| OLD | NEW |
|---|
| (Empty) | |
| 1 Index: source/i18n/rematch.cpp |
| 2 =================================================================== |
| 3 --- source/i18n/rematch.cpp (revision 98343) |
| 4 +++ source/i18n/rematch.cpp (working copy) |
| 5 @@ -5598,6 +5598,7 @@ |
| 6 const UChar *foldChars = NULL; |
| 7 int32_t foldOffset, foldLength; |
| 8 UChar32 c; |
| 9 + UBool c_is_valid = FALSE; |
| 10 |
| 11 #ifdef REGEX_SMART_BACKTRACKING |
| 12 int32_t originalInputIdx = fp->fInputIdx; |
| 13 @@ -5607,23 +5608,29 @@ |
| 14 foldOffset = foldLength = 0; |
| 15 |
| 16 while (patternChars < patternEnd && success) { |
| 17 - if(foldOffset < foldLength) { |
| 18 - U16_NEXT_UNSAFE(foldChars, foldOffset, c); |
| 19 - } else { |
| 20 - U16_NEXT(inputBuf, fp->fInputIdx, fActiveLimit, c); |
| 21 - foldLength = ucase_toFullFolding(csp, c, &foldChars
, U_FOLD_CASE_DEFAULT); |
| 22 - if(foldLength >= 0) { |
| 23 - if(foldLength <= UCASE_MAX_STRING_LENGTH) { /
/ !!!: Does not correctly handle chars that fold to 0-length strings |
| 24 - foldOffset = 0; |
| 25 - U16_NEXT_UNSAFE(foldChars, foldOffset, c); |
| 26 - } else { |
| 27 - c = foldLength; |
| 28 - foldLength = foldOffset; // to avoid readin
g chars from the folding buffer |
| 29 + if (fp->fInputIdx < fActiveLimit) { // don't read past
end of string |
| 30 + if(foldOffset < foldLength) { |
| 31 + U16_NEXT_UNSAFE(foldChars, foldOffset, c); |
| 32 + c_is_valid = TRUE; |
| 33 + } else { |
| 34 + // test pre-condition of U16_NEXT: i < length |
| 35 + U_ASSERT(fp->fInputIdx < fActiveLimit); |
| 36 + U16_NEXT(inputBuf, fp->fInputIdx, fActiveLimit,
c); |
| 37 + c_is_valid = TRUE; |
| 38 + foldLength = ucase_toFullFolding(csp, c, &foldC
hars, U_FOLD_CASE_DEFAULT); |
| 39 + if(foldLength >= 0) { |
| 40 + if(foldLength <= UCASE_MAX_STRING_LENGTH) {
// !!!: Does not correctly handle chars that fold to 0-length strings |
| 41 + foldOffset = 0; |
| 42 + U16_NEXT_UNSAFE(foldChars, foldOffset,
c); |
| 43 + } else { |
| 44 + c = foldLength; |
| 45 + foldLength = foldOffset; // to avoid re
ading chars from the folding buffer |
| 46 + } |
| 47 } |
| 48 } |
| 49 } |
| 50 |
| 51 - if (fp->fInputIdx <= fActiveLimit) { |
| 52 + if (fp->fInputIdx <= fActiveLimit && c_is_valid) { |
| 53 if (U_IS_BMP(c)) { |
| 54 success = (*patternChars == c); |
| 55 patternChars += 1; |
| 56 @@ -6070,4 +6077,3 @@ |
| 57 U_NAMESPACE_END |
| 58 |
| 59 #endif // !UCONFIG_NO_REGULAR_EXPRESSIONS |
| 60 - |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 7891051:
Fix for bug 81753, do not read past the end of unicode strings (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/deps/third_party/icu46/