fixed heap-buffer-overflow in url_count_inline, fixes #122

[smdp.git] / src / url.c

diff --git a/src/url.c b/src/url.c
index a7a5c0c..da21a57 100644 (file)
--- a/src/url.c
+++ b/src/url.c
@@ -1,6 +1,6 @@
 /*
  * Functions necessary to handle pandoc URLs.
- * Copyright (C) 2014 Michael Goehler
+ * Copyright (C) 2016 Michael Goehler
  *
  * This file is part of mdp.
  *
@@ -165,7 +165,7 @@ int url_count_inline(const wchar_t *line) {
     for (; *i; i++) {
         if (*i == '\\') {
             i++;
-        } else if ( *i == '[' && *(i+1) != ']') {
+        } else if ( *i == '[' && *(i+1) && *(i+1) != ']') {
             while (*i && *i != ']') i++;
             i++;
             if (*i == '(' && wcschr(i, ')')) {
@@ -178,14 +178,14 @@ int url_count_inline(const wchar_t *line) {
     return count;
 }
 
-int url_len_inline(const wchar_t *text) {
+int url_len_inline(const wchar_t *value) {
     int count = 0;
-    const wchar_t *i = text;
+    const wchar_t *i = value;
 
     for (; *i; i++) {
         if (*i == '\\') {
             i++;
-        } else if ( *i == '[' && *(i+1) != ']') {
+        } else if ( *i == '[' && *(i+1) && *(i+1) != ']') {
             while (*i && *i != ']') i++;
             i++;
             if (*i == '(' && wcschr(i, ')')) {