diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-24 12:21:49 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2017-01-06 14:20:43 +0000 |
| commit | 07499d6c018f1e7ab01faba676a27f250c225a9d (patch) | |
| tree | df36f7995a3b26435a44214b599980fc7877e1a5 /libwc/wtf.c | |
| parent | Preserve one byte for end of string character in form_update_line() (diff) | |
| download | w3m-07499d6c018f1e7ab01faba676a27f250c225a9d.tar.gz w3m-07499d6c018f1e7ab01faba676a27f250c225a9d.zip | |
Prevent overflow beyond the end of string in wtf_parse1()v0.5.3+debian-19+deb8u2
Bug-Debian: https://github.com/tats/w3m/issues/68
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=00433f4ac2645ac6236ea1892b4a93f26a039a84
Diffstat (limited to 'libwc/wtf.c')
| -rw-r--r-- | libwc/wtf.c | 44 |
1 files changed, 32 insertions, 12 deletions
diff --git a/libwc/wtf.c b/libwc/wtf.c index cdc6cbc..94d95c1 100644 --- a/libwc/wtf.c +++ b/libwc/wtf.c @@ -397,7 +397,7 @@ wtf_parse1(wc_uchar **p) cc.code = *(q++); } else if (*q > 0xa0) { cc.ccs = wtf_gr_ccs; - if (WC_CCS_IS_WIDE(cc.ccs)) { + if (WC_CCS_IS_WIDE(cc.ccs) && *(q+1)) { cc.code = ((wc_uint32)*q << 8) | *(q+1); q += 2; } else @@ -410,27 +410,47 @@ wtf_parse1(wc_uchar **p) case WC_CCS_A_CS942: case WC_CCS_A_PCS: case WC_CCS_A_UNKNOWN: - cc.ccs |= *(q++) & 0x7f; - cc.code = *(q++); + if (*q && *(q+1)) { + cc.ccs |= *(q++) & 0x7f; + cc.code = *(q++); + } else { + cc.ccs = WC_CCS_US_ASCII; + cc.code = (wc_uint32)' '; + } break; case WC_CCS_A_CS94W: case WC_CCS_A_CS96W: case WC_CCS_A_PCSW: - cc.ccs |= *(q++) & 0x7f; - cc.code = ((wc_uint32)*q << 8) | *(q+1); - q += 2; + if (*q && *(q+1) && *(q+2)) { + cc.ccs |= *(q++) & 0x7f; + cc.code = ((wc_uint32)*q << 8) | *(q+1); + q += 2; + } else { + cc.ccs = WC_CCS_US_ASCII; + cc.code = (wc_uint32)' '; + } break; case WC_CCS_A_WCS16: case WC_CCS_A_WCS16W: - cc.ccs |= (*q & 0x7c) >> 2; - cc.code = wtf_to_wcs16(q); - q += 3; + if (*q && *(q+1) && *(q+2)) { + cc.ccs |= (*q & 0x7c) >> 2; + cc.code = wtf_to_wcs16(q); + q += 3; + } else { + cc.ccs = WC_CCS_US_ASCII; + cc.code = (wc_uint32)' '; + } break; case WC_CCS_A_WCS32: case WC_CCS_A_WCS32W: - cc.ccs |= (*q & 0x70) >> 4; - cc.code = wtf_to_wcs32(q); - q += 5; + if (*q && *(q+1) && *(q+2) && *(q+3) && *(q+4)) { + cc.ccs |= (*q & 0x70) >> 4; + cc.code = wtf_to_wcs32(q); + q += 5; + } else { + cc.ccs = WC_CCS_US_ASCII; + cc.code = (wc_uint32)' '; + } break; default: /* case 0: */ |