Fix #24914: 3D text glitch and crash

Crash was caused by invalid utf8 sequence pasteing from the clipboard.
Prevent memory corruption by giving utf8slen() the same rules of bytes checking
as utf8towchar() does.

1 files changed, 18 insertions, 22 deletions

diff --git a/source/blender/blenkernel/intern/font.c b/source/blender/blenkernel/intern/font.c
index 1b5760fc5f1..500ccf0781b 100644
--- a/source/blender/blenkernel/intern/font.c
+++ b/source/blender/blenkernel/intern/font.c
@@ -124,31 +124,27 @@ wcsleninu8(wchar_t *src)
 }
 
 static int
-utf8slen(char *src)
+utf8slen(const char *strc)
 {
-	int size = 0, index = 0;
-	unsigned char c;
-	
-	c = src[index++];
-	while(c)
-	{    
-		if((c & 0x80) == 0)
-		{
-			index += 0;
-		}
-		else if((c & 0xe0) == 0xe0)
-		{
-			index += 2;
-		}
-		else
-		{
-			index += 1;
+	int len=0;
+
+	while(*strc) {
+		if ((*strc & 0xe0) == 0xc0) {
+			if((strc[1] & 0x80) && (strc[1] & 0x40) == 0x00)
+				strc++;
+		} else if ((*strc & 0xf0) == 0xe0) {
+			if((strc[1] & strc[2] & 0x80) && ((strc[1] | strc[2]) & 0x40) == 0x00)
+				strc += 2;
+		} else if ((*strc & 0xf8) == 0xf0) {
+			if((strc[1] & strc[2] & strc[3] & 0x80) && ((strc[1] | strc[2] | strc[3]) & 0x40) == 0x00)
+				strc += 3;
 		}
-		size += 1;
-		c = src[index++];		
+
+		strc++;
+		len++;
 	}
-	
-	return size;
+
+	return len;
 }