Guarantee that dom_strings are NUL terminated

svn path=/trunk/libdom/; revision=13646

1 files changed, 12 insertions, 6 deletions

diff --git a/src/core/string.c b/src/core/string.c
index dd9b268..4e6d98c 100644
--- a/src/core/string.c
+++ b/src/core/string.c
@@ -121,13 +121,14 @@ dom_exception dom_string_create(const uint8_t *ptr, size_t len,
 	if (ret == NULL)
 		return DOM_NO_MEM_ERR;
 
-	ret->data.cdata.ptr = malloc((len > 0) ? len : 1);
+	ret->data.cdata.ptr = malloc(len + 1);
 	if (ret->data.cdata.ptr == NULL) {
 		free(ret);
 		return DOM_NO_MEM_ERR;
 	}
 
 	memcpy(ret->data.cdata.ptr, ptr, len);
+	ret->data.cdata.ptr[len] = '\0';
 
 	ret->data.cdata.len = len;
 
@@ -335,7 +336,7 @@ bool dom_string_lwc_isequal(const dom_string *s1, lwc_string *s2)
 		return match;
 	}
 
-	/* Handle non-interend case */
+	/* Handle non-interned case */
 	len = dom_string_byte_length(s1);
 
 	if (len != lwc_string_length(s2))
@@ -540,12 +541,11 @@ dom_exception dom_string_concat(dom_string *s1, dom_string *s2,
 	s2len = dom_string_byte_length(s2);
 
 	concat = malloc(sizeof(dom_string));
-
 	if (concat == NULL) {
 		return DOM_NO_MEM_ERR;
 	}
 
-	concat->data.cdata.ptr = malloc(s1len + s2len);
+	concat->data.cdata.ptr = malloc(s1len + s2len + 1);
 	if (concat->data.cdata.ptr == NULL) {
 		free(concat);
 
@@ -556,6 +556,8 @@ dom_exception dom_string_concat(dom_string *s1, dom_string *s2,
 
 	memcpy(concat->data.cdata.ptr + s1len, s2ptr, s2len);
 
+	concat->data.cdata.ptr[s1len + s2len] = '\0';
+
 	concat->data.cdata.len = s1len + s2len;
 
 	concat->refcnt = 1;
@@ -678,7 +680,7 @@ dom_exception dom_string_insert(dom_string *target,
 	}
 
 	/* Allocate data buffer for result contents */
-	res->data.cdata.ptr = malloc(tlen + slen);
+	res->data.cdata.ptr = malloc(tlen + slen + 1);
 	if (res->data.cdata.ptr == NULL) {
 		free(res);
 		return DOM_NO_MEM_ERR;
@@ -697,6 +699,8 @@ dom_exception dom_string_insert(dom_string *target,
 		memcpy(res->data.cdata.ptr + ins + slen, t + ins, tlen - ins);
 	}
 
+	res->data.cdata.ptr[tlen + slen] = '\0';
+
 	res->data.cdata.len = tlen + slen;
 
 	res->refcnt = 1;
@@ -773,7 +777,7 @@ dom_exception dom_string_replace(dom_string *target,
 	}
 
 	/* Allocate data buffer for result contents */
-	res->data.cdata.ptr = malloc(tlen + slen - (b2 - b1));
+	res->data.cdata.ptr = malloc(tlen + slen - (b2 - b1) + 1);
 	if (res->data.cdata.ptr == NULL) {
 		free(res);
 		return DOM_NO_MEM_ERR;
@@ -794,6 +798,8 @@ dom_exception dom_string_replace(dom_string *target,
 		memcpy(res->data.cdata.ptr + b1 + slen, t + b2, tlen - b2);
 	}
 
+	res->data.cdata.ptr[tlen + slen - (b2 - b1)] = '\0';
+
 	res->data.cdata.len = tlen + slen - (b2 - b1);
 
 	res->refcnt = 1;