diff options
author | Andreas Kling <kling@serenityos.org> | 2021-02-24 22:10:32 +0100 |
---|---|---|
committer | Andreas Kling <kling@serenityos.org> | 2021-02-24 22:13:04 +0100 |
commit | 42133a196a0bea83705b5947921d5c7e5b9f201d (patch) | |
tree | 289404f803dcf3980cfca2efbd403e7e47348b87 /AK/StringView.h | |
parent | 9bc3c3c9628926de22fe19f12672472fc9dfe661 (diff) | |
download | serenity-42133a196a0bea83705b5947921d5c7e5b9f201d.zip |
AK: Don't compare past '\0' in StringView::operator==(const char*)
We kept scanning the needle string even after hitting a null terminator
and that's clearly not right.
Found by oss-fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31338
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31351
Diffstat (limited to 'AK/StringView.h')
-rw-r--r-- | AK/StringView.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/AK/StringView.h b/AK/StringView.h index 1237e147b6..0a5edf6904 100644 --- a/AK/StringView.h +++ b/AK/StringView.h @@ -147,6 +147,8 @@ public: // NOTE: `m_characters` is not guaranteed to be null-terminated, but `cstring` is. const char* cp = cstring; for (size_t i = 0; i < m_length; ++i) { + if (!*cp) + return false; if (m_characters[i] != *(cp++)) return false; } |