Skip to content

Commit 1d87932

Browse files
authored
TextSubtext fixes (#4759)
Fix buffer write overflow Fix reading past the end of text
1 parent a1de60f commit 1d87932

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

src/rtext.c

+6-6
Original file line numberDiff line numberDiff line change
@@ -1540,21 +1540,21 @@ const char *TextSubtext(const char *text, int position, int length)
15401540

15411541
if (position >= textLength)
15421542
{
1543-
position = textLength - 1;
1544-
length = 0;
1543+
return buffer; //First char is already '\0' by memset
15451544
}
15461545

1547-
if (length >= textLength) length = textLength;
1546+
int maxLength = textLength - position;
1547+
if (length > maxLength) length = maxLength;
1548+
if (length >= MAX_TEXT_BUFFER_LENGTH) length = MAX_TEXT_BUFFER_LENGTH - 1;
15481549

15491550
// NOTE: Alternative: memcpy(buffer, text + position, length)
15501551

15511552
for (int c = 0 ; c < length ; c++)
15521553
{
1553-
*(buffer + c) = *(text + position);
1554-
text++;
1554+
buffer[c] = text[position + c];
15551555
}
15561556

1557-
*(buffer + length) = '\0';
1557+
buffer[length] = '\0';
15581558

15591559
return buffer;
15601560
}

0 commit comments

Comments
 (0)