From: Jeff King <peff@peff.net>
Date: Mon, 02 Jun 2014 06:47:06 GMT
Subject: Re: [PATCH] Improve function dir.c:trim_trailing_spaces()
Message-ID: <20140602064706.GB27254@sigill.intra.peff.net>
In-Reply-To: <1401549691-20788-1-git-send-email-pasha.bolokhov@gmail.com>

On Sat, May 31, 2014 at 08:21:31AM -0700, Pasha Bolokhov wrote:

> +	char *p, *last_space = NULL;
> +
> +	for (p = buf; *p; p++)
> +		if (*p == ' ') {
> +			if (!last_space)
> +				last_space = p;
> +		} else {
> +			if (*p == '\\')
> +				p++;
> +			last_space = NULL;
> +		}

Your backslash-escape works here by incrementing "p" an extra time. So
we move past the backslash to the next character (which is escaped), and
then the for-loop increments it again to the character beyond that,
which is the next one worth considering.

What happens if we are parsing a string with an unmatched backslash at
the end of the string, like:

  foo\

We consider the end-of-string NUL to be escaped, skip it, and then keep
reading whatever random bytes are in memory after the string.

The original version did not have a problem with this because it used
a length, which meant that  "i < len" caught this case.

I think you either need to insert an extra check for "!p[1]" when moving
past the escaped character, or move back to a length-based check.

-Peff