= FUNCTION_MAX_ARGS) | ||
| 401 | pperror("too many function arguments"); | ||
| 399 | new_argv[new_argc++] = prev; | 402 | new_argv[new_argc++] = prev; |
| 400 | 403 | ||
| 401 | /* | 404 | /* |