aniani/irssi
1
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2024-12-04 14:46:39 -05:00
Code

Do not go beyond the end of the string when processing an octal escape.

Browse Source 
This code is used, for example, when /set expand_escapes on.

I can't reproduce crashes but I can reproduce garbage if I type a\1.

bug #775


git-svn-id: file:///var/www/svn.irssi.org/SVN/irssi/trunk@5195 dbcabf3a-b0e7-0310-adc4-f8d773084564
This commit is contained in:
Jilles Tjoelker 2010-11-17 20:41:14 +00:00 committed by jilles
parent c488c3e58b
commit 81b8dcdeb2
1 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
src/core/misc.c
View File

@ -756,17 +756,22 @@ int expand_escape(const char **data)
/* control character (\cA = ^A) */ /* control character (\cA = ^A) */
(*data)++; (*data)++;
return i_toupper(**data) - 64; return i_toupper(**data) - 64;
default: case '0': case '1': case '2': case '3':
if (!i_isdigit(**data)) case '4': case '5': case '6': case '7':
return -1;
/* octal */ /* octal */
digit[1] = digit[2] = digit[3] = '\0';
digit[0] = (*data)[0]; digit[0] = (*data)[0];
digit[1] = (*data)[1]; if ((*data)[1] >= '0' && (*data)[1] <= '7') {
digit[2] = (*data)[2]; ++*data;
digit[3] = '\0'; digit[1] = **data;
*data += 2; if ((*data)[1] >= '0' && (*data)[1] <= '7') {
++*data;
digit[2] = **data;
}
}
return strtol(digit, NULL, 8); return strtol(digit, NULL, 8);
default:
return -1;
} }
} }