Fix out of bound access, and provide better tokenize api.

3 files changed, 10 insertions, 5 deletions

diff --git a/lib/filter.c b/lib/filter.c
index 811451b..204eac1 100644
--- a/lib/filter.c
+++ b/lib/filter.c
@@ -54,15 +54,15 @@ static char* _bmFilterTokenize(bmMenu *menu, char ***outTokv, unsigned int *outT
     if (!(buffer = _bmStrdup(menu->filter)))
         goto fail;
 
-    size_t pos = 0;
+    size_t pos = 0, next;
     unsigned int tokc = 0, tokn = 0;
     char *s = buffer, **tmp = NULL;
-    while ((pos = _bmStripToken(s, " ")) != 0) {
+    while ((pos = _bmStripToken(s, " ", &next)) > 0) {
         if (++tokc > tokn && !(tmp = realloc(tmp, ++tokn * sizeof(char*))))
             goto fail;
 
         tmp[tokc - 1] = s;
-        s += pos + 1;
+        s += next;
     }
 
     *outTokv = tmp;
diff --git a/lib/internal.h b/lib/internal.h
index 1ed13b4..6d116a0 100644
--- a/lib/internal.h
+++ b/lib/internal.h
@@ -163,7 +163,7 @@ int _bmItemListRemoveItem(struct _bmItemList *list, const bmItem *item);
 
 /* util.c */
 char* _bmStrdup(const char *s);
-size_t _bmStripToken(char *string, const char *token);
+size_t _bmStripToken(char *string, const char *token, size_t *outNext);
 int _bmStrupcmp(const char *hay, const char *needle);
 int _bmStrnupcmp(const char *hay, const char *needle, size_t len);
 char* _bmStrupstr(const char *hay, const char *needle);
diff --git a/lib/util.c b/lib/util.c
index c4533ca..bcb27cb 100644
--- a/lib/util.c
+++ b/lib/util.c
@@ -34,11 +34,16 @@ char* _bmStrdup(const char *string)
  * Replaces next token in string with '\0' and returns position for the replaced token.
  *
  * @param string C "string" where token will be replaced.
+ * @param outNext Reference to position of next delimiter, or 0 if none.
  * @return Position of the replaced token.
  */
-size_t _bmStripToken(char *string, const char *token)
+size_t _bmStripToken(char *string, const char *token, size_t *outNext)
 {
     size_t len = strcspn(string, token);
+
+    if (outNext)
+        *outNext = len + (string[len] != 0);
+
     string[len] = 0;
     return len;
 }