talons

commit 2f1eda3f09725b6fbf467a71593c020226478162
parent 066e76a2863a8468b8fd491e50396661b62174e6
Author: Andrej Kacian <ticho@claws-mail.org>
Date:   Tue,  4 Jul 2017 00:07:49 +0200

Fix reading past buffer boundary in RSSyl's strreplace.

Diffstat:
M
src/plugins/rssyl/strutils.c
 | 
21
++++++++++++++-------

1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/src/plugins/rssyl/strutils.c b/src/plugins/rssyl/strutils.c
@@ -79,23 +79,22 @@ gchar *rssyl_strreplace(gchar *source, gchar *pattern,
 		+ ( count * len_replacement );
 
 	new = malloc(final_length + 1);
-	w_new = new;
 	memset(new, '\0', final_length + 1);
 
+	/* 'c' will be our iterator over original string
+	 * 'w_new' our iterator over the new string */
 	c = source;
+	w_new = new;
 
-	while( *c != '\0' ) {
+	/* Go until either end of string is reached, or until the
+	 * remaining text is shorter than the pattern. */
+	while( *c != '\0' && strlen(c) <= len_pattern) {
 		if( !memcmp(c, pattern, len_pattern) ) {
-			gboolean break_after_rep = FALSE;
 			int i;
-			if (*(c + len_pattern) == '\0')
-				break_after_rep = TRUE;
 			for (i = 0; i < len_replacement; i++) {
 				*w_new = replacement[i];
 				w_new++;
 			}
-			if (break_after_rep)
-				break;
 			c = c + len_pattern;
 		} else {
 			*w_new = *c;
@@ -103,6 +102,14 @@ gchar *rssyl_strreplace(gchar *source, gchar *pattern,
 			c++;
 		}
 	}
+
+	/* We broke off the above cycle because remaining text was not
+	 * long enough for the pattern, so now we need to append the
+	 * remaining text to the new string. */
+	if (c != '\0') {
+		strncat(new, c, final_length - strlen(new));
+	}
+
 	return new;
 }