emelie/tidy-html5
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix static buffer overrrun (issue #443)

Browse source 
result[6] is a fixed array of size 6, but in the process
of copying data into it, we clobber the last allocated byte.

Simplify some of the code by not calling redundant functions.
This commit is contained in:
Adam Majer 2016-08-02 11:10:45 +02:00
parent 09caae3b9c
commit 50557a4f63
1 changed files with 11 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
src/language.c
View file

@ -601,7 +601,6 @@ tmbstr tidyNormalizedLocaleName( ctmbstr locale )
uint i; uint i;
uint len; uint len;
static char result[6] = "xx_yy"; static char result[6] = "xx_yy";
char character[1];
tmbstr search = strdup(locale); tmbstr search = strdup(locale);
search = TY_(tmbstrtolower)(search); search = TY_(tmbstrtolower)(search);
@ -622,27 +621,28 @@ tmbstr tidyNormalizedLocaleName( ctmbstr locale )
junk language that doesn't exist and won't be set. */ junk language that doesn't exist and won't be set. */
len = strlen( search ); len = strlen( search );
len = len <= 5 ? len : 5; len = ( len <= 5 ? len : 5 );
for ( i = 0; i <= len; i++ ) for ( i = 0; i < len; i++ )
{ {
if ( i == 2 ) if ( i == 2 )
{ {
/* Either terminate the string or ensure there's an underscore */ /* Either terminate the string or ensure there's an underscore */
if (strlen( search) >= 5) if (len == 5) {
character[0] = '_'; result[i] = '_';
else }
character[0] = '\0'; else {
strncpy( result + i, character, 1 ); result[i] = '\0';
break; /* no need to copy after null */
}
} }
else else
{ {
strncpy( result + i, search + i, 1); result[i] = tolower( search[i] );
result[i] = tolower( result[i] );
} }
} }
if ( search ) free( search ); free( search );
return result; return result;
} }