blob: 7afb58aa1492e616dbcac3c17ddd0c198871b622 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
Copied from Debian.
From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...
---
src/lexer.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
/* and prompts attributes unless --literal-attributes is set to yes */
/* #994841 - Whitespace is removed from value attributes */
- if (munge &&
+ /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+ if ((len > 0) && munge &&
TY_(tmbstrcasecmp)(name, "alt") &&
TY_(tmbstrcasecmp)(name, "title") &&
TY_(tmbstrcasecmp)(name, "value") &&
TY_(tmbstrcasecmp)(name, "prompt"))
{
- while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+ while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
--len;
- while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+ while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
{
++start;
--len;
|
