fix longstanding bug in pack('u',...) (reads garbage beyond the end

of the input string)

p4raw-id: //depot/maint-5.005/perl@1712

diff --git a/pp.c b/pp.c
index 8068f41..60cb417 100644 (file)
--- a/pp.c
+++ b/pp.c
@@ -3653,7 +3653,7 @@ doencodes(register SV *sv, register char *s, register I32 len)
     *hunk = uuemap[len];
     sv_catpvn(sv, hunk, 1);
     hunk[4] = '\0';
-    while (len > 0) {
+    while (len > 2) {
        hunk[0] = uuemap[(077 & (*s >> 2))];
        hunk[1] = uuemap[(077 & ((*s << 4) & 060 | (s[1] >> 4) & 017))];
        hunk[2] = uuemap[(077 & ((s[1] << 2) & 074 | (s[2] >> 6) & 03))];
@@ -3662,6 +3662,14 @@ doencodes(register SV *sv, register char *s, register I32 len)
        s += 3;
        len -= 3;
     }
+    if (len > 0) {
+       char r = (len > 1 ? s[1] : '\0');
+       hunk[0] = uuemap[(077 & (*s >> 2))];
+       hunk[1] = uuemap[(077 & ((*s << 4) & 060 | (r >> 4) & 017))];
+       hunk[2] = uuemap[(077 & ((r << 2) & 074))];
+       hunk[3] = uuemap[0];
+       sv_catpvn(sv, hunk, 4);
+    }
     sv_catpvn(sv, "\n", 1);
 }