storm/w3m
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent overflow beyond the end of string in proc_mchar()

Browse Source 
Bug-Debian: https://github.com/tats/w3m/issues/59
This commit is contained in:
Tatsuya Kinoshita
2016-12-07 21:14:07 +09:00
parent d345c0950d
commit 512ed467d1
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
file.c
+6 -1
View File
@@ -2599,6 +2599,8 @@ static void
proc_mchar(struct readbuffer *obuf, int pre_mode, proc_mchar(struct readbuffer *obuf, int pre_mode,
int width, char **str, Lineprop mode) int width, char **str, Lineprop mode)
{ {
size_t len;
check_breakpoint(obuf, pre_mode, *str); check_breakpoint(obuf, pre_mode, *str);
obuf->pos += width; obuf->pos += width;
Strcat_charp_n(obuf->line, *str, get_mclen(*str)); Strcat_charp_n(obuf->line, *str, get_mclen(*str));
@@ -2607,7 +2609,10 @@ proc_mchar(struct readbuffer *obuf, int pre_mode,
if (**str != ' ') if (**str != ' ')
obuf->prev_ctype = mode; obuf->prev_ctype = mode;
} }
(*str) += get_mclen(*str); len = get_mclen(*str);
if (len > strlen(*str))
len = strlen(*str);
(*str) += len;
obuf->flag |= RB_NFLUSHED; obuf->flag |= RB_NFLUSHED;
} }