gnustep/libs-base
0
0
Fork 0
mirror of https://github.com/gnustep/libs-base.git synced 2025-04-22 16:33:29 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix possible memory corruption in string handling

Browse source
This commit is contained in:
Frederik Seiffert 2021-07-16 13:43:07 +02:00 committed by Frederik Seiffert
parent 49ba7d1ed1
commit a377a86094
3 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
ChangeLog
View file

@ -1,3 +1,11 @@
2021-07-16 Frederik Seiffert <frederik@algoriddim.com>
* Source/GSICUString.h:
* Source/GSICUString.m:
Fix possible memory corruption in string handling that occured
primarily when using NSRegularExpression with strings longer than
16 characters.
2021-07-02 Frederik Seiffert <frederik@algoriddim.com>
* Source/Additions/Unicode.m:

8
Source/GSICUString.h
View file

@ -80,13 +80,13 @@ static inline void free_string(unichar **buf)
*
* Buffers created in this way are exception safe when using native exceptions.
*/
#define TEMP_BUFFER(name, size)\
#define TEMP_BUFFER(name, length)\
__attribute__((cleanup(free_string))) unichar *name ##_onheap = 0;\
unichar name ## _onstack[64 / sizeof(unichar)];\
unichar name ## _onstack[64];\
unichar *name = name ## _onstack;\
if (size > 64)\
if (length > 64)\
{\
name ## _onheap = malloc(size);\
name ## _onheap = malloc(length * sizeof(unichar));\
name = name ## _onheap;\
}

8
Source/GSICUString.m
View file

@ -487,13 +487,13 @@ UTextInitWithNSString(UText *txt, NSString *str)
- (void) replaceCharactersInRange: (NSRange)r
withString: (NSString*)aString
{
NSUInteger size = [aString length];
NSUInteger length = [aString length];
UErrorCode status = 0;
TEMP_BUFFER(buffer, size);
[aString getCharacters: buffer range: NSMakeRange(0, size)];
TEMP_BUFFER(buffer, length);
[aString getCharacters: buffer range: NSMakeRange(0, length)];
utext_replace(&txt, r.location, r.location + r.length, buffer, size, &status);
utext_replace(&txt, r.location, r.location + r.length, buffer, length, &status);
}
- (void) dealloc