PATCH: GH #17367 read 1 beyond end of buffer

This is a bug in grok_infnan() in which in one place it failed to check
that it was reading within bounds.

1 files changed, 3 insertions, 0 deletions

diff --git a/numeric.c b/numeric.c
index db8197c259..142f61753a 100644
--- a/numeric.c
+++ b/numeric.c
@@ -791,6 +791,9 @@ Perl_grok_infnan(pTHX_ const char** sp, const char* send)
                 /* "nanq" or "nans" are ok, though generating
                  * these portably is tricky. */
                 s++;
+                if (s == send) {
+                    return flags;
+                }
             }
             if (*s == '(') {
                 /* C99 style "nan(123)" or Perlish equivalent "nan($uv)". */