summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorNick Wellnhofer <wellnhofer@aevum.de>2015-05-07 17:26:36 +0200
committerNick Wellnhofer <wellnhofer@aevum.de>2015-05-07 17:29:00 +0200
commit5f52f7be7fa1e119fc74cabe1a3a4fd44b6e4623 (patch)
tree7977e41419ec4c46f6539a6ec426c06d85227c94 /src
parentc06c705260a6681a8bb5eebecd35422e388cab9f (diff)
Multiple issues with numeric entities
This closes #33.
Diffstat (limited to 'src')
-rw-r--r--src/houdini_html_u.c39
1 files changed, 26 insertions, 13 deletions
diff --git a/src/houdini_html_u.c b/src/houdini_html_u.c
index 2cb14b4..eaf295e 100644
--- a/src/houdini_html_u.c
+++ b/src/houdini_html_u.c
@@ -12,32 +12,45 @@ houdini_unescape_ent(cmark_strbuf *ob, const uint8_t *src, size_t size)
{
size_t i = 0;
- if (size > 3 && src[0] == '#') {
- int codepoint = 0;
+ if (size >= 3 && src[0] == '#') {
+ int codepoint = 0;
+ int num_digits = 0;
if (_isdigit(src[1])) {
for (i = 1; i < size && _isdigit(src[i]); ++i) {
- int cp = (codepoint * 10) + (src[i] - '0');
+ codepoint = (codepoint * 10) + (src[i] - '0');
- if (cp < codepoint)
- return 0;
-
- codepoint = cp;
+ if (codepoint >= 0x110000) {
+ // Keep counting digits but
+ // avoid integer overflow.
+ codepoint = 0x110000;
+ }
}
+
+ num_digits = i - 1;
}
else if (src[1] == 'x' || src[1] == 'X') {
for (i = 2; i < size && _isxdigit(src[i]); ++i) {
- int cp = (codepoint * 16) + ((src[i] | 32) % 39 - 9);
+ codepoint = (codepoint * 16) + ((src[i] | 32) % 39 - 9);
- if (cp < codepoint)
- return 0;
-
- codepoint = cp;
+ if (codepoint >= 0x110000) {
+ // Keep counting digits but
+ // avoid integer overflow.
+ codepoint = 0x110000;
+ }
}
+
+ num_digits = i - 2;
}
- if (i < size && src[i] == ';' && codepoint) {
+ if (num_digits >= 1 && num_digits <= 8 &&
+ i < size && src[i] == ';') {
+ if (codepoint == 0 ||
+ (codepoint >= 0xD800 && codepoint < 0xE000) ||
+ codepoint >= 0x110000) {
+ codepoint = 0xFFFD;
+ }
utf8proc_encode_char(codepoint, ob);
return i + 1;
}