Fix out-of-bounds read in RemoveLineComments
Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24553pull/4146/head
parent
1909b3e8d2
commit
6f07e89fdf
|
@ -64,20 +64,28 @@ void CommentRemover::RemoveLineComments(const char* szComment,
|
||||||
if (len > lenBuffer) {
|
if (len > lenBuffer) {
|
||||||
len = lenBuffer;
|
len = lenBuffer;
|
||||||
}
|
}
|
||||||
while (*szBuffer) {
|
|
||||||
|
char *szCurrent = szBuffer;
|
||||||
|
while (*szCurrent) {
|
||||||
|
|
||||||
// skip over quotes
|
// skip over quotes
|
||||||
if (*szBuffer == '\"' || *szBuffer == '\'')
|
if (*szCurrent == '\"' || *szCurrent == '\'')
|
||||||
while (*szBuffer++ && *szBuffer != '\"' && *szBuffer != '\'');
|
while (*szCurrent++ && *szCurrent != '\"' && *szCurrent != '\'');
|
||||||
if (!strncmp(szBuffer,szComment,len)) {
|
|
||||||
while (!IsLineEnd(*szBuffer))
|
|
||||||
*szBuffer++ = chReplacement;
|
|
||||||
|
|
||||||
if (!*szBuffer) {
|
size_t lenRemaining = lenBuffer - (szCurrent - szBuffer);
|
||||||
|
if(lenRemaining < len) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!strncmp(szCurrent,szComment,len)) {
|
||||||
|
while (!IsLineEnd(*szCurrent))
|
||||||
|
*szCurrent++ = chReplacement;
|
||||||
|
|
||||||
|
if (!*szCurrent) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
++szBuffer;
|
++szCurrent;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue