Fix out-of-bounds read in c_substitute(): http://seclists.org/oss-sec/2016/q4/612 Patch copied from upstream source repository: https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 From 6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596 Mon Sep 17 00:00:00 2001 From: christos <christos> Date: Fri, 2 Dec 2016 16:59:28 +0000 Subject: [PATCH] Fix out of bounds read (Brooks Davis) (reproduce by starting tcsh and hitting tab at the prompt) --- ed.chared.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ed.chared.c b/ed.chared.c index 1277e53..310393e 100644 --- ed.chared.c +++ ed.chared.c @@ -750,7 +750,7 @@ c_substitute(void) /* * If we found a history character, go expand it. */ - if (HIST != '\0' && *p == HIST) + if (p >= InputBuf && HIST != '\0' && *p == HIST) nr_exp = c_excl(p); else nr_exp = 0;