Fix for buffer overflows identified by libgmalloc

1 files changed, 4 insertions, 2 deletions

diff --git a/parse_util.cpp b/parse_util.cpp
index 2f95a3e2..5d8a1b1d 100644
--- a/parse_util.cpp
+++ b/parse_util.cpp
@@ -260,8 +260,7 @@ void parse_util_cmdsubst_extent(const wchar_t *buff, size_t cursor_pos, const wc
             /* No subshell found, all done */
             break;
         }
-        
-        /* Intrepret NULL to mean the end */
+        /* Interpret NULL to mean the end */
         if (end == NULL)
         {
             end = const_cast<wchar_t *>(buff) + bufflen;
@@ -273,6 +272,9 @@ void parse_util_cmdsubst_extent(const wchar_t *buff, size_t cursor_pos, const wc
             begin++;
             ap = begin;
             bp = end;
+            /* pos is where to begin looking for the next one. But if we reached the end there's no next one. */
+            if (begin >= end)
+                break;
             pos = begin + 1;
         }
         else if (begin >= cursor)