changeset: 6525:444f1f013f1b
user:      Kevin McCarthy <ke...@8t8.us>
date:      Wed Nov 18 16:14:39 2015 -0800
link:      http://dev.mutt.org/hg/mutt/rev/444f1f013f1b

Fix memcpy buf=NULL/len=0 issue in replace_part(). (closes #3790)

Calling memcpy with src or dest=NULL is technically illegal, even if
len=0.  Recent compilers seem to now be generating warnings/errors with
this.

replace_part() is currently the only place we are getting bug reports,
so for now just fix the problem in this one place.

diffs (46 lines):

diff -r c799162691b2 -r 444f1f013f1b enter.c
--- a/enter.c   Mon Nov 09 18:53:05 2015 -0800
+++ b/enter.c   Wed Nov 18 16:14:39 2015 -0800
@@ -166,24 +166,32 @@
 {
   /* Save the suffix */
   size_t savelen = state->lastchar - state->curpos;
-  wchar_t *savebuf = safe_calloc (savelen, sizeof (wchar_t));
-  memcpy (savebuf, state->wbuf + state->curpos, savelen * sizeof (wchar_t));
+  wchar_t *savebuf = NULL;
+
+  if (savelen)
+  {
+    savebuf = safe_calloc (savelen, sizeof (wchar_t));
+    memcpy (savebuf, state->wbuf + state->curpos, savelen * sizeof (wchar_t));
+  }
 
   /* Convert to wide characters */
   state->curpos = my_mbstowcs (&state->wbuf, &state->wbuflen, from, buf);
 
-  /* Make space for suffix */
-  if (state->curpos + savelen > state->wbuflen)
+  if (savelen)
   {
-    state->wbuflen = state->curpos + savelen;
-    safe_realloc (&state->wbuf, state->wbuflen * sizeof (wchar_t));
+    /* Make space for suffix */
+    if (state->curpos + savelen > state->wbuflen)
+    {
+      state->wbuflen = state->curpos + savelen;
+      safe_realloc (&state->wbuf, state->wbuflen * sizeof (wchar_t));
+    }
+
+    /* Restore suffix */
+    memcpy (state->wbuf + state->curpos, savebuf, savelen * sizeof (wchar_t));
+    FREE (&savebuf);
   }
 
-  /* Restore suffix */
-  memcpy (state->wbuf + state->curpos, savebuf, savelen * sizeof (wchar_t));
   state->lastchar = state->curpos + savelen;
-
-  FREE (&savebuf);
 }
 
 /*

Reply via email to