Skip to content

Commit e489ba4

Browse files
Check for empty buffer when rendering
For empty documents, `->size` is zero so `renderer.buffer->ptr[renderer.buffer->size - 1]` will cause an out-of-bounds read. Empty buffers always point to the global `cmark_strbuf__initbuf` buffer so we read `cmark_strbuf__initbuf[-1]`.
1 parent a5c83d7 commit e489ba4

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/render.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ char *cmark_render(cmark_node *root, int options, int width,
171171
}
172172

173173
// ensure final newline
174-
if (renderer.buffer->ptr[renderer.buffer->size - 1] != '\n') {
174+
if (renderer.buffer->size == 0 || renderer.buffer->ptr[renderer.buffer->size - 1] != '\n') {
175175
cmark_strbuf_putc(renderer.buffer, '\n');
176176
}
177177

0 commit comments

Comments
 (0)