From 8f7104f203e78671bfd74e94190aeee515e6493c Mon Sep 17 00:00:00 2001 From: Flavio Toffalini Date: Wed, 7 Oct 2026 10:03:38 +0000 Subject: [PATCH] Stop the trailing-space strip at the value start After an unquoted value ucl_parse_value strips trailing whitespace by walking back from chunk->pos with no lower bound. When the value is empty and starts the chunk - the parser is in a value state from the previous chunk, say '[', and the next chunk opens with ',', ';', '}' or a NUL - the loop reads the byte before the chunk's buffer, a one-byte overread. Within a single chunk that byte belongs to the same buffer, so only multi-chunk input exposes it; the outcome ('string value must not be empty') is the same either way. Bound the loop by the value start. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01W3aXdPKAnVwjiNtZstnmPj --- src/ucl_parser.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/ucl_parser.c b/src/ucl_parser.c index 434d41a..4453494 100644 --- a/src/ucl_parser.c +++ b/src/ucl_parser.c @@ -2169,7 +2169,8 @@ ucl_parse_value(struct ucl_parser *parser, struct ucl_chunk *chunk) } /* Cut trailing spaces */ stripped_spaces = 0; - while (ucl_test_character(*(chunk->pos - 1 - stripped_spaces), + while (chunk->pos - stripped_spaces > c && + ucl_test_character(*(chunk->pos - 1 - stripped_spaces), UCL_CHARACTER_WHITESPACE)) { stripped_spaces++; }