From cb08e2f59f2166660abc998a0554e64c61d4a0f5 Mon Sep 17 00:00:00 2001
From: Phil Pennock <phil+git@pennock-tech.com>
Date: Thu, 29 Oct 2020 19:00:51 -0400
Subject: SECURITY: fix Qualys CVE-2020-PFPSN

(cherry picked from commit 93b6044e1636404f3463f3e1113098742e295542)
(cherry picked from commit 4e59a5d5c448e1fcdcbead268ffe6561adf0224d)
---
 src/src/parse.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'src')

diff --git a/src/src/parse.c b/src/src/parse.c
index 18a6df198..7dfb9a7eb 100644
--- a/src/src/parse.c
+++ b/src/src/parse.c
@@ -1129,9 +1129,17 @@ while (s < end)
             {
             if (ss >= end) ss--;
             *t++ = '(';
-            Ustrncpy(t, s, ss-s);
-            t += ss-s;
-            s = ss;
+            if (ss < s)
+              {
+              /* Someone has ended the string with "<punct>(". */
+              ss = s;
+              }
+            else
+              {
+              Ustrncpy(t, s, ss-s);
+              t += ss-s;
+              s = ss;
+              }
             }
           }
 
-- 
cgit v1.2.3