You have to do the bounds check before the access.

diff --git a/apt-pkg/tagfile.cc b/apt-pkg/tagfile.cc
index c5c668fd391005455a8d1159b4ca8936f8014b2c..1aa67cc6774f2cd97616324ffbf642e6028398eb 100644 (file)
--- a/apt-pkg/tagfile.cc
+++ b/apt-pkg/tagfile.cc
@@ -389,7 +389,7 @@ bool pkgTagSection::FindInternal(unsigned int Pos, const char *&Start,
    if (unlikely(Start > End))
       return _error->Error("Internal parsing error");
 
-   for (; isspace_ascii(End[-1]) != 0 && End > Start; --End);
+   for (; End > Start && isspace_ascii(End[-1]) != 0; --End);
 
    return true;
 }