Skip to content

Commit 6539a7c

Browse files
authored
fix(ios): guard onText against out-of-buffer pointers from md4c (#218)
* fix(ios): guard onText against out-of-buffer pointers from md4c soft/hard break callbacks * fix(ios): update onText to handle out-of-buffer tokens and clarify newline handling
1 parent 47919a5 commit 6539a7c

1 file changed

Lines changed: 14 additions & 0 deletions

File tree

ios/input/ENRMInputParser.mm

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,20 @@ static int onText(MD_TEXTTYPE, const MD_CHAR *text, MD_SIZE size, void *userdata
184184
return 0;
185185
}
186186
auto *context = static_cast<ParseContext *>(userdata);
187+
188+
// md4c passes pointers outside the input buffer for synthetic tokens
189+
// (e.g. MD_TEXT_SOFTBR, MD_TEXT_BR use a string literal "\n").
190+
// Pointer arithmetic against context->buffer would underflow, corrupting offsets.
191+
//
192+
// TODO: Skipping out-of-buffer tokens means lastTextEnd doesn't advance past
193+
// newlines. Fine for inline spans, but if block-level input formatting is
194+
// added later, openingDelimiterByteOffset will include newline chars in the
195+
// syntax range. See the related TODO above onEnterBlock.
196+
bool insideBuffer = (text >= context->buffer && text < context->buffer + context->bufferLength);
197+
if (!insideBuffer) {
198+
return 0;
199+
}
200+
187201
size_t textStart = text - context->buffer;
188202
size_t textEnd = textStart + size;
189203

0 commit comments

Comments
 (0)