git_clone/thorvg
1
0
Fork 0
mirror of https://github.com/thorvg/thorvg.git synced 2025-06-14 12:04:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

svg_loader XmlParser: Fix check the end of string

Browse source 
While skipping the string, check the end of the string first.
Prevents an invalid read when parser really get to the end of the string.
This commit is contained in:
JunsuChoi 2021-06-22 13:27:40 +09:00 • committed by Hermet Park
parent 24cebf5cc5
commit b791924983
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/loaders/svg/tvgXmlParser.cpp
View file

@ -142,7 +142,7 @@ static const char* _simpleXmlUnskipWhiteSpace(const char* itr, const char* itrSt
static const char* _simpleXmlSkipXmlEntities(const char* itr, const char* itrEnd) static const char* _simpleXmlSkipXmlEntities(const char* itr, const char* itrEnd)
{ {
auto p = itr; auto p = itr;
while (*itr == '&' && itr < itrEnd) { while (itr < itrEnd && *itr == '&') {
for (int i = 0; i < NUMBER_OF_XML_ENTITIES; ++i) { for (int i = 0; i < NUMBER_OF_XML_ENTITIES; ++i) {
if (strncmp(itr, xmlEntity[i], xmlEntityLength[i]) == 0) { if (strncmp(itr, xmlEntity[i], xmlEntityLength[i]) == 0) {
itr += xmlEntityLength[i]; itr += xmlEntityLength[i];
@ -159,7 +159,7 @@ static const char* _simpleXmlSkipXmlEntities(const char* itr, const char* itrEnd
static const char* _simpleXmlUnskipXmlEntities(const char* itr, const char* itrStart) static const char* _simpleXmlUnskipXmlEntities(const char* itr, const char* itrStart)
{ {
auto p = itr; auto p = itr;
while (*(itr - 1) == ';' && itr > itrStart) { while (itr > itrStart && *(itr - 1) == ';') {
for (int i = 0; i < NUMBER_OF_XML_ENTITIES; ++i) { for (int i = 0; i < NUMBER_OF_XML_ENTITIES; ++i) {
if (itr - xmlEntityLength[i] > itrStart && if (itr - xmlEntityLength[i] > itrStart &&
strncmp(itr - xmlEntityLength[i], xmlEntity[i], xmlEntityLength[i]) == 0) { strncmp(itr - xmlEntityLength[i], xmlEntity[i], xmlEntityLength[i]) == 0) {