From d59e9a479ac74b8addc96c4bceeb3845464a05f8 Mon Sep 17 00:00:00 2001
From: Kaz Kylheku <kaz@kylheku.com>
Date: Tue, 6 May 2025 18:32:36 -0700
Subject: buf: buf_ash: fix buffer overrrun.

* buf.c (buf_ash): Loop must be clamped the
smaller length of the result, cnlen.
---
 buf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/buf.c b/buf.c
index e83eb121..0bb21a5c 100644
--- a/buf.c
+++ b/buf.c
@@ -1456,7 +1456,7 @@ val buf_ash(val buf, val bits)
       struct buf *nbh = buf_handle(nbuf, self);
       ucnum i;
 
-      for (i = 0; i < len; i++) {
+      for (i = 0; i < cnlen; i++) {
         unsigned by = bh->data[i + v];
         nbh->data[i] = (by | acc) >> r;
         acc = by << 8;
-- 
cgit v1.2.3