comparison util.c @ 311:5a22c65d019c

fix for memory overrun
author Yoshiki Yazawa <yaz@honeyplanet.jp>
date Sun, 05 Jul 2009 10:40:27 +0900
parents 42cdddf0f747
children e2156468f4e5
comparison
equal deleted inserted replaced
310:aa1f0dd1a723 311:5a22c65d019c
75 75
76 g_return_val_if_fail(src != NULL, NULL); 76 g_return_val_if_fail(src != NULL, NULL);
77 77
78 const gchar *ptr, *ent; 78 const gchar *ptr, *ent;
79 gchar *ptr2; 79 gchar *ptr2;
80 gint srclen;
80 gint entlen; 81 gint entlen;
81 82
82 /* unescape &x; */ 83 /* unescape &x; */
83 html = g_malloc0(strlen(src) + 1); 84 srclen = strlen(src);
85 html = g_malloc0(srclen + 1);
84 ptr2 = html; 86 ptr2 = html;
85 for(ptr = src; *ptr; ) { 87 for(ptr = src; *ptr; ) {
86 if(*ptr == '&') { 88 if(*ptr == '&') {
87 ent = purple_markup_unescape_entity(ptr, &entlen); 89 ent = purple_markup_unescape_entity(ptr, &entlen);
88 if(ent != NULL) { 90 if(ent != NULL) {
96 } 98 }
97 } 99 }
98 else { 100 else {
99 *ptr2++ = *ptr++; 101 *ptr2++ = *ptr++;
100 } 102 }
103 if(ptr2 - html > srclen)
104 break;
101 } /* for */ 105 } /* for */
102 106
103 str = g_strdup("\0"); 107 str = g_strdup("\0");
104 108
105 head = html; 109 head = html;