From: Christian Dywan <christian@twotoasts.de>
Date: Tue, 18 Nov 2008 21:00:38 +0000 (+0100)
Subject: Malloc in bytes, not characters, and don't copy freed memory
X-Git-Url: https://spindle.queued.net/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=166a7e48e060d7efd676d4f86c2ddaacaa2d0d1f;p=midori

Malloc in bytes, not characters, and don't copy freed memory

This was teamwork of Brian, Enrico and me.
---

diff --git a/midori/midori-locationaction.c b/midori/midori-locationaction.c
index 1f09d59d..51af271c 100644
--- a/midori/midori-locationaction.c
+++ b/midori/midori-locationaction.c
@@ -423,12 +423,10 @@ midori_location_entry_render_text_cb (GtkCellLayout*   layout,
     {
         temp = g_utf8_strdown (uri, -1);
         start = strstr (temp, key);
-        g_free (temp);
         if (start)
         {
-            len = g_utf8_strlen (key, -1);
-            skey = g_malloc0 (len);
-            g_utf8_strncpy (skey, uri + (start - temp), len);
+            skey = g_malloc0 (strlen (key) + 1);
+            g_utf8_strncpy (skey, uri + (start - temp), g_utf8_strlen (key, -1));
             parts = g_strsplit (uri, skey, 2);
             if (parts && parts[0] && parts[1])
                 desc_uri = g_markup_printf_escaped ("%s<b>%s</b>%s",
@@ -436,6 +434,7 @@ midori_location_entry_render_text_cb (GtkCellLayout*   layout,
             g_strfreev (parts);
             g_free (skey);
         }
+        g_free (temp);
     }
     if (uri && !desc_uri)
         desc_uri = g_markup_escape_text (uri, -1);
@@ -443,12 +442,10 @@ midori_location_entry_render_text_cb (GtkCellLayout*   layout,
     {
         temp = g_utf8_strdown (title, -1);
         start = strstr (temp, key);
-        g_free (temp);
         if (start)
         {
-            len = g_utf8_strlen (key, -1);
-            skey = g_malloc0 (len);
-            g_utf8_strncpy (skey, title + (start - temp), len);
+            skey = g_malloc0 (strlen (key) + 1);
+            g_utf8_strncpy (skey, title + (start - temp), g_utf8_strlen (key, -1));
             parts = g_strsplit (title, skey, 2);
             if (parts && parts[0] && parts[1])
                 desc_title = g_markup_printf_escaped ("%s<b>%s</b>%s",
@@ -456,6 +453,7 @@ midori_location_entry_render_text_cb (GtkCellLayout*   layout,
             g_strfreev (parts);
             g_free (skey);
         }
+        g_free (temp);
     }
     if (title && !desc_title)
         desc_title = g_markup_escape_text (title, -1);