diff options
author | Matthias Clasen <mclasen@redhat.com> | 2016-02-26 15:50:31 -0500 |
---|---|---|
committer | Matthias Clasen <mclasen@redhat.com> | 2016-02-26 15:52:19 -0500 |
commit | ca3d87ce70e1a9c00a37d40eb0d8039d92368a1d (patch) | |
tree | 688b636c9ecbe5abdede5fbc3b8c53e126335fdb | |
parent | 8ff40b5d149b041aae324e8cc4dff64a26bd09eb (diff) | |
download | gtk+-ca3d87ce70e1a9c00a37d40eb0d8039d92368a1d.tar.gz |
Avoid an out-of-bounds access
When the offset gets smaller than min_offset, we can't
access the array at that position.
-rw-r--r-- | gtk/gtktextiter.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/gtk/gtktextiter.c b/gtk/gtktextiter.c index dc3891a1b4..3e2e5f5300 100644 --- a/gtk/gtktextiter.c +++ b/gtk/gtktextiter.c @@ -3073,9 +3073,12 @@ inside_sentence_func (const PangoLogAttr *attrs, gint len) { /* Find next sentence start or end */ - while (offset >= min_offset && - !(attrs[offset].is_sentence_start || attrs[offset].is_sentence_end)) - --offset; + while (!(attrs[offset].is_sentence_start || attrs[offset].is_sentence_end)) + { + --offset; + if (offset < min_offset) + return FALSE; + } return attrs[offset].is_sentence_start; } |