fixed heap-buffer-overflow in url_count_inline, fixes #122

[smdp.git] / src / url.c

diff --git a/src/url.c b/src/url.c
index c5ffd4b..da21a57 100644 (file)
--- a/src/url.c
+++ b/src/url.c
@@ -1,6 +1,27 @@
+/*
+ * Functions necessary to handle pandoc URLs.
+ * Copyright (C) 2016 Michael Goehler
+ *
+ * This file is part of mdp.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
 #include <stdlib.h>
 #include <assert.h>
-#include <string.h>
+#include <wchar.h>
 #include <stdio.h>
 
 #include "url.h"
@@ -18,7 +39,7 @@ void url_init(void) {
     init_ok = 1;
 }
 
-int url_add(const char *link_name, int link_name_length, const char *target, int target_length, int x, int y) {
+int url_add(const wchar_t *link_name, int link_name_length, const wchar_t *target, int target_length, int x, int y) {
     if (!init_ok) return -1;
 
     url_t *tmp = NULL;
@@ -39,14 +60,14 @@ int url_add(const char *link_name, int link_name_length, const char *target, int
         assert(tmp);
     }
 
-    tmp -> link_name = calloc(link_name_length+1, sizeof(char));
+    tmp -> link_name = calloc(link_name_length+1, sizeof(wchar_t));
     assert(tmp->link_name);
-    strncpy(tmp->link_name, link_name, link_name_length);
+    wcsncpy(tmp->link_name, link_name, link_name_length);
     tmp->link_name[link_name_length] = '\0';
 
-    tmp->target = calloc(target_length+1, sizeof(char));
+    tmp->target = calloc(target_length+1, sizeof(wchar_t));
     assert(tmp->target);
-    strncpy(tmp->target, target, target_length);
+    wcsncpy(tmp->target, target, target_length);
     tmp->target[target_length] = '\0';
 
     tmp->x = x;
@@ -58,7 +79,7 @@ int url_add(const char *link_name, int link_name_length, const char *target, int
     return index_max-1;
 }
 
-char * url_get_target(int index) {
+wchar_t * url_get_target(int index) {
     if (!init_ok) return NULL;
 
     url_t *tmp = list;
@@ -75,7 +96,7 @@ char * url_get_target(int index) {
     } else return NULL;
 }
 
-char * url_get_name(int index) {
+wchar_t * url_get_name(int index) {
     url_t *tmp = list;
 
     while (index > 0 && tmp && tmp->next) {
@@ -137,19 +158,19 @@ int url_get_amount(void) {
     return index_max;
 }
 
-int url_count_inline(const char *line) {
+int url_count_inline(const wchar_t *line) {
     int count = 0;
-    const char *i = line;
+    const wchar_t *i = line;
 
     for (; *i; i++) {
         if (*i == '\\') {
             i++;
-        } else if ( *i == '[' && *(i+1) != ']') {
+        } else if ( *i == '[' && *(i+1) && *(i+1) != ']') {
             while (*i && *i != ']') i++;
             i++;
-            if (*i == '(' && strchr(i, ')')) {
+            if (*i == '(' && wcschr(i, ')')) {
                 count ++;
-                i = strchr(i, ')');
+                i = wcschr(i, ')');
             }
         }
     }
@@ -157,17 +178,17 @@ int url_count_inline(const char *line) {
     return count;
 }
 
-int url_len_inline(const char *text) {
+int url_len_inline(const wchar_t *value) {
     int count = 0;
-    const char *i = text;
+    const wchar_t *i = value;
 
     for (; *i; i++) {
         if (*i == '\\') {
             i++;
-        } else if ( *i == '[' && *(i+1) != ']') {
+        } else if ( *i == '[' && *(i+1) && *(i+1) != ']') {
             while (*i && *i != ']') i++;
             i++;
-            if (*i == '(' && strchr(i, ')')) {
+            if (*i == '(' && wcschr(i, ')')) {
                 while (*i && *i != ')') {
                     count++;
                     i++;