Avoid heap-buffer-overflow

zsx · zsx · commit e1d1c1220bd8 · 2017-03-21T10:33:32.000-04:00
bp-1 might not be readable when len == 0
diff --git a/src/core/f-enbase.c b/src/core/f-enbase.c
@@ -443,7 +443,7 @@
 		if (brk && ((count % 32) == 0)) *bp++ = LF;
 	}
 
-	if (*(bp-1) != LF && (len >= 32) && brk) *bp++ = LF;
+	if ((len >= 32) && brk && *(bp-1) != LF) *bp++ = LF;
 	*bp = 0;
 	
 	SERIES_TAIL(series) = DIFF_PTRS(bp, series->data);

Original file line number	Diff line number	Diff line change
`@@ -443,7 +443,7 @@`
`443`	`443`	`if (brk && ((count % 32) == 0)) *bp++ = LF;`
`444`	`444`	`}`
`445`	`445`
`446`		`- if ((bp-1) != LF && (len >= 32) && brk) bp++ = LF;`
	`446`	`+ if ((len >= 32) && brk && (bp-1) != LF) bp++ = LF;`
`447`	`447`	`*bp = 0;`
`448`	`448`
`449`	`449`	`SERIES_TAIL(series) = DIFF_PTRS(bp, series->data);`