Shebang without trailing newline causes buffer overflow (segfault)

[sjoqvist]

Given an input file like

#!/usr/bin/env lci

without a trailing newline, the interpreter segfaults.

Expected: An error message instead of a crash.

The reason is the following piece of code, which doesn't check the buffer length while searching for trailing '\n' or '\r'.

lci/main.c

Lines 210 to 215 in 6762b72

	/* Remove hash bang line if run as a standalone script */
	if (buffer[0] == '#' && buffer[1] == '!') {
	unsigned int n;
	for (n = 0; buffer[n] != '\n' && buffer[n] != '\r'; n++)
	buffer[n] = ' ';
	}

(Note that this is a crash that only occurs on malformed input files.)