diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 11:41:29 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:19:28 +0000 |
| commit | d345c0950dfdef065b7377ecad0e4bc1d2601bf8 (patch) | |
| tree | 582aec6d1c82f1ffcb84db118676c60054f7aaef /libwc/wtf.c | |
| parent | Update ChangeLog (diff) | |
| download | w3m-d345c0950dfdef065b7377ecad0e4bc1d2601bf8.tar.gz w3m-d345c0950dfdef065b7377ecad0e4bc1d2601bf8.zip | |
Prevent overflow beyond the end of string in wtf_strwidth()
Bug-Debian: https://github.com/tats/w3m/issues/57
Diffstat (limited to 'libwc/wtf.c')
| -rw-r--r-- | libwc/wtf.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libwc/wtf.c b/libwc/wtf.c index b8cfdc7..69a8271 100644 --- a/libwc/wtf.c +++ b/libwc/wtf.c @@ -120,10 +120,14 @@ int wtf_strwidth(wc_uchar *p) { int w = 0; + size_t len; while (*p) { w += wtf_width(p); - p += WTF_LEN_MAP[*p]; + len = WTF_LEN_MAP[*p]; + if (len > strlen(p)) + len = strlen(p); + p += len; } return w; } |