blob: 62b5e9169fad7e7379689d773da9697b2b249605 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
Subject: Prevent overflow beyond the end of string in wtf_parse1()
From: Tatsuya Kinoshita <tats@debian.org>
Bug-Debian: https://github.com/tats/w3m/issues/68
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=00433f4ac2645ac6236ea1892b4a93f26a039a84
---
libwc/wtf.c | 44 ++++++++++++++++++++++++++++++++------------
1 file changed, 32 insertions(+), 12 deletions(-)
diff --git a/libwc/wtf.c b/libwc/wtf.c
index cdc6cbc..94d95c1 100644
--- a/libwc/wtf.c
+++ b/libwc/wtf.c
@@ -397,7 +397,7 @@ wtf_parse1(wc_uchar **p)
cc.code = *(q++);
} else if (*q > 0xa0) {
cc.ccs = wtf_gr_ccs;
- if (WC_CCS_IS_WIDE(cc.ccs)) {
+ if (WC_CCS_IS_WIDE(cc.ccs) && *(q+1)) {
cc.code = ((wc_uint32)*q << 8) | *(q+1);
q += 2;
} else
@@ -410,27 +410,47 @@ wtf_parse1(wc_uchar **p)
case WC_CCS_A_CS942:
case WC_CCS_A_PCS:
case WC_CCS_A_UNKNOWN:
- cc.ccs |= *(q++) & 0x7f;
- cc.code = *(q++);
+ if (*q && *(q+1)) {
+ cc.ccs |= *(q++) & 0x7f;
+ cc.code = *(q++);
+ } else {
+ cc.ccs = WC_CCS_US_ASCII;
+ cc.code = (wc_uint32)' ';
+ }
break;
case WC_CCS_A_CS94W:
case WC_CCS_A_CS96W:
case WC_CCS_A_PCSW:
- cc.ccs |= *(q++) & 0x7f;
- cc.code = ((wc_uint32)*q << 8) | *(q+1);
- q += 2;
+ if (*q && *(q+1) && *(q+2)) {
+ cc.ccs |= *(q++) & 0x7f;
+ cc.code = ((wc_uint32)*q << 8) | *(q+1);
+ q += 2;
+ } else {
+ cc.ccs = WC_CCS_US_ASCII;
+ cc.code = (wc_uint32)' ';
+ }
break;
case WC_CCS_A_WCS16:
case WC_CCS_A_WCS16W:
- cc.ccs |= (*q & 0x7c) >> 2;
- cc.code = wtf_to_wcs16(q);
- q += 3;
+ if (*q && *(q+1) && *(q+2)) {
+ cc.ccs |= (*q & 0x7c) >> 2;
+ cc.code = wtf_to_wcs16(q);
+ q += 3;
+ } else {
+ cc.ccs = WC_CCS_US_ASCII;
+ cc.code = (wc_uint32)' ';
+ }
break;
case WC_CCS_A_WCS32:
case WC_CCS_A_WCS32W:
- cc.ccs |= (*q & 0x70) >> 4;
- cc.code = wtf_to_wcs32(q);
- q += 5;
+ if (*q && *(q+1) && *(q+2) && *(q+3) && *(q+4)) {
+ cc.ccs |= (*q & 0x70) >> 4;
+ cc.code = wtf_to_wcs32(q);
+ q += 5;
+ } else {
+ cc.ccs = WC_CCS_US_ASCII;
+ cc.code = (wc_uint32)' ';
+ }
break;
default:
/* case 0: */
--
2.10.2
|
