3 files changed, 8 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index 0aa78129..8c712c46 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2016-06-26         Andrew J. Schorr     <aschorr@telemetry-investments.com>
 
+	* node.c (r_force_number): When checking for trailing spaces, protect
+	against running off the end of the string.
+	* mpfr.c (force_mpnum): Ditto.
+
+2016-06-26         Andrew J. Schorr     <aschorr@telemetry-investments.com>
+
 	* builtin.c (do_print): There's actually no reason to test whether a
 	value is a number, since the STRCUR flag and stfmt value contain all
 	the necessary info, as in awk.h:force_string.
diff --git a/mpfr.c b/mpfr.c
index b15c9b0b..f2c58116 100644
--- a/mpfr.c
+++ b/mpfr.c
@@ -327,7 +327,7 @@ force_mpnum(NODE *n, int do_nondec, int use_locale)
 	IEEE_FMT(n->mpg_numbr, tval);
 done:
 	/* trailing space is OK for NUMBER */
-	while (isspace((unsigned char) *ptr))
+	while (ptr < cpend && isspace((unsigned char) *ptr))
 		ptr++;
 	*cpend = save;
 	if (errno == 0 && ptr == cpend)
diff --git a/node.c b/node.c
index 39c25dfd..58b54561 100644
--- a/node.c
+++ b/node.c
@@ -136,7 +136,7 @@ r_force_number(NODE *n)
 	}
 
 	/* POSIX says trailing space is OK for NUMBER */
-	while (isspace((unsigned char) *ptr))
+	while (ptr < cpend && isspace((unsigned char) *ptr))
 		ptr++;
 
 	if (errno == 0) {