 |
Check for empty destination before NUL-terminating - libgrapheme - unicode stri… |
 |
git clone git://git.suckless.org/libgrapheme |
 |
Log |
|
Files |
|
Refs |
|
README |
|
LICENSE |
|
--- |
|
commit ad4877023146953d4daa8d91c119124c38620337 |
|
parent 4b4292a8f78eec4271213982fdddaf1c479dfe96 |
|
Author: Christopher Wellons <[email protected]> |
|
Date: Fri, 7 Oct 2022 11:33:10 -0400 |
|
|
|
Check for empty destination before NUL-terminating |
|
|
|
This overflow was triggered in the second test of to_lowercase_utf8 |
|
where the destination is zero length (w->destlen == 0). `w->destlen` |
|
would overflow by subtraction, then the subscript would overflow the |
|
destination. |
|
|
|
Signed-off-by: Laslo Hunhold <[email protected]> |
|
|
|
Diffstat: |
|
M src/util.c | 2 +- |
|
|
|
1 file changed, 1 insertion(+), 1 deletion(-) |
|
--- |
|
diff --git a/src/util.c b/src/util.c |
|
@@ -207,7 +207,7 @@ herodotus_writer_nul_terminate(HERODOTUS_WRITER *w) |
|
} else { /* w->type == HERODOTUS_TYPE_UTF8 */ |
|
((char *)(w->dest))[w->first_unwritable_offset] = '\0'; |
|
} |
|
- } else { |
|
+ } else if (w->destlen > 0) { |
|
/* |
|
* In this case, there is no more space in the buffer and |
|
* the last unwritable offset is larger than |
