Mercurial > hg > openttd
changeset 6195:8f7373285579 draft
(svn r8975) -Regression: [win32] Possible buffer overflow if unicode text is pasted into an input box and needs trimming. The last character was wrongly assumed to be of length 1 (tb->maxlength - 1), while a unicode character can be up to 4 long.
| author | Darkvater <Darkvater@openttd.org> |
|---|---|
| date | Fri, 02 Mar 2007 15:08:28 +0000 |
| parents | bf3c126349b4 |
| children | a68986f10bb5 |
| files | src/win32.cpp |
| diffstat | 1 files changed, 6 insertions(+), 5 deletions(-) [+] |
line wrap: on
line diff
--- a/src/win32.cpp +++ b/src/win32.cpp @@ -1017,16 +1017,16 @@ width = length = 0; for (ptr = utf8_buf; (c = Utf8Consume(&ptr)) != '\0';) { - byte charwidth; + if (!IsPrintable(c)) break; - if (!IsPrintable(c)) break; - if (tb->length + length >= tb->maxlength - 1) break; - charwidth = GetCharacterWidth(FS_NORMAL, c); + size_t len = Utf8CharLen(c); + if (tb->length + length >= tb->maxlength - (uint16)len) break; + byte charwidth = GetCharacterWidth(FS_NORMAL, c); if (tb->maxwidth != 0 && width + tb->width + charwidth > tb->maxwidth) break; width += charwidth; - length += Utf8CharLen(c); + length += len; } if (length == 0) return false; @@ -1038,6 +1038,7 @@ tb->length += length; tb->caretpos += length; + assert(tb->length < tb->maxlength); tb->buf[tb->length] = '\0'; // terminating zero return true;