gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2025-12-19 12:28:22 +01:00
Code Issues Projects Releases Wiki Activity

WUtil: Fixed risky code for de-escaping of strings

Browse Source 
The internal function 'unescapestr' is used to transform strings which
may contain escape sequences (\x) into their plain representation.

There are a few cases where the function can misbehave (typically parse
after the end of string, thus writing past the end of the reserved
result area) which can be a source of problem later. The new code
should be safer.
This commit is contained in:
Christophe CURIS
2013-05-04 15:43:28 +02:00
committed by Carlos R. Mafra
parent f386e34d29
commit fd02f5f083
1 changed files with 28 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
WINGs/proplist.c
View File

@@ -508,16 +508,33 @@ static char *unescapestr(const char *src)
char *dPtr;
char ch;
for (dPtr = dest; *src; src++, dPtr++) {
if (*src != '\\') {
*dPtr = *src;
} else {
ch = *(++src);
if ((ch >= '0') && (ch <= '3')) {
/* assume next 2 chars are octal too */
*dPtr = ((ch & 07) << 6);
*dPtr |= ((*(++src) & 07) << 3);
*dPtr |= *(++src) & 07;
for (dPtr = dest; ; dPtr++) {
ch = *src++;
if (ch == '\0')
break;
else if (ch != '\\')
*dPtr = ch;
else {
ch = *(src++);
if (ch == '\0') {
*dPtr = '\\';
break;
} else if ((ch >= '0') && (ch <= '7')) {
char wch;
/* Convert octal number to character */
wch = (ch & 07);
ch = *src;
if ((ch >= '0') && (ch <= '7')) {
src++;
wch = (wch << 3) | (ch & 07);
ch = *src;
if ((ch >= '0') && (ch <= '7')) {
src++;
wch = (wch << 3) | (ch & 07);
}
}
*dPtr = wch;
} else {
switch (ch) {
case 'a':
@@ -542,7 +559,7 @@ static char *unescapestr(const char *src)
*dPtr = '\f';
break;
default:
*dPtr = *src;
*dPtr = ch;
}
}
}