tr [=
triggers a buffer overflow, which causes tr to process garbage data:
53: while (*arg) {
...
/* "[xyz...", i=x, arg points to y */
136: if (ENABLE_FEATURE_TR_EQUIV && i == '=') { /* [=CHAR=] */
*buffer++ = *arg; /* copy CHAR */
arg += 3; /* skip CHAR=] */
continue;
}
...
When line tr.c:136 is hit, i is "=", and arg points just past the end of the
original buffer. Then arg is incremented by 3, and the main loop at tr.c:53
continues processing garbage data.
1.patch [^] (525 bytes) 07-28-08 16:45 
