In Perl_pv_escape(), avoid reading 1 byte beyond the end of the buffer.

The check for whether to use 3 digits of octal was not correct, and was capable
of reading the byte beyond the passed in buffer. Except for the small
possibility that that byte was not mapped memory, it wouldn't change the
semantic correctness of the escaped output, but it would lead to
non-deterministic choice of which format to use.

1 files changed, 1 insertions, 1 deletions

diff --git a/dump.c b/dump.c
index 32e7596c63..9624970188 100644
--- a/dump.c
+++ b/dump.c
@@ -321,7 +321,7 @@ Perl_pv_escape( pTHX_ SV *dsv, char const * const str,
                             chsize = 1;
                         break;
 		default:
-                        if ( (pv < end) && isDIGIT((U8)*(pv+readsize)) )
+                        if ( (pv+readsize < end) && isDIGIT((U8)*(pv+readsize)) )
                             chsize = my_snprintf( octbuf, PV_ESCAPE_OCTBUFSIZE, 
                                                   "%c%03o", esc, c);
 			else