From 68dddd4132521dc72133a4f0010d0d07ec30a16e Mon Sep 17 00:00:00 2001 From: Isaac Freund Date: Thu, 22 Apr 2021 00:37:03 +0200 Subject: keysym: fix underflow in binary searches This is hit when passing an empty string and XKB_KEYSYM_CASE_INSENSITIVE to xkb_keysym_from_name currently if `(lo + hi) / 2` is 0 and `cmp < 0`, causing mid to underflow and the the array access into name_to_keysym on the next iteration of the loop to be out of bounds . We *would* use ssize_t here as it is the appropriate type, but windows unfortunately does not define it. --- src/keysym.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/keysym.c b/src/keysym.c index 83a418e..bf49c63 100644 --- a/src/keysym.c +++ b/src/keysym.c @@ -69,9 +69,9 @@ xkb_keysym_get_name(xkb_keysym_t ks, char *buffer, size_t size) return -1; } - size_t lo = 0, hi = ARRAY_SIZE(keysym_to_name) - 1; + int32_t lo = 0, hi = ARRAY_SIZE(keysym_to_name) - 1; while (hi >= lo) { - size_t mid = (lo + hi) / 2; + int32_t mid = (lo + hi) / 2; if (ks > keysym_to_name[mid].keysym) { lo = mid + 1; } else if (ks < keysym_to_name[mid].keysym) { @@ -155,9 +155,9 @@ xkb_keysym_from_name(const char *name, enum xkb_keysym_flags flags) * lower-case match is enough in this case. */ else { - size_t lo = 0, hi = ARRAY_SIZE(name_to_keysym) - 1; + int32_t lo = 0, hi = ARRAY_SIZE(name_to_keysym) - 1; while (hi >= lo) { - size_t mid = (lo + hi) / 2; + int32_t mid = (lo + hi) / 2; int cmp = istrcmp(name, get_name(&name_to_keysym[mid])); if (cmp > 0) { lo = mid + 1; -- cgit v1.2.1