libgrapheme

commit ad4877023146953d4daa8d91c119124c38620337
parent 4b4292a8f78eec4271213982fdddaf1c479dfe96
Author: Christopher Wellons <wellons@nullprogram.com>
Date:   Fri,  7 Oct 2022 11:33:10 -0400

Check for empty destination before NUL-terminating

This overflow was triggered in the second test of to_lowercase_utf8
where the destination is zero length (w->destlen == 0). `w->destlen`
would overflow by subtraction, then the subscript would overflow the
destination.

Signed-off-by: Laslo Hunhold <dev@frign.de>

Diffstat:
M
src/util.c
 | 
2
+-

1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/util.c b/src/util.c
@@ -207,7 +207,7 @@ herodotus_writer_nul_terminate(HERODOTUS_WRITER *w)
 		} else { /* w->type == HERODOTUS_TYPE_UTF8 */
 			((char *)(w->dest))[w->first_unwritable_offset] = '\0';
 		}
-	} else {
+	} else if (w->destlen > 0) {
 		/*
 		 * In this case, there is no more space in the buffer and
 		 * the last unwritable offset is larger than