diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2015-01-11 17:21:17 -0500 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2015-01-11 23:41:42 -0500 |
| commit | 7f76961982e03d4d5f781e7e7113fc7eff970f82 (patch) | |
| tree | b53ec520a161642ffcba434526eec371972b961d /factory | |
| parent | e01ff428993f0c126f010b5625002e6a0a8aff4a (diff) | |
shared/util: respect buffer boundary on incomplete escape sequences
cunescape_length_with_prefix() is called with the length as an
argument, so it cannot rely on the buffer being NUL terminated.
Move the length check before accessing the memory.
When an incomplete escape sequence was given at the end of the
buffer, c_l_w_p() would read past the end of the buffer. Fix this
and add a test.
Diffstat (limited to 'factory')
0 files changed, 0 insertions, 0 deletions