Fix an out of bounds read in UTF-7 decoding code

Calling wxMBConvUTF7::ToWChar(..., "+", 1) resulted in reading
uninitialized memory as the decoding code didn't check that there were
any bytes left when switching to the "shifted" mode.

Fix this by explicitly checking for this and returning an error if
nothing is left.
This commit is contained in:
Vadim Zeitlin
2017-11-09 21:56:07 +01:00
parent f365b0712b
commit 666ff421bb

View File

@@ -699,6 +699,10 @@ size_t wxMBConvUTF7::ToWChar(wchar_t *dst, size_t dstLen,
// start of an encoded segment?
if ( cc == '+' )
{
// Can't end with a plus sign.
if ( src == srcEnd )
return wxCONV_FAILED;
if ( *src == '-' )
{
// just the encoded plus sign, don't switch to shifted mode