From 0c98220148d6c4a89f357360c28a4fc890c4666b Mon Sep 17 00:00:00 2001
From: Eli Zaretskii <eliz@gnu.org>
Date: Mon, 12 Jul 2021 20:51:25 +0300
Subject: Avoid crashes in 'handle_block_command'

* tp/Texinfo/XS/parsetexi/handle_commands.c
(handle_block_command): Don't let 'memcmp' try accessing memory
past the end of the input buffer.
---
 ChangeLog                                 |  6 ++++++
 tp/Texinfo/XS/parsetexi/handle_commands.c | 19 +++++++++++--------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/tp/Texinfo/XS/parsetexi/handle_commands.c b/tp/Texinfo/XS/parsetexi/handle_commands.c
index fa3ce13..39c73c3 100644
--- a/tp/Texinfo/XS/parsetexi/handle_commands.c
+++ b/tp/Texinfo/XS/parsetexi/handle_commands.c
@@ -811,16 +811,19 @@ handle_block_command (ELEMENT *current, char **line_inout,
                 {
                   p += strspn (p, whitespace_chars);
                   /* Check for a comment at the end of the line. */
-                  if (memcmp (p, "@c", 2) == 0)
+                  if (*p)
                     {
-                      p += 2;
-                      if (memcmp (p, "omment", 6) == 0)
-                        p += 7;
-                      if (*p && *p != '@' && !strchr (whitespace_chars, *p))
-                        goto bad_value; /* @c or @comment not terminated. */
+		      if (memcmp (p, "@c", 2) == 0)
+			{
+			  p += 2;
+			  if (memcmp (p, "omment", 6) == 0)
+			    p += 7;
+			  if (*p && *p != '@' && !strchr (whitespace_chars, *p))
+			    goto bad_value; /* @c or @comment not terminated. */
+			}
+		      else
+			goto bad_value; /* Trailing characters on line. */
                     }
-                  else if (*p)
-                    goto bad_value; /* Trailing characters on line. */
                 }
               if (1)
                 {
-- 
cgit v1.1

