gre-ilya/fltk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix buffer overflow in CR/LF conversion

Browse Source 
An already present CR/LF combination causes us to jump two characters,
but we failed to update the length counter when doing this.

This also makes sure we handle the corner case of a CR as the last
character.


git-svn-id: file:///fltk/svn/fltk/branches/branch-1.3@11873 ea41ed52-d2ee-0310-a9c1-e6b18d33e121
This commit is contained in:
Pierre Ossman 2016-08-16 13:30:26 +00:00
parent 633d7c2c5f
commit 0eb99fa0b1
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/Fl_win32.cxx
View File

@ -602,9 +602,9 @@ public:
char *o;
int lencount;
// Predict size of \r\n conversion buffer
for ( i=in, lencount = inlen; lencount--; ) {
if ( *i == '\r' && *(i+1) == '\n' ) // leave \r\n untranslated
{ i+=2; outlen+=2; }
for (i = in, lencount = inlen; lencount > 0; lencount--) {
if ( *i == '\r' && *(i+1) == '\n' && lencount >= 2 ) // leave \r\n untranslated
{ i+=2; outlen+=2; lencount--; }
else if ( *i == '\n' ) // \n by itself? leave room to insert \r
{ i++; outlen+=2; }
else
@ -613,9 +613,9 @@ public:
// Alloc conversion buffer + NULL
out = new char[outlen+1];
// Handle \n -> \r\n conversion
for ( i=in, o=out, lencount = inlen; lencount--; ) {
if ( *i == '\r' && *(i+1) == '\n' ) // leave \r\n untranslated
{ *o++ = *i++; *o++ = *i++; }
for (i = in, o=out, lencount = inlen; lencount > 0; lencount--) {
if ( *i == '\r' && *(i+1) == '\n' && lencount >= 2 ) // leave \r\n untranslated
{ *o++ = *i++; *o++ = *i++; lencount--; }
else if ( *i == '\n' ) // \n by itself? insert \r
{ *o++ = '\r'; *o++ = *i++; }
else