Fix an out of bounds read in UTF-7 decoding code
Calling wxMBConvUTF7::ToWChar(..., "+", 1) resulted in reading uninitialized memory as the decoding code didn't check that there were any bytes left when switching to the "shifted" mode. Fix this by explicitly checking for this and returning an error if nothing is left.
This commit is contained in:
@@ -699,6 +699,10 @@ size_t wxMBConvUTF7::ToWChar(wchar_t *dst, size_t dstLen,
|
||||
// start of an encoded segment?
|
||||
if ( cc == '+' )
|
||||
{
|
||||
// Can't end with a plus sign.
|
||||
if ( src == srcEnd )
|
||||
return wxCONV_FAILED;
|
||||
|
||||
if ( *src == '-' )
|
||||
{
|
||||
// just the encoded plus sign, don't switch to shifted mode
|
||||
|
Reference in New Issue
Block a user