[PATCH 2/2] expand: pmatch(): Fix buffer overread caused by passing array of chars as string

[Zurab Kvachadze <zurabid2016@gmail.com>]

strpbrk() accepts two null-terminated string arguments. stop[] is char
array that is not null-terminated but is still passed as a second
argument to strpbrk. This causes buffer overread, which is detected by
AddressSanitizer.

This commit adds an explicit null-terminated to the end of the array.

Signed-off-by: Zurab Kvachadze <zurabid2016@gmail.com>
---
 src/expand.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/expand.c b/src/expand.c
index 171c135..8cff60d 100644
--- a/src/expand.c
+++ b/src/expand.c
@@ -1890,7 +1890,9 @@ static __attribute__((noinline)) int ccmatch(char *p, const char *mbc, int ml,
 
 static int pmatch(char *pattern, const char *string)
 {
-	char stop[] = { 0, CTLESC, CTLMBCHAR };
+    /* stop should be null-terminated as it passed as a string to
+     * strpbrk. */
+	char stop[] = { 0, CTLESC, CTLMBCHAR, '\0' };
 	const char *q;
 	unsigned mb;
 	char *p;
-- 
2.45.3