From 4065f86f9a943c1ae2e655722e4cb221aa628fa5 Mon Sep 17 00:00:00 2001
From: Matt Mundell <matt@mundell.me>
Date: Fri, 29 May 2026 15:30:05 +0200
Subject: [PATCH] Fix: decrement past start of allocated memory in add_quoting

---
 util/cpeutils.c       |  4 ++--
 util/cpeutils_tests.c | 11 +++++++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/util/cpeutils.c b/util/cpeutils.c
index 15c4c75b3..d6d3f1643 100644
--- a/util/cpeutils.c
+++ b/util/cpeutils.c
@@ -938,7 +938,7 @@ add_quoting (const char *component)
       if (*c == '*')
         {
           if ((c == tmp_component)
-              || (c == tmp_component + strlen (tmp_component - 1)))
+              || (c == tmp_component + strlen (tmp_component) - 1))
             {
               g_string_append_c (quoted_component, *c);
               c++;
@@ -954,7 +954,7 @@ add_quoting (const char *component)
       if (*c == '?')
         {
           if ((c == tmp_component)
-              || (c == tmp_component + strlen (tmp_component - 1))
+              || (c == tmp_component + strlen (tmp_component) - 1)
               || (!embedded && (c > tmp_component) && (*(c - 1) == '?'))
               || (embedded && *(c + 1) == '?'))
             {
diff --git a/util/cpeutils_tests.c b/util/cpeutils_tests.c
index 68c42f473..8a8298d59 100644
--- a/util/cpeutils_tests.c
+++ b/util/cpeutils_tests.c
@@ -293,6 +293,16 @@ Ensure (cpeutils, uri_cpe_to_uri_product)
   g_free (uri_product);
 }
 
+Ensure (cpeutils, fs_cpe_to_uri_cpe_accepts_end_star)
+{
+  char *result;
+
+  result =
+    fs_cpe_to_uri_cpe ("cpe:2.3:*:microsoft:foo*:8.0.6001:beta:*:*:*:*:*:*");
+  assert_that (result, is_not_null);
+  g_free (result);
+}
+
 /* Test suite. */
 int
 main (int argc, char **argv)
@@ -310,6 +320,7 @@ main (int argc, char **argv)
   add_test_with_context (suite, cpeutils, fs_cpe_to_uri_cpe);
   add_test_with_context (suite, cpeutils, cpe_struct_match);
   add_test_with_context (suite, cpeutils, uri_cpe_to_uri_product);
+  add_test_with_context (suite, cpeutils, fs_cpe_to_uri_cpe_accepts_end_star);
 
   if (argc > 1)
     ret = run_single_test (suite, argv[1], create_text_reporter ());