diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-10 13:54:00 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-12-10 13:54:14 +0000 |
| commit | 7fbaf9444fcd2d3ce061775949b38deb4d489943 (patch) | |
| tree | 35b5a9cbff1d425ebdfd8a59cac3b60389565040 /libwc | |
| parent | Prevent negative array index for realColumn in calcPosition() (diff) | |
| download | w3m-7fbaf9444fcd2d3ce061775949b38deb4d489943.tar.gz w3m-7fbaf9444fcd2d3ce061775949b38deb4d489943.zip | |
Prevent overflow beyond the end of string in wtf_len()
cf. https://github.com/tats/w3m/issues/57
Diffstat (limited to 'libwc')
| -rw-r--r-- | libwc/wtf.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libwc/wtf.c b/libwc/wtf.c index 9a9a15c..7d450a1 100644 --- a/libwc/wtf.c +++ b/libwc/wtf.c @@ -141,9 +141,10 @@ size_t wtf_len(wc_uchar *p) { wc_uchar *q = p; + wc_uchar *strz = p + strlen(p); q += WTF_LEN_MAP[*q]; - while (*q && ! WTF_WIDTH_MAP[*q]) + while (q < strz && ! WTF_WIDTH_MAP[*q]) q += WTF_LEN_MAP[*q]; return q - p; } |