From 47a7fbe438ee7350a2b151e007f07043ef596775 Mon Sep 17 00:00:00 2001
From: Nikias Bassen
Date: Fri, 13 Jan 2023 21:29:26 +0100
Subject: oplist: Fix another OOB read

Credit to OSS-Fuzz
---
 .../clusterfuzz-testcase-minimized-oplist_fuzzer-4503815405830144      | 1 +
 src/oplist.c                                                           | 3 +++
 2 files changed, 4 insertions(+)
 create mode 100644 fuzz/oplist-crashes/clusterfuzz-testcase-minimized-oplist_fuzzer-4503815405830144

diff --git a/fuzz/oplist-crashes/clusterfuzz-testcase-minimized-oplist_fuzzer-4503815405830144 b/fuzz/oplist-crashes/clusterfuzz-testcase-minimized-oplist_fuzzer-4503815405830144
new file mode 100644
index 0000000..11496c4
--- /dev/null
+++ b/fuzz/oplist-crashes/clusterfuzz-testcase-minimized-oplist_fuzzer-4503815405830144
@@ -0,0 +1 @@
+"3ÿÿÿÿ"= /// hÐo/**5/*(*///6/*/#o/,{Å	
\ No newline at end of file
diff --git a/src/oplist.c b/src/oplist.c
index 0ad1d1c..122440f 100644
--- a/src/oplist.c
+++ b/src/oplist.c
@@ -508,6 +508,9 @@ static void parse_skip_ws(parse_ctx ctx)
                     ctx->pos++;
                 }
             }
+            if (ctx->pos >= ctx->end) {
+                break;
+            }
         }
         // break on any char that's not white space
         if (!(((*(ctx->pos) == ' ') || (*(ctx->pos) == '\t') || (*(ctx->pos) == '\r') || (*(ctx->pos) == '\n')))) {
-- 
cgit v1.1-32-gdbae