Issue #379 - Care about 'ix' going negative.
How this lasted so long in the code is a mystery! But of course it will only be a read out-of-bounds if testing the first character in the lexer, and it is a spacey char. A big thanks to @gaa-cifasis for running ASAN tests on Tidy.
This commit is contained in:
parent
b83d5ffb03
commit
8dda04f1df
12
src/pprint.c
12
src/pprint.c
|
@ -1034,10 +1034,11 @@ static void PPrintText( TidyDocImpl* doc, uint mode, uint indent,
|
||||||
ix = IncrWS( ix, end, indent, ixWS );
|
ix = IncrWS( ix, end, indent, ixWS );
|
||||||
}
|
}
|
||||||
else if (( c == '&' ) && (TY_(HTMLVersion)(doc) == HT50) &&
|
else if (( c == '&' ) && (TY_(HTMLVersion)(doc) == HT50) &&
|
||||||
(((ix + 1) == end) || (((ix + 1) < end) && (isspace(doc->lexer->lexbuf[ix+1])))) )
|
(((ix + 1) == end) || (((ix + 1) < end) && (isspace(doc->lexer->lexbuf[ix+1] & 0xff)))) )
|
||||||
{
|
{
|
||||||
/*\
|
/*\
|
||||||
* Issue #207 - This is an unambiguous ampersand need not be 'quoted' in HTML5
|
* Issue #207 - This is an unambiguous ampersand need not be 'quoted' in HTML5
|
||||||
|
* Issue #379 - Ensure only 0 to 255 passed to 'isspace' to avoid debug assert
|
||||||
\*/
|
\*/
|
||||||
PPrintChar( doc, c, (mode | CDATA) );
|
PPrintChar( doc, c, (mode | CDATA) );
|
||||||
}
|
}
|
||||||
|
@ -1866,9 +1867,12 @@ static int TextEndsWithNewline(Lexer *lexer, Node *node, uint mode )
|
||||||
if ( (mode & (CDATA|COMMENT)) && TY_(nodeIsText)(node) && node->end > node->start )
|
if ( (mode & (CDATA|COMMENT)) && TY_(nodeIsText)(node) && node->end > node->start )
|
||||||
{
|
{
|
||||||
uint ch, ix = node->end - 1;
|
uint ch, ix = node->end - 1;
|
||||||
/* Skip non-newline whitespace. */
|
/*\
|
||||||
while ( ix >= node->start && (ch = (lexer->lexbuf[ix] & 0xff))
|
* Skip non-newline whitespace.
|
||||||
&& ( ch == ' ' || ch == '\t' || ch == '\r' ) )
|
* Issue #379 - Only if ix is GT start can it be decremented!
|
||||||
|
\*/
|
||||||
|
while ( ix > node->start && (ch = (lexer->lexbuf[ix] & 0xff))
|
||||||
|
&& ( ch == ' ' || ch == '\t' || ch == '\r' ) )
|
||||||
--ix;
|
--ix;
|
||||||
|
|
||||||
if ( lexer->lexbuf[ ix ] == '\n' )
|
if ( lexer->lexbuf[ ix ] == '\n' )
|
||||||
|
|
Loading…
Reference in a new issue