From 1c0e5a4773cb14415e2ace40af154e8c48e3f825 Mon Sep 17 00:00:00 2001
From: Andrew Borodin <aborodin@vmail.ru>
Date: Thu, 21 Jul 2011 14:06:26 +0400
Subject: [PATCH] Fix potential segfault in term_trim() functions

...if requested width is negative.

Signed-off-by: Andrew Borodin <aborodin@vmail.ru>
---
 lib/strutil/strutil8bit.c  | 39 +++++++++++++++++++--------------------
 lib/strutil/strutilascii.c | 46 +++++++++++++++++++++++++---------------------
 lib/strutil/strutilutf8.c  |  6 ++++++
 3 files changed, 50 insertions(+), 41 deletions(-)

diff --git a/lib/strutil/strutil8bit.c b/lib/strutil/strutil8bit.c
index 92082ef31..d462402bf 100644
--- a/lib/strutil/strutil8bit.c
+++ b/lib/strutil/strutil8bit.c
@@ -381,33 +381,32 @@ str_8bit_term_trim (const char *text, int width)
     actual = result;
     remain = sizeof (result);
 
-    if (width < (int) length)
+    if (width > 0)
     {
-        if (width <= 3)
+        if (width < (int) length)
         {
-            memset (actual, '.', width);
-            actual += width;
-            remain -= width;
-        }
-        else
-        {
-            memset (actual, '.', 3);
-            actual += 3;
-            remain -= 3;
+            if (width <= 3)
+            {
+                memset (actual, '.', width);
+                actual += width;
+                remain -= width;
+            }
+            else
+            {
+                memset (actual, '.', 3);
+                actual += 3;
+                remain -= 3;
 
-            pos += length - width + 3;
+                pos += length - width + 3;
 
-            for (; pos < length && remain > 1; pos++, actual++, remain--)
-            {
-                actual[0] = char_isprint (text[pos]) ? text[pos] : '.';
+                for (; pos < length && remain > 1; pos++, actual++, remain--)
+                    actual[0] = char_isprint (text[pos]) ? text[pos] : '.';
             }
         }
-    }
-    else
-    {
-        for (; pos < length && remain > 1; pos++, actual++, remain--)
+        else
         {
-            actual[0] = char_isprint (text[pos]) ? text[pos] : '.';
+            for (; pos < length && remain > 1; pos++, actual++, remain--)
+                actual[0] = char_isprint (text[pos]) ? text[pos] : '.';
         }
     }
 
diff --git a/lib/strutil/strutilascii.c b/lib/strutil/strutilascii.c
index 413e5a1cf..23ec7a1c2 100644
--- a/lib/strutil/strutilascii.c
+++ b/lib/strutil/strutilascii.c
@@ -327,23 +327,36 @@ str_ascii_term_trim (const char *text, int width)
     actual = result;
     remain = sizeof (result);
 
-    if (width < (int) length)
+
+    if (width > 0)
     {
-        if (width <= 3)
+        if (width < (int) length)
         {
-            memset (actual, '.', width);
-            actual += width;
-            remain -= width;
+            if (width <= 3)
+            {
+                memset (actual, '.', width);
+                actual += width;
+                remain -= width;
+            }
+            else
+            {
+                memset (actual, '.', 3);
+                actual += 3;
+                remain -= 3;
+
+                pos += length - width + 3;
+
+                /* copy suffix of text */
+                for (; pos < length && remain > 1; pos++, actual++, remain--)
+                {
+                    actual[0] = isascii ((unsigned char) text[pos]) ? text[pos] : '?';
+                    actual[0] = g_ascii_isprint ((gchar) actual[0]) ? actual[0] : '.';
+                }
+            }
         }
         else
         {
-            memset (actual, '.', 3);
-            actual += 3;
-            remain -= 3;
-
-            pos += length - width + 3;
-
-            /* copy suffix of text */
+            /* copy all characters */
             for (; pos < length && remain > 1; pos++, actual++, remain--)
             {
                 actual[0] = isascii ((unsigned char) text[pos]) ? text[pos] : '?';
@@ -351,15 +364,6 @@ str_ascii_term_trim (const char *text, int width)
             }
         }
     }
-    else
-    {
-        /* copy all characters */
-        for (; pos < length && remain > 1; pos++, actual++, remain--)
-        {
-            actual[0] = isascii ((unsigned char) text[pos]) ? text[pos] : '?';
-            actual[0] = g_ascii_isprint ((gchar) actual[0]) ? actual[0] : '.';
-        }
-    }
 
     actual[0] = '\0';
     return result;
diff --git a/lib/strutil/strutilutf8.c b/lib/strutil/strutilutf8.c
index 59be6b2ce..cde3302d0 100644
--- a/lib/strutil/strutilutf8.c
+++ b/lib/strutil/strutilutf8.c
@@ -669,6 +669,12 @@ str_utf8_term_trim (const char *text, int width)
     const struct term_form *pre_form;
     struct utf8_tool tool;
 
+    if (width < 1)
+    {
+        result [0] = '\0';
+        return result;
+    }
+
     pre_form = str_utf8_make_make_term_form (text, (size_t) (-1));
 
     tool.cheked = pre_form->text;
-- 
2.11.4.GIT