7214 make buffer under-read while parsing conditional variables
Reviewed by: Richard Lowe <richlowe@richlowe.net>
Reviewed by: Robert Mustacchi <rm@joyent.com>

*** 19,28 ****
--- 19,30 ----
   * CDDL HEADER END
   */
  /*
   * Copyright 2006 Sun Microsystems, Inc. All rights reserved.
   * Use is subject to license terms.
+  *
+  * Copyright 2016 RackTop Systems.
   */
  
  /*
   *      doname.c
   *
*** 2891,2902 ****
               conditional = get_prop(conditional->next, conditional_prop)) {
                  wcb1.init(conditional->body.conditional.target);
                  pattern = wcb1.get_string();
                  if (pattern[1] != 0) {
                          percent = (wchar_t *) wcschr(pattern, (int) percent_char);
                          if (!wcb.equaln(pattern, percent-pattern) ||
!                             !IS_WEQUAL(wcb.get_string(wcb.length()-wcslen(percent+1)), percent+1)) {
                                  continue;
                          }
                  }
                  for (previous = &target->prop;
                       *previous != NULL;
--- 2893,2908 ----
               conditional = get_prop(conditional->next, conditional_prop)) {
                  wcb1.init(conditional->body.conditional.target);
                  pattern = wcb1.get_string();
                  if (pattern[1] != 0) {
                          percent = (wchar_t *) wcschr(pattern, (int) percent_char);
+                         /* Check for possible buffer under-read */
+                         if ((length = wcb.length()-wcslen(percent+1)) <= 0) {
+                                 continue;
+                         }
                          if (!wcb.equaln(pattern, percent-pattern) ||
!                             !IS_WEQUAL(wcb.get_string(length), percent+1)) {
                                  continue;
                          }
                  }
                  for (previous = &target->prop;
                       *previous != NULL;