Selaa lähdekoodia

LibTextCodec: Make UTF16BEDecoder read only up to an even offset

Reading up to the end of the input string of odd length results in
an out-of-bounds read
Idan Horowitz 4 vuotta sitten
vanhempi
commit
c9f25bca04
1 muutettua tiedostoa jossa 2 lisäystä ja 1 poistoa
  1. 2 1
      Userland/Libraries/LibTextCodec/Decoder.cpp

+ 2 - 1
Userland/Libraries/LibTextCodec/Decoder.cpp

@@ -183,7 +183,8 @@ String UTF8Decoder::to_utf8(const StringView& input)
 String UTF16BEDecoder::to_utf8(const StringView& input)
 String UTF16BEDecoder::to_utf8(const StringView& input)
 {
 {
     StringBuilder builder(input.length() / 2);
     StringBuilder builder(input.length() / 2);
-    for (size_t i = 0; i < input.length(); i += 2) {
+    size_t utf16_length = input.length() - (input.length() % 2);
+    for (size_t i = 0; i < utf16_length; i += 2) {
         u16 code_point = (input[i] << 8) | input[i + 1];
         u16 code_point = (input[i] << 8) | input[i + 1];
         builder.append_code_point(code_point);
         builder.append_code_point(code_point);
     }
     }