Fix out of bounds read (Brooks Davis)
(reproduce by starting tcsh and hitting tab at the prompt)
See:
http://mx.gw.com/pipermail/tcsh-bugs/2016-December/001103.html
for more details.
Upstream fix at:
https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596
--- tcsh-6.19.00/ed.chared.c.orig 2016-12-07 06:26:09.076227132 +0000
+++ tcsh-6.19.00/ed.chared.c 2016-12-07 06:26:41.976633276 +0000
@@ -750,7 +750,7 @@
/*
* If we found a history character, go expand it.
*/
- if (HIST != '\0' && *p == HIST)
+ if (p >= InputBuf && HIST != '\0' && *p == HIST)
nr_exp = c_excl(p);
else
nr_exp = 0;