fixed heap-buffer-overflow in url_count_inline, fixes #122

[smdp.git] / src / url.c

diff --git a/src/url.c b/src/url.c
index 18b7397..da21a57 100644 (file)
--- a/src/url.c
+++ b/src/url.c
@@ -1,6 +1,6 @@
 /*
  * Functions necessary to handle pandoc URLs.
- * Copyright (C) 2015 Michael Goehler
+ * Copyright (C) 2016 Michael Goehler
  *
  * This file is part of mdp.
  *
@@ -165,7 +165,7 @@ int url_count_inline(const wchar_t *line) {
     for (; *i; i++) {
         if (*i == '\\') {
             i++;
-        } else if ( *i == '[' && *(i+1) != ']') {
+        } else if ( *i == '[' && *(i+1) && *(i+1) != ']') {
             while (*i && *i != ']') i++;
             i++;
             if (*i == '(' && wcschr(i, ')')) {
@@ -185,7 +185,7 @@ int url_len_inline(const wchar_t *value) {
     for (; *i; i++) {
         if (*i == '\\') {
             i++;
-        } else if ( *i == '[' && *(i+1) != ']') {
+        } else if ( *i == '[' && *(i+1) && *(i+1) != ']') {
             while (*i && *i != ']') i++;
             i++;
             if (*i == '(' && wcschr(i, ')')) {