Merge pull request #341 from dequis/strsplit-len-fix

Fix invalid reads in strsplit_len when splitting on spaces

1 files changed, 6 insertions, 6 deletions

diff --git a/src/core/misc.c b/src/core/misc.c
index 88c27255..490b5a8f 100644
--- a/src/core/misc.c
+++ b/src/core/misc.c
@@ -997,22 +997,22 @@ char **strsplit_len(const char *str, int len, gboolean onspace)
 	int n;
 	int offset;
 
-	for (n = 0; *str != '\0'; n++, str += MIN(len - offset, strlen(str))) {
-		offset = 0;
-		if (onspace) {
+	for (n = 0; *str != '\0'; n++, str += offset) {
+		offset = MIN(len, strlen(str));
+		if (onspace && strlen(str) > len) {
 			/*
 			 * Try to find a space to split on and leave
 			 * the space on the previous line.
 			 */
 			int i;
-			for (i = 0; i < len; i++) {
-				if (str[len-1-i] == ' ') {
+			for (i = len - 1; i > 0; i--) {
+				if (str[i] == ' ') {
 					offset = i;
 					break;
 				}
 			}
 		}
-		ret[n] = g_strndup(str, len - offset);
+		ret[n] = g_strndup(str, offset);
 		ret = g_renew(char *, ret, n + 2);
 	}
 	ret[n] = NULL;