diff options
author | John Mark Bell <jmb@netsurf-browser.org> | 2008-11-27 02:51:11 +0000 |
---|---|---|
committer | John Mark Bell <jmb@netsurf-browser.org> | 2008-11-27 02:51:11 +0000 |
commit | 0956b553da021d26ebd37d91ab1c86bc3dfb0d53 (patch) | |
tree | 77a10230ac3e5f76ea9eec37d26e8c2d3dba03eb /src/lex | |
parent | a572ac473682204ceab8e08be05c878569a8e5b0 (diff) | |
download | libcss-0956b553da021d26ebd37d91ab1c86bc3dfb0d53.tar.gz |
Prevent reading from beyond the start of token data.
svn path=/trunk/libcss/; revision=5807
Diffstat (limited to 'src/lex')
-rw-r--r-- | src/lex/lex.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/src/lex/lex.c b/src/lex/lex.c index 29291cf..7565b60 100644 --- a/src/lex/lex.c +++ b/src/lex/lex.c @@ -397,8 +397,8 @@ css_error emitToken(css_lexer *lexer, css_token_type type, t->data.len -= 1; /* Strip the trailing quote, iff it exists (may have hit EOF) */ - if (t->data.ptr[t->data.len - 1] == '"' || - t->data.ptr[t->data.len - 1] == '\'') { + if (t->data.len > 0 && (t->data.ptr[t->data.len - 1] == '"' || + t->data.ptr[t->data.len - 1] == '\'')) { t->data.len -= 1; } break; @@ -440,13 +440,14 @@ css_error emitToken(css_lexer *lexer, css_token_type type, t->data.len -= 1; /* Strip any trailing whitespace */ - while (isSpace(t->data.ptr[t->data.len - 1])) { + while (t->data.len > 0 && + isSpace(t->data.ptr[t->data.len - 1])) { t->data.len--; } /* Strip any trailing quote */ - if (t->data.ptr[t->data.len - 1] == '"' || - t->data.ptr[t->data.len - 1] == '\'') { + if (t->data.len > 0 && (t->data.ptr[t->data.len - 1] == '"' || + t->data.ptr[t->data.len - 1] == '\'')) { t->data.len -= 1; } break; |