PATCH: check we didn't advance past the end of string in getarg's search loops

[Mikael Magnusson <mikachu@xxxxxxxxx>]

% valgrind --track-origins=yes --trace-children=no -q Src/zsh -c 's=a; print -r -- "${s[(in:2:)*]}"
==22526== Invalid read of size 1
==22526==    at 0x4C7380: mb_metacharlenconv (utils.c:5615)
==22526==    by 0x482266: getarg (params.c:2008)
==22526==    by 0x48256B: getindex (params.c:2075)
==22526==    by 0x482FED: fetchvalue (params.c:2343)
==22526==    by 0x4B26EF: paramsubst (subst.c:2801)
==22526==    by 0x4AD1BA: stringsubst (subst.c:322)
==22526==    by 0x4AC55B: prefork (subst.c:142)
==22526==    by 0x438308: execcmd_exec (exec.c:3365)
==22526==    by 0x434B5B: execpline2 (exec.c:2074)
==22526==    by 0x43379E: execpline (exec.c:1799)
==22526==    by 0x432A05: execlist (exec.c:1549)
==22526==    by 0x432080: execode (exec.c:1330)
==22526==  Address 0x522ed12 is 0 bytes after a block of size 2 alloc'd
==22526==    at 0x48397B5: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==22526==    by 0x474C67: zalloc (mem.c:966)
==22526==    by 0x4ABCE5: ztrdup (string.c:68)
==22526==    by 0x4364D7: addvars (exec.c:2639)
==22526==    by 0x4321EB: execsimple (exec.c:1373)
==22526==    by 0x43283B: execlist (exec.c:1516)
==22526==    by 0x432080: execode (exec.c:1330)
==22526==    by 0x431EED: execstring (exec.c:1282)
==22526==    by 0x45BE33: init_misc (init.c:1571)
==22526==    by 0x45D3C9: zsh_main (init.c:1952)
==22526==    by 0x410D61: main (main.c:93)
==22526==
==22526== Invalid read of size 1
==22526==    at 0x4C73C0: mb_metacharlenconv (utils.c:5619)
==22526==    by 0x482266: getarg (params.c:2008)
==22526==    by 0x48256B: getindex (params.c:2075)
==22526==    by 0x482FED: fetchvalue (params.c:2343)
==22526==    by 0x4B26EF: paramsubst (subst.c:2801)
==22526==    by 0x4AD1BA: stringsubst (subst.c:322)
==22526==    by 0x4AC55B: prefork (subst.c:142)
==22526==    by 0x438308: execcmd_exec (exec.c:3365)
==22526==    by 0x434B5B: execpline2 (exec.c:2074)
==22526==    by 0x43379E: execpline (exec.c:1799)
==22526==    by 0x432A05: execlist (exec.c:1549)
==22526==    by 0x432080: execode (exec.c:1330)
==22526==  Address 0x522ed12 is 0 bytes after a block of size 2 alloc'd
==22526==    at 0x48397B5: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==22526==    by 0x474C67: zalloc (mem.c:966)
==22526==    by 0x4ABCE5: ztrdup (string.c:68)
==22526==    by 0x4364D7: addvars (exec.c:2639)
==22526==    by 0x4321EB: execsimple (exec.c:1373)
==22526==    by 0x43283B: execlist (exec.c:1516)
==22526==    by 0x432080: execode (exec.c:1330)
==22526==    by 0x431EED: execstring (exec.c:1282)
==22526==    by 0x45BE33: init_misc (init.c:1571)
==22526==    by 0x45D3C9: zsh_main (init.c:1952)
==22526==    by 0x410D61: main (main.c:93)
---
 Src/params.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/Src/params.c b/Src/params.c
index d8437d16d8..e898f8540f 100644
--- a/Src/params.c
+++ b/Src/params.c
@@ -1983,10 +1983,12 @@ getarg(char **str, int *inv, Value v, int a2, zlong *w,
 			    /* return pointer after matched char */
 			    lastpos +=
 				(lastcharlen = MB_METACHARLEN(lastpos));
-			    if (prevcharlen)
-				*prevcharlen = lastcharlen;
-			    if (nextcharlen)
-				*nextcharlen = MB_METACHARLEN(lastpos);
+			    if (lastpos <= de) {
+				if (prevcharlen)
+				    *prevcharlen = lastcharlen;
+				if (nextcharlen)
+				    *nextcharlen = MB_METACHARLEN(lastpos);
+			    }
 			    return lastpos - d;
 			}
 
@@ -2002,10 +2004,12 @@ getarg(char **str, int *inv, Value v, int a2, zlong *w,
 			    if (pprog && pattry(pprog, t) && !--num) {
 				/* return pointer after matched char */
 				t += (lastcharlen = MB_METACHARLEN(t));
-				if (prevcharlen)
-				    *prevcharlen = lastcharlen;
-				if (nextcharlen)
-				    *nextcharlen = MB_METACHARLEN(t);
+				if (t <= de) {
+				    if (prevcharlen)
+					*prevcharlen = lastcharlen;
+				    if (nextcharlen)
+					*nextcharlen = MB_METACHARLEN(t);
+				}
 				return t - d;
 			    }
 			    if (t == de)
-- 
2.38.1