summaryrefslogtreecommitdiff
path: root/libguile/strings.c
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2010-09-15 23:32:28 +0200
committerLudovic Courtès <ludo@gnu.org>2010-09-15 23:32:28 +0200
commitf1ee6d54d219056c62d87a8e4a6b199162c946e8 (patch)
tree2ccec5ae9d5c772111d8b1b48569c8b751d5257a /libguile/strings.c
parentfd5eec2b6e113f6d13028215a738417607432a2d (diff)
downloadguile-f1ee6d54d219056c62d87a8e4a6b199162c946e8.tar.gz
Fix write-beyond-end-of-string error in the conversion to R6RS string escapes.
Reported by Mike Gran <spk121@yahoo.com>. * libguile/strings.c (scm_i_unistring_escapes_to_guile_escapes, scm_i_unistring_escapes_to_r6rs_escapes): Augment comments. (scm_to_stringn): When `handler == SCM_FAILED_CONVERSION_ESCAPE_SEQUENCE && SCM_R6RS_ESCAPES_P', realloc BUF so that it's large enough for the worst case. * libguile/print.c (display_character): When `result != NULL && strategy == SCM_FAILED_CONVERSION_ESCAPE_SEQUENCE && SCM_R6RS_ESCAPES_P', make LOCALE_ENCODED large enough to hold an R6RS escape.
Diffstat (limited to 'libguile/strings.c')
-rw-r--r--libguile/strings.c20
1 files changed, 16 insertions, 4 deletions
diff --git a/libguile/strings.c b/libguile/strings.c
index dbff0660a..e64c37b84 100644
--- a/libguile/strings.c
+++ b/libguile/strings.c
@@ -1575,8 +1575,9 @@ scm_take_locale_string (char *str)
return scm_take_locale_stringn (str, -1);
}
-/* Change libunistring escapes (\uXXXX and \UXXXXXXXX) to \xXX \uXXXX
- and \UXXXXXX. */
+/* Change libunistring escapes (`\uXXXX' and `\UXXXXXXXX') in BUF, a
+ *LENP-byte locale-encoded string, to `\xXX', `\uXXXX', or `\UXXXXXX'.
+ Set *LENP to the size of the resulting string. */
void
scm_i_unistring_escapes_to_guile_escapes (char *buf, size_t *lenp)
{
@@ -1629,7 +1630,11 @@ scm_i_unistring_escapes_to_guile_escapes (char *buf, size_t *lenp)
*lenp = j;
}
-/* Change libunistring escapes (\uXXXX and \UXXXXXXXX) to \xXXXX; */
+/* Change libunistring escapes (`\uXXXX' and `\UXXXXXXXX') in BUF, a
+ *LENP-byte locale-encoded string, to `\xXXXX;'. Set *LEN to the size
+ of the resulting string. BUF must be large enough to handle the
+ worst case when `\uXXXX' escapes (6 characters) are replaced by
+ `\xXXXX;' (7 characters). */
void
scm_i_unistring_escapes_to_r6rs_escapes (char *buf, size_t *lenp)
{
@@ -1815,7 +1820,14 @@ scm_to_stringn (SCM str, size_t *lenp, const char *encoding,
if (handler == SCM_FAILED_CONVERSION_ESCAPE_SEQUENCE)
{
if (SCM_R6RS_ESCAPES_P)
- scm_i_unistring_escapes_to_r6rs_escapes (buf, &len);
+ {
+ /* The worst case is if the input string contains all 4-digit
+ hex escapes. "\uXXXX" (six characters) becomes "\xXXXX;"
+ (seven characters). Make BUF large enough to hold
+ that. */
+ buf = scm_realloc (buf, (len * 7) / 6 + 1);
+ scm_i_unistring_escapes_to_r6rs_escapes (buf, &len);
+ }
else
scm_i_unistring_escapes_to_guile_escapes (buf, &len);