Prevent overflow beyond the end of string in proc_mchar()

Bug-Debian: https://github.com/tats/w3m/issues/59
2016-12-07 21:14:07 +09:00
parent d345c0950d
commit 512ed467d1
1 changed files with 6 additions and 1 deletions
@@ -2599,6 +2599,8 @@ static void
 proc_mchar(struct readbuffer *obuf, int pre_mode,
 	   int width, char **str, Lineprop mode)
 {
+    size_t len;
+
    check_breakpoint(obuf, pre_mode, *str);
    obuf->pos += width;
    Strcat_charp_n(obuf->line, *str, get_mclen(*str));
@@ -2607,7 +2609,10 @@ proc_mchar(struct readbuffer *obuf, int pre_mode,
 	if (**str != ' ')
 	    obuf->prev_ctype = mode;
    }
-    (*str) += get_mclen(*str);
+    len = get_mclen(*str);
+    if (len > strlen(*str))
+	len = strlen(*str);
+    (*str) += len;
    obuf->flag |= RB_NFLUSHED;
 }