fix longstanding bug in pack('u',...) (reads garbage beyond the end

of the input string)

p4raw-id: //depot/maint-5.005/perl@1712

1 files changed, 9 insertions, 1 deletions

diff --git a/pp.c b/pp.c
index 8068f41d27..60cb4175e7 100644
--- a/pp.c
+++ b/pp.c
@@ -3653,7 +3653,7 @@ doencodes(register SV *sv, register char *s, register I32 len)
     *hunk = uuemap[len];
     sv_catpvn(sv, hunk, 1);
     hunk[4] = '\0';
-    while (len > 0) {
+    while (len > 2) {
 	hunk[0] = uuemap[(077 & (*s >> 2))];
 	hunk[1] = uuemap[(077 & ((*s << 4) & 060 | (s[1] >> 4) & 017))];
 	hunk[2] = uuemap[(077 & ((s[1] << 2) & 074 | (s[2] >> 6) & 03))];
@@ -3662,6 +3662,14 @@ doencodes(register SV *sv, register char *s, register I32 len)
 	s += 3;
 	len -= 3;
     }
+    if (len > 0) {
+	char r = (len > 1 ? s[1] : '\0');
+	hunk[0] = uuemap[(077 & (*s >> 2))];
+	hunk[1] = uuemap[(077 & ((*s << 4) & 060 | (r >> 4) & 017))];
+	hunk[2] = uuemap[(077 & ((r << 2) & 074))];
+	hunk[3] = uuemap[0];
+	sv_catpvn(sv, hunk, 4);
+    }
     sv_catpvn(sv, "\n", 1);
 }