Commit da511fa4dff62f17d36dc081afb51cd53b50be42

Martin Mitas 2019-02-03T00:45:20

md_is_entity_str(): Fix using bad offset and buffer overflow situation. Fixes #47.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
diff --git a/md4c/md4c.c b/md4c/md4c.c
index b93aa19..2435d6c 100644
--- a/md4c/md4c.c
+++ b/md4c/md4c.c
@@ -1335,9 +1335,9 @@ md_is_entity_str(MD_CTX* ctx, const CHAR* text, OFF beg, OFF max_end, OFF* p_end
     MD_ASSERT(text[off] == _T('&'));
     off++;
 
-    if(off+1 < max_end  &&  text[off] == _T('#')  &&  (text[off+1] == _T('x') || text[off+1] == _T('X')))
+    if(off+2 < max_end  &&  text[off] == _T('#')  &&  (text[off+1] == _T('x') || text[off+1] == _T('X')))
         is_contents = md_is_hex_entity_contents(ctx, text, off+2, max_end, &off);
-    else if(off < max_end  &&  CH(off) == _T('#'))
+    else if(off+1 < max_end  &&  text[off] == _T('#'))
         is_contents = md_is_dec_entity_contents(ctx, text, off+1, max_end, &off);
     else
         is_contents = md_is_named_entity_contents(ctx, text, off, max_end, &off);