3 ms·
This. The UTF-8 decoding is broken, and I didn't look at anything beyond that, resulting in a heap buffer overflow with untrusted input. And here is a summary
by msim 9y ago
This. The UTF-8 decoding is broken, and I didn't look at anything beyond that, resulting in a heap buffer overflow with untrusted input.
And here is a summary of the warnings I get when compiling with "-Weverything":
26 [-Wcast-align]
20 [-Wcast-qual]
6 [-Wconditional-uninitialized]
24 [-Wdollar-in-identifier-extension]
172 [-Wold-style-cast]
2 [-Wshorten-64-to-32]
3 [-Wsign-compare]
25 [-Wsign-conversion]
3 [-Wunused-parameter]
72 [-Wzero-as-null-pointer-constant]
Please don't use this code.
- bananapeel 9y agoActually, the UTF-8 decoding is broken even with proper input. This https://github.com/btwael/SuperString/blob/master/src/SuperString.cc#L2015 https://github.com/btwael/SuperString/blob/master/src/SuperS... will make `pointer` and `i` be out of sync, so everything after the first multibyte sequence is a coin toss. To the OP: you should use theses tests to validate your implementation https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-test.txt https://www.cl.cam.ac.uk/~mgk25/ucs/examples/UTF-8-test.txt (caveat: 5- and 6-byte sequences are no longer valid UTF-8 and should be rejected).