Hi,
There is a buffer overflow for array "tkn_arr".
In line 501, if the variable status<0, then the buffer overflow will happen in line 503. This can fix it:
int status = split(pThis, pThis->cursor, tkn_arr);
+ if (status < 0) {
+ return;
+ }
- if (pThis->cmdline[pThis->cursor-1] == '\0')
- tkn_arr[status++] = "";
+ if (pThis->cursor > 0 && pThis->cmdline[pThis->cursor - 1] == '\0') {
+ if (status < _COMMAND_TOKEN_NMB) {
+ tkn_arr[status++] = "";
+ }
+ }