From 0956b553da021d26ebd37d91ab1c86bc3dfb0d53 Mon Sep 17 00:00:00 2001 From: John Mark Bell Date: Thu, 27 Nov 2008 02:51:11 +0000 Subject: Prevent reading from beyond the start of token data. svn path=/trunk/libcss/; revision=5807 --- src/lex/lex.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/lex/lex.c b/src/lex/lex.c index 29291cf..7565b60 100644 --- a/src/lex/lex.c +++ b/src/lex/lex.c @@ -397,8 +397,8 @@ css_error emitToken(css_lexer *lexer, css_token_type type, t->data.len -= 1; /* Strip the trailing quote, iff it exists (may have hit EOF) */ - if (t->data.ptr[t->data.len - 1] == '"' || - t->data.ptr[t->data.len - 1] == '\'') { + if (t->data.len > 0 && (t->data.ptr[t->data.len - 1] == '"' || + t->data.ptr[t->data.len - 1] == '\'')) { t->data.len -= 1; } break; @@ -440,13 +440,14 @@ css_error emitToken(css_lexer *lexer, css_token_type type, t->data.len -= 1; /* Strip any trailing whitespace */ - while (isSpace(t->data.ptr[t->data.len - 1])) { + while (t->data.len > 0 && + isSpace(t->data.ptr[t->data.len - 1])) { t->data.len--; } /* Strip any trailing quote */ - if (t->data.ptr[t->data.len - 1] == '"' || - t->data.ptr[t->data.len - 1] == '\'') { + if (t->data.len > 0 && (t->data.ptr[t->data.len - 1] == '"' || + t->data.ptr[t->data.len - 1] == '\'')) { t->data.len -= 1; } break; -- cgit v1.2.3