From 42133a196a0bea83705b5947921d5c7e5b9f201d Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Wed, 24 Feb 2021 22:10:32 +0100 Subject: [PATCH] AK: Don't compare past '\0' in StringView::operator==(const char*) We kept scanning the needle string even after hitting a null terminator and that's clearly not right. Found by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31338 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31351 --- AK/StringView.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/AK/StringView.h b/AK/StringView.h index 1237e147b6..0a5edf6904 100644 --- a/AK/StringView.h +++ b/AK/StringView.h @@ -147,6 +147,8 @@ public: // NOTE: `m_characters` is not guaranteed to be null-terminated, but `cstring` is. const char* cp = cstring; for (size_t i = 0; i < m_length; ++i) { + if (!*cp) + return false; if (m_characters[i] != *(cp++)) return false; }