From: David Lawrence Ramsey <pooka109@gmail.com>
Date: Wed, 14 Sep 2005 19:17:56 +0000 (+0000)
Subject: in (control_)?mbrep(), if crep is an invalid multibyte sequence, copy
X-Git-Tag: v1.3.9~28
X-Git-Url: https://git.wh0rd.org/?a=commitdiff_plain;h=3c4dc46fdccd4102536ca61d62f3ffe32f818823;p=nano.git

in (control_)?mbrep(), if crep is an invalid multibyte sequence, copy
Unicode 0xFFFD (Replacement Character) into it using strncpy() instead
of assigning the former to it; this avoids segfaults when freeing crep
later, since it's supposed to be dynamically allocated


git-svn-id: svn://svn.savannah.gnu.org/nano/trunk/nano@3018 35c25a1d-7b9e-4130-9fde-d3aeb78583b8
---

diff --git a/ChangeLog b/ChangeLog
index 63b82c32..982f91ba 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -170,6 +170,11 @@ CVS code -
   control_rep(), control_mbrep()
 	- Assert that the multibyte character passed in is a control
 	  character if it's valid. (DLR)
+	- If crep is an invalid multibyte sequence, copy Unicode 0xFFFD
+	  (Replacement Character) into it using strncpy() instead of
+	  assigning the former to it.  This avoids segfaults when freeing
+	  crep later, since it's supposed to be dynamically allocated.
+	  (DLR)
   mbrep()
 	- New function, the equivalent of control_mbrep() for non-control
 	  characters. (DLR)
diff --git a/src/chars.c b/src/chars.c
index e51547bc..945a9f53 100644
--- a/src/chars.c
+++ b/src/chars.c
@@ -213,7 +213,10 @@ wchar_t control_wrep(wchar_t wc)
 #endif
 
 /* c is a multibyte control character.  It displays as ^@, ^?, or ^[ch],
- * where ch is (c + 64).  We return that multibyte character. */
+ * where ch is (c + 64).  We return that multibyte character.  If crep
+ * is an invalid multibyte sequence, it will be replaced with Unicode
+ * 0xFFFD (Replacement Character), so it should be dynamically allocated
+ * and able to hold MB_CUR_MAX single-byte characters. */
 char *control_mbrep(const char *c, char *crep, int *crep_len)
 {
     assert(c != NULL && crep != NULL && crep_len != NULL);
@@ -224,8 +227,8 @@ char *control_mbrep(const char *c, char *crep, int *crep_len)
 
 	if (mbtowc(&wc, c, MB_CUR_MAX) < 0) {
 	    mbtowc(NULL, NULL, 0);
-	    crep = (char *)bad_mbchar;
 	    *crep_len = bad_mbchar_len;
+	    strncpy(crep, bad_mbchar, *crep_len);
 	} else {
 	    *crep_len = wctomb(crep, control_wrep(wc));
 
@@ -246,7 +249,10 @@ char *control_mbrep(const char *c, char *crep, int *crep_len)
 }
 
 /* c is a multibyte non-control character.  We return that multibyte
- * character. */
+ * character.  If crep is an invalid multibyte sequence, it will be
+ * replaced with Unicode 0xFFFD (Replacement Character), so it should be
+ * dynamically allocated and able to hold MB_CUR_MAX single-byte
+ * characters. */
 char *mbrep(const char *c, char *crep, int *crep_len)
 {
     assert(c != NULL && crep != NULL && crep_len != NULL);
@@ -258,8 +264,8 @@ char *mbrep(const char *c, char *crep, int *crep_len)
 	/* Reject invalid Unicode characters. */
 	if (mbtowc(&wc, c, MB_CUR_MAX) < 0 || !is_valid_unicode(wc)) {
 	    mbtowc(NULL, NULL, 0);
-	    crep = (char *)bad_mbchar;
 	    *crep_len = bad_mbchar_len;
+	    strncpy(crep, bad_mbchar, *crep_len);
 	} else {
 	    *crep_len = wctomb(crep, wc);