parse.y: fix parser_yyerror

* parse.y (parser_yyerror): fix buffer overflow at truncation of
  error line.  [ruby-core:81790] [Bug #13687]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59188 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 10 insertions, 8 deletions

diff --git a/parse.y b/parse.y
index adae297678..833eda062c 100644
--- a/parse.y
+++ b/parse.y
@@ -5074,14 +5074,16 @@ parser_yyerror(struct parser_params *parser, const char *msg)
 	buf = ALLOCA_N(char, i+2);
 	code = p;
 	caret = p2 = buf;
-	i = (int)(parser->tokp - p);
-	while (i-- > 0) {
-	    *p2++ = *p++ == '\t' ? '\t' : ' ';
-	}
-	*p2++ = '^';
-	if (lex_p > parser->tokp + 1) {
-	    memset(p2, '~', (lex_p - parser->tokp) - 1);
-	    p2 += (lex_p - parser->tokp) - 1;
+	if (p <= parser->tokp) {
+	    while (p < parser->tokp) {
+		*p2++ = *p++ == '\t' ? '\t' : ' ';
+	    }
+	    *p2++ = '^';
+	    p++;
+	}
+	if (lex_p > p) {
+	    memset(p2, '~', (lex_p - p));
+	    p2 += (lex_p - p);
 	}
 	*p2 = '\0';
 	newline = "\n";