Change #282081

Comments

tool_help: guard category[2] access when category is bare "-"
When category is "-" (length 1), category[1] is already the null
terminator. The else-if on line 272 then reads category[2] without first
confirming category[1] is non-null, producing a one-byte
heap-buffer-overflow that ASan flags. Add the category[1] guard so the
short-option path is only taken for exactly two-character inputs like
"-x".

Closes #22957

Changed files

• src/tool_help.c