From a8b5272bb8d5afb81ebf93c9e4456a07afcf65fa Mon Sep 17 00:00:00 2001
From: Olaf Seibert <rhialto@falu.nl>
Date: Tue, 12 May 2015 21:40:13 +0200
Subject: [PATCH] Nested delimited strings had an infinite loop.

The code for nested and unnested strings was mixed, thereby being too
simple for the nested case. I separated them, which is simpler than
the fixed combined version.
Detected by the macro call
        ..EMIT <$FAC=^D<fb$rea>>
---
 parse.c | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/parse.c b/parse.c
index cc44885..a973878 100644
--- a/parse.c
+++ b/parse.c
@@ -569,10 +569,10 @@ int brackrange(
         endlen = 1;
         *start = 1;
         break;
-    case '/':	/* seen on page 6-52 */
-    case '?':	/* seen on page 6-52 */
-    case '\\':	/* seen on page 6-52 */
-    case '"':	/* seen in Kermit-11 source for RT11 */
+    case '/':   /* seen on page 6-52 */
+    case '?':   /* seen on page 6-52 */
+    case '\\':  /* seen on page 6-52 */
+    case '"':   /* seen in Kermit-11 source for RT11 */
         endstr[0] = cp[0];
         strcpy(endstr + 1, "\n");
         *start = 1;
@@ -585,15 +585,28 @@ int brackrange(
     cp += *start;
 
     len = 0;
-    nest = 1;
-    while (nest) {
+    if (endstr[1] == '>') { /* <>\n */
+        nest = 1;
+        while (nest) {
+            int             sublen;
+
+            sublen = strcspn(cp + len, endstr);
+            if (cp[len + sublen] == '<') {
+                nest++;
+                sublen++;  /* avoid infinite loop when sublen == 0 */
+            } else {
+                nest--;
+                if (nest > 0 && cp[len + sublen] == '>')
+                    sublen++;  /* avoid infinite loop when sublen == 0 */
+            }
+            len += sublen;
+            if (sublen == 0)
+                break;
+        }
+    } else {
         int             sublen;
 
         sublen = strcspn(cp + len, endstr);
-        if (cp[len + sublen] == '<')
-            nest++;
-        else
-            nest--;
         len += sublen;
     }