Subject: Re: bug#50611: one-byte (write) heap-buffer-underrun

From: Paul Eggert <[email-masked]>
Date: Thu, 16 Sep 2021 00:26:34 -0700

Thanks for reporting that. I installed the attached to fix it.
>From 121f74dfc2e060a2ae174a636cd773f4d461a852 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Thu, 16 Sep 2021 00:17:18 -0700
Subject: [PATCH] cksum: fix off-by-1 bug with \r stripping

Problem reported by Jim Meyering (Bug#50611).
* src/digest.c (digest_check): When stripping trailing \r,
avoid subscript error before start of line.
---
 src/digest.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/digest.c b/src/digest.c
index 0d7ce3265..fdf01b21b 100644
--- a/src/digest.c
+++ b/src/digest.c
@@ -1070,11 +1070,10 @@ digest_check (char const *checkfile_name)
         continue;
 
       /* Remove any trailing newline.  */
-      if (line[line_length - 1] == '\n')
-        line[--line_length] = '\0';
+      line_length -= line[line_length - 1] == '\n';
       /* Remove any trailing carriage return.  */
-      if (line[line_length - 1] == '\r')
-        line[--line_length] = '\0';
+      line_length -= line[line_length - (0 < line_length)] == '\r';
+      line[line_length] = '\0';
 
       if (! (split_3 (line, line_length, &hex_digest, &binary, &filename)
              && ! (is_stdin && STREQ (filename, "-"))))
-- 
2.30.2