commit ad4877023146953d4daa8d91c119124c38620337
parent 4b4292a8f78eec4271213982fdddaf1c479dfe96
Author: Christopher Wellons <wellons@nullprogram.com>
Date: Fri, 7 Oct 2022 11:33:10 -0400
Check for empty destination before NUL-terminating
This overflow was triggered in the second test of to_lowercase_utf8
where the destination is zero length (w->destlen == 0). `w->destlen`
would overflow by subtraction, then the subscript would overflow the
destination.
Signed-off-by: Laslo Hunhold <dev@frign.de>
Diffstat:
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/util.c b/src/util.c
@@ -207,7 +207,7 @@ herodotus_writer_nul_terminate(HERODOTUS_WRITER *w)
} else { /* w->type == HERODOTUS_TYPE_UTF8 */
((char *)(w->dest))[w->first_unwritable_offset] = '\0';
}
- } else {
+ } else if (w->destlen > 0) {
/*
* In this case, there is no more space in the buffer and
* the last unwritable offset is larger than
