[PATCH] format_sanitized_subject: Don't trim past initial length of strbuf
- From
Stephen Boyd <bebarino@gmail.com>
- Date
- Mar 31, 2009, 23:24 UTC
- Message-ID
- <1238541878-11025-1-git-send-email-bebarino@gmail.com>
- In-Reply-To
- <49D2968D.6010108@lsrfire.ath.cx>
If the subject line is '...' the strbuf will be accessed before the first dot is added; potentially changing the strbuf passed into the function or accessing sb->buf[-1] if it was originally empty.
Reported-by: René Scharfe <rene.scharfe@lsrfire.ath.cx> --- I was thinking about this today actually. Thanks.
With regards to the isalnum(), I kept the original code because I wasn't sure if the functionality would be different.
pretty.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/pretty.c b/pretty.c index c57cef4..a0ef356 100644 --- a/pretty.c +++ b/pretty.c @@ -502,6 +502,7 @@ static int istitlechar(char c) static void format_sanitized_subject(struct strbuf *sb, const char *msg) { size_t trimlen; + size_t start_len = sb->len; int space = 2; for (; *msg && *msg != '\n'; msg++) { @@ -519,8 +520,9 @@ static void format_sanitized_subject(struct strbuf *sb, const char *msg) /* trim any trailing '.' or '-' characters */ trimlen = 0; - while (sb->buf[sb->len - 1 - trimlen] == '.' - || sb->buf[sb->len - 1 - trimlen] == '-') + while (sb->len - trimlen > start_len && + (sb->buf[sb->len - 1 - trimlen] == '.' + || sb->buf[sb->len - 1 - trimlen] == '-')) trimlen++; strbuf_remove(sb, sb->len - trimlen, trimlen); }
-- 1.6.2