kimcinoo
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

eina_strbuf: resolve segfault when replace used with read_only buffer 

Summary: when eina_strbuf_replace is used by read_only buffer, this will cause segfault (access invalid memory)

Reviewers: cedric

Reviewed By: cedric

Subscribers: cedric, #reviewers, #committers

Tags: #efl

Maniphest Tasks: T8757

Differential Revision: https://phab.enlightenment.org/D11989
This commit is contained in:
Ali Alzyod 2020-06-22 16:54:51 +09:00 committed by WooHyun Jung
parent e3e3d0cfe4
commit 1bbd03b768
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/lib/eina/eina_strbuf_common.c
View File

@ -945,6 +945,10 @@ eina_strbuf_replace(Eina_Strbuf *buf,
if (n) spos++;
}
pos = spos - (const char *)buf->buf;
len1 = strlen(str);
len2 = strlen(with);
/* This is a read only buffer which need change to be made */
if (buf->ro)
{
@ -956,9 +960,6 @@ eina_strbuf_replace(Eina_Strbuf *buf,
buf->buf = dest;
}
pos = spos - (const char *)buf->buf;
len1 = strlen(str);
len2 = strlen(with);
if (len1 != len2)
{
/* resize the buffer if necessary */

10
src/tests/eina/eina_test_strbuf.c
View File

@ -303,6 +303,16 @@ EFL_START_TEST(eina_test_strbuf_replace)
fail_if(strlen(eina_strbuf_string_get(buf)) != eina_strbuf_length_get(buf));
fail_if(strcmp(eina_strbuf_string_get(buf), "baaaab"));
fail_if(eina_strbuf_replace_first(buf, "a", "b") == 0);
fail_if(strcmp(eina_strbuf_string_get(buf), "bbaaab"));
eina_strbuf_free(buf);
buf = eina_strbuf_manage_read_only_new_length("baaaab",6);
fail_if(!buf);
fail_if(eina_strbuf_replace_first(buf, "a", "b") == 0);
fail_if(strcmp(eina_strbuf_string_get(buf), "bbaaab"));
eina_strbuf_free(buf);
}
EFL_END_TEST