Fix possible buffer overruns

rfm · rfm · commit 1e3d29acf448 · 2025-11-11T19:23:36.000Z
diff --git a/Source/NSCharacterSet.m b/Source/NSCharacterSet.m
@@ -188,6 +188,10 @@ - (BOOL) hasMemberInPlane: (uint8_t)aPlane
       unsigned	i = GSBITMAP_SIZE * aPlane;
       unsigned	e = GSBITMAP_SIZE * (aPlane + 1);
 
+      if (e > _length)
+	{
+	  e = _length;
+	}
       while (i < e)
 	{
 	  if (_data[i] != 0)
@@ -450,6 +454,10 @@ - (NSData*) bitmapRepresentation
 	  i--;
 	}
     }
+  else if (_length < i)
+    {
+      i = _length;
+    }
   return [NSData dataWithBytes: _data length: i];
 }
 

Original file line number	Diff line number	Diff line change
`@@ -188,6 +188,10 @@ - (BOOL) hasMemberInPlane: (uint8_t)aPlane`
`188`	`188`	`unsigned i = GSBITMAP_SIZE * aPlane;`
`189`	`189`	`unsigned e = GSBITMAP_SIZE * (aPlane + 1);`
`190`	`190`
	`191`	`+ if (e > _length)`
	`192`	`+ {`
	`193`	`+ e = _length;`
	`194`	`+ }`
`191`	`195`	`while (i < e)`
`192`	`196`	`{`
`193`	`197`	`if (_data[i] != 0)`
`@@ -450,6 +454,10 @@ - (NSData*) bitmapRepresentation`
`450`	`454`	`i--;`
`451`	`455`	`}`
`452`	`456`	`}`
	`457`	`+ else if (_length < i)`
	`458`	`+ {`
	`459`	`+ i = _length;`
	`460`	`+ }`
`453`	`461`	`return [NSData dataWithBytes: _data length: i];`
`454`	`462`	`}`
`455`	`463`