mirrors/fltk
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer overflow in CR/LF conversion.

Browse Source 
An already present CR/LF combination causes us to jump two characters,
but we failed to update the length counter when doing this.

This also makes sure we handle the corner case of a CR as the last
character.

Note: porting Pierre Ossman's commit (svn r11873) to branch-1.3-porting.


git-svn-id: file:///fltk/svn/fltk/branches/branch-1.3-porting@11913 ea41ed52-d2ee-0310-a9c1-e6b18d33e121
This commit is contained in:
Albrecht Schlosser 2016-09-01 10:35:21 +00:00
parent 89954986bb
commit 9fd31ed94e
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/Fl_win32.cxx
View File

@ -581,9 +581,9 @@ public:
char *o; char *o;
int lencount; int lencount;
// Predict size of \r\n conversion buffer // Predict size of \r\n conversion buffer
for ( i=in, lencount = inlen; lencount--; ) { for (i = in, lencount = inlen; lencount > 0; lencount--) {
if ( *i == '\r' && *(i+1) == '\n' ) // leave \r\n untranslated if ( *i == '\r' && *(i+1) == '\n' && lencount >= 2 ) // leave \r\n untranslated
{ i+=2; outlen+=2; } { i+=2; outlen+=2; lencount--; }
else if ( *i == '\n' ) // \n by itself? leave room to insert \r else if ( *i == '\n' ) // \n by itself? leave room to insert \r
{ i++; outlen+=2; } { i++; outlen+=2; }
else else
@ -592,9 +592,9 @@ public:
// Alloc conversion buffer + NULL // Alloc conversion buffer + NULL
out = new char[outlen+1]; out = new char[outlen+1];
// Handle \n -> \r\n conversion // Handle \n -> \r\n conversion
for ( i=in, o=out, lencount = inlen; lencount--; ) { for (i = in, o=out, lencount = inlen; lencount > 0; lencount--) {
if ( *i == '\r' && *(i+1) == '\n' ) // leave \r\n untranslated if ( *i == '\r' && *(i+1) == '\n' && lencount >= 2 ) // leave \r\n untranslated
{ *o++ = *i++; *o++ = *i++; } { *o++ = *i++; *o++ = *i++; lencount--; }
else if ( *i == '\n' ) // \n by itself? insert \r else if ( *i == '\n' ) // \n by itself? insert \r
{ *o++ = '\r'; *o++ = *i++; } { *o++ = '\r'; *o++ = *i++; }
else else