Fix boundary checking in base-256 decoder

* src/list.c (from_header): Base-256 encoding is at least 2 bytes long.
2023-02-11 11:57:39 +02:00
parent 02402920f8
commit 3da78400ea
1 changed files with 3 additions and 2 deletions
--- a/src/list.c
+++ b/src/list.c
@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
 	  where++;
 	}
    }
-  else if (*where == '\200' /* positive base-256 */
-	   || *where == '\377' /* negative base-256 */)
+  else if (where <= lim - 2
+	   && (*where == '\200' /* positive base-256 */
+	       || *where == '\377' /* negative base-256 */))
    {
      /* Parse base-256 output.  A nonnegative number N is
 	 represented as (256**DIGS)/2 + N; a negative number -N is