summaryrefslogtreecommitdiff
path: root/src/lex
diff options
context:
space:
mode:
authorJohn Mark Bell <jmb@netsurf-browser.org>2008-11-27 02:51:11 +0000
committerJohn Mark Bell <jmb@netsurf-browser.org>2008-11-27 02:51:11 +0000
commit0956b553da021d26ebd37d91ab1c86bc3dfb0d53 (patch)
tree77a10230ac3e5f76ea9eec37d26e8c2d3dba03eb /src/lex
parenta572ac473682204ceab8e08be05c878569a8e5b0 (diff)
downloadlibcss-0956b553da021d26ebd37d91ab1c86bc3dfb0d53.tar.gz
libcss-0956b553da021d26ebd37d91ab1c86bc3dfb0d53.tar.bz2
Prevent reading from beyond the start of token data.
svn path=/trunk/libcss/; revision=5807
Diffstat (limited to 'src/lex')
-rw-r--r--src/lex/lex.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/src/lex/lex.c b/src/lex/lex.c
index 29291cf..7565b60 100644
--- a/src/lex/lex.c
+++ b/src/lex/lex.c
@@ -397,8 +397,8 @@ css_error emitToken(css_lexer *lexer, css_token_type type,
t->data.len -= 1;
/* Strip the trailing quote, iff it exists (may have hit EOF) */
- if (t->data.ptr[t->data.len - 1] == '"' ||
- t->data.ptr[t->data.len - 1] == '\'') {
+ if (t->data.len > 0 && (t->data.ptr[t->data.len - 1] == '"' ||
+ t->data.ptr[t->data.len - 1] == '\'')) {
t->data.len -= 1;
}
break;
@@ -440,13 +440,14 @@ css_error emitToken(css_lexer *lexer, css_token_type type,
t->data.len -= 1;
/* Strip any trailing whitespace */
- while (isSpace(t->data.ptr[t->data.len - 1])) {
+ while (t->data.len > 0 &&
+ isSpace(t->data.ptr[t->data.len - 1])) {
t->data.len--;
}
/* Strip any trailing quote */
- if (t->data.ptr[t->data.len - 1] == '"' ||
- t->data.ptr[t->data.len - 1] == '\'') {
+ if (t->data.len > 0 && (t->data.ptr[t->data.len - 1] == '"' ||
+ t->data.ptr[t->data.len - 1] == '\'')) {
t->data.len -= 1;
}
break;