Check for empty destination before NUL-terminating - libgrapheme - unicode string library
(HTM) git clone git://git.suckless.org/libgrapheme
(DIR) Log
(DIR) Files
(DIR) Refs
(DIR) README
(DIR) LICENSE
---
(DIR) commit ad4877023146953d4daa8d91c119124c38620337
(DIR) parent 4b4292a8f78eec4271213982fdddaf1c479dfe96
(HTM) Author: Christopher Wellons <wellons@nullprogram.com>
Date: Fri, 7 Oct 2022 11:33:10 -0400
Check for empty destination before NUL-terminating
This overflow was triggered in the second test of to_lowercase_utf8
where the destination is zero length (w->destlen == 0). `w->destlen`
would overflow by subtraction, then the subscript would overflow the
destination.
Signed-off-by: Laslo Hunhold <dev@frign.de>
Diffstat:
M src/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
(DIR) diff --git a/src/util.c b/src/util.c
@@ -207,7 +207,7 @@ herodotus_writer_nul_terminate(HERODOTUS_WRITER *w)
} else { /* w->type == HERODOTUS_TYPE_UTF8 */
((char *)(w->dest))[w->first_unwritable_offset] = '\0';
}
- } else {
+ } else if (w->destlen > 0) {
/*
* In this case, there is no more space in the buffer and
* the last unwritable offset is larger than