blob: 60fa1730162783e08e7012519476f9d776b08320 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
Subject: Prevent segfault when iso2022 parsing
Author: Tatsuya Kinoshita <tats@debian.org>
Bug-Debian: https://github.com/tats/w3m/issues/14 [CVE-2016-9433]
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=9cf6926c5d947371dc9e44f32bc7a2fbfca5d469
diff --git a/libwc/iso2022.c b/libwc/iso2022.c
index 33d9a19..59f35de 100644
--- a/libwc/iso2022.c
+++ b/libwc/iso2022.c
@@ -405,7 +405,8 @@ wc_push_to_iso2022(Str os, wc_wchar_t cc, wc_status *st)
case WC_CCS_A_CS94:
if (cc.ccs == WC_CCS_US_ASCII)
cc.ccs = st->g0_ccs;
- g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
break;
case WC_CCS_A_CS94W:
is_wide = 1;
@@ -435,31 +436,37 @@ wc_push_to_iso2022(Str os, wc_wchar_t cc, wc_status *st)
break;
#endif
}
- g = cs94w_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs94w_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
break;
case WC_CCS_A_CS96:
- g = cs96_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs96_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
break;
case WC_CCS_A_CS96W:
is_wide = 1;
- g = cs96w_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs96w_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
break;
case WC_CCS_A_CS942:
- g = cs942_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs942_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
break;
case WC_CCS_A_UNKNOWN_W:
if (WcOption.no_replace)
return;
is_wide = 1;
cc.ccs = WC_CCS_US_ASCII;
- g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
cc.code = ((wc_uint32)WC_REPLACE_W[0] << 8) | WC_REPLACE_W[1];
break;
case WC_CCS_A_UNKNOWN:
if (WcOption.no_replace)
return;
cc.ccs = WC_CCS_US_ASCII;
- g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
+ if (WC_CCS_INDEX(cc.ccs) >= WC_F_ISO_BASE)
+ g = cs94_gmap[WC_CCS_INDEX(cc.ccs) - WC_F_ISO_BASE];
cc.code = (wc_uint32)WC_REPLACE[0];
break;
default:
|
