From 6442209cd6d8628584956780e5d8298a33098500 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Tue, 3 Aug 2021 01:23:25 -0400 Subject: [PATCH 1/2] Fix buffer overflow in swkbdDictWordCreate --- src/util.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util.cpp b/src/util.cpp index ed1251a..4e6f7fd 100644 --- a/src/util.cpp +++ b/src/util.cpp @@ -66,10 +66,10 @@ void swkbdDictWordCreate(dictWord *w, const char *read, const char *word) uint16_t tmp[0x32 / sizeof(uint16_t)]; memset(tmp, 0, 0x32); - utf8_to_utf16(tmp, (uint8_t *)read, 0x30); + utf8_to_utf16(tmp, (uint8_t *)read, 0x19); memcpy(w->read, tmp, 0x30); - utf8_to_utf16(tmp, (uint8_t *)word, 0x30); + utf8_to_utf16(tmp, (uint8_t *)word, 0x19); memcpy(w->word, tmp, 0x30); } From 2ebe81556d93616009cd3859720d5a6bab17ecbe Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Tue, 3 Aug 2021 10:22:20 -0400 Subject: [PATCH 2/2] Refactored swkbdDictWordCreate --- src/util.cpp | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/src/util.cpp b/src/util.cpp index 4e6f7fd..e1aaf60 100644 --- a/src/util.cpp +++ b/src/util.cpp @@ -60,17 +60,10 @@ typedef struct void swkbdDictWordCreate(dictWord *w, const char *read, const char *word) { - memset(w->read, 0, 0x32); - memset(w->word, 0, 0x32); + memset(w, 0, sizeof(*w)); - uint16_t tmp[0x32 / sizeof(uint16_t)]; - memset(tmp, 0, 0x32); - - utf8_to_utf16(tmp, (uint8_t *)read, 0x19); - memcpy(w->read, tmp, 0x30); - - utf8_to_utf16(tmp, (uint8_t *)word, 0x19); - memcpy(w->word, tmp, 0x30); + utf8_to_utf16(w->read, (uint8_t *)read, (sizeof(w->read) / sizeof(uint16_t)) - 1); + utf8_to_utf16(w->word, (uint8_t *)word, (sizeof(w->word) / sizeof(uint16_t)) - 1); } uint32_t replaceChar(uint32_t c)