commit 106c4ee7f53ef800a82fce9638f29756e8b78640
author Nikias Bassen <nikias@gmx.li> Tue Feb 15 04:30:07 2022 +0100
committer Nikias Bassen <nikias@gmx.li> Tue Feb 15 04:30:07 2022 +0100
tree 059cc4eb656ef5cc44da4084e387f60aec62ce62
parent 38759317cbda07288f48268cf0c1bebaf54ef869

jplist: Fix another OOB read by using correct bounds check

Credit to OSS-Fuzz

src/jplist.c

diff --git a/src/jplist.c b/src/jplist.c
index 978c5f9..45f0544 100644
--- a/src/jplist.c
+++ b/src/jplist.c
@@ -490,7 +490,7 @@
         if (endp >= str_end) {
             /* integer */
             val = plist_new_uint((uint64_t)intpart);
-        } else if ((*endp == '.' && endp+1 < str_end && isdigit(*(endp+1))) || ((*endp == 'e' || *endp == 'E') && endp < str_end && (isdigit(*(endp+1)) || ((*(endp+1) == '-') && endp+1 < str_end && isdigit(*(endp+2)))))) {
+        } else if ((*endp == '.' && endp+1 < str_end && isdigit(*(endp+1))) || ((*endp == 'e' || *endp == 'E') && endp+1 < str_end && (isdigit(*(endp+1)) || ((*(endp+1) == '-') && endp+2 < str_end && isdigit(*(endp+2)))))) {
             /* floating point */
             double dval = (double)intpart;
             char* fendp = endp;