Created attachment 321796 [details] [review]
proposed patch / fix

Running "make check" with glib when compiled with Address Sanitizer shows an out of bounds error in the file gvariant-parser.c (line 240), function token_stream_prepare().

This is the code in question:
      for (end = stream->stream + 1;
           end != stream->end && *end != ',' &&
           *end != ':' && *end != '>' && *end != ']' && !g_ascii_isspace (*end);
           end++)

What happens is that stream->end is not really set to the end of the stream (it's zero, set in g_variant_new_parsed_va(), line 2461). Therefore the end of the string is not detected.

I have attached a patch to fix this, but I propose someone more familiar with this code checks if this is a good way to fix it. I add an additional check for a terminating null byte in the for condition.
Another way to fix this would be to make sure that stream->end is always set to a valid value (could be done in line 2461 by using "format + strlen(format)"), but as this function is called from various other functions I'm not sure this is wanted and it seems the code is written in a way that it expects that the stream end can be set to zero.