pinosaur
/
smdp.git
/ commitdiff
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
38cfde7
)
fixed heap-buffer-overflow in url_count_inline, fixes #122
author
Michael Göhler
<github@nixhub.de>
Wed, 27 Dec 2017 21:48:39 +0000
(22:48 +0100)
committer
Michael Göhler
<github@nixhub.de>
Wed, 27 Dec 2017 21:48:39 +0000
(22:48 +0100)
src/url.c
patch
|
blob
|
history
diff --git
a/src/url.c
b/src/url.c
index
0e49b49
..
da21a57
100644
(file)
--- a/
src/url.c
+++ b/
src/url.c
@@
-165,7
+165,7
@@
int url_count_inline(const wchar_t *line) {
for (; *i; i++) {
if (*i == '\\') {
i++;
for (; *i; i++) {
if (*i == '\\') {
i++;
- } else if ( *i == '[' && *(i+1) != ']') {
+ } else if ( *i == '[' && *(i+1)
&& *(i+1)
!= ']') {
while (*i && *i != ']') i++;
i++;
if (*i == '(' && wcschr(i, ')')) {
while (*i && *i != ']') i++;
i++;
if (*i == '(' && wcschr(i, ')')) {
@@
-185,7
+185,7
@@
int url_len_inline(const wchar_t *value) {
for (; *i; i++) {
if (*i == '\\') {
i++;
for (; *i; i++) {
if (*i == '\\') {
i++;
- } else if ( *i == '[' && *(i+1) != ']') {
+ } else if ( *i == '[' && *(i+1)
&& *(i+1)
!= ']') {
while (*i && *i != ']') i++;
i++;
if (*i == '(' && wcschr(i, ')')) {
while (*i && *i != ']') i++;
i++;
if (*i == '(' && wcschr(i, ')')) {
