From 42c8e85109d9c8edaf1e46eb26d5484ebdf16881 Mon Sep 17 00:00:00 2001 From: Corinna Vinschen Date: Mon, 17 Jun 2013 10:11:54 +0000 Subject: * fhandler_clipboard.cc (fhandler_dev_clipboard::read): Fix buffer read access overrun when pos > 0. --- winsup/cygwin/fhandler_clipboard.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'winsup/cygwin/fhandler_clipboard.cc') diff --git a/winsup/cygwin/fhandler_clipboard.cc b/winsup/cygwin/fhandler_clipboard.cc index 1118137c1..db72b9787 100644 --- a/winsup/cygwin/fhandler_clipboard.cc +++ b/winsup/cygwin/fhandler_clipboard.cc @@ -295,7 +295,8 @@ fhandler_dev_clipboard::read (void *ptr, size_t& len) != (size_t) -1 && (ret > conv_len /* Skip separated high surrogate: */ - || ((buf [pos + glen - 1] & 0xFC00) == 0xD800 && glen - pos > 1))) + || ((buf [glen - 1] & 0xFC00) == 0xD800 + && glen - pos > 1))) --glen; if (ret == (size_t) -1) ret = 0; -- cgit v1.2.3