CVE-2022-34035: Out-of-bounds Write (CWE-787)
value: HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-07-18T21:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Other
Files changed: CHANGES.md, htmldoc/html.cxx, htmldoc/htmllib.cxx, htmldoc/htmlsep.cxx
Commit date: 2021-05-07 06:42:42 -0400
Commit message: Fix a crash bug with bogus text (Issue #426)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index d0d5b32b3..c260fa15e 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -6,10 +6,11 @@
 - Fixed JPEG error handling (Issue #415)
 - Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed a crash bug with empty titles (Issue #425)
+- Fixed a crash bug with bogus text (Issue #426)
 - Fixed some issues reported by Coverity.
 - Removed the bundled libjpeg, libpng, and zlib.
 
 
 # Changes in HTMLDOC v1.9.11
diff --git a/htmldoc/html.cxx b/htmldoc/html.cxx
index b417c4b26..fda46ad82 100644
--- a/htmldoc/html.cxx
+++ b/htmldoc/html.cxx
@@ -1,9 +1,9 @@
 /*
  * HTML exporting functions for HTMLDOC, a HTML document processing program.
  *
- * Copyright 2011-2019 by Michael R Sweet.
+ * Copyright 2011-2021 by Michael R Sweet.
  * Copyright 1997-2010 by Easy Software Products.  All rights reserved.
  *
  * This program is free software.  Distribution and use rights are outlined in
  * the file "COPYING".
  */
@@ -583,11 +583,11 @@ write_node(FILE   *out,		/* I - Output file */
 	if (t->preformatted)
 	{
           for (ptr = t->data; *ptr; ptr ++)
             fputs((char *)iso8859(*ptr), out);
 
-	  if (t->data[strlen((char *)t->data) - 1] == '\n')
+	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
             col = 0;
 	  else
             col += strlen((char *)t->data);
 	}
 	else
diff --git a/htmldoc/htmllib.cxx b/htmldoc/htmllib.cxx
index 2be77b413..df753d02f 100644
--- a/htmldoc/htmllib.cxx
+++ b/htmldoc/htmllib.cxx
@@ -1600,11 +1600,11 @@ write_file(tree_t *t,		/* I - Tree entry */
       if (t->preformatted)
       {
         for (ptr = t->data; *ptr != '\0'; ptr ++)
           fputs((char *)iso8859(*ptr), fp);
 
-	if (t->data[strlen((char *)t->data) - 1] == '\n')
+	if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
           col = 0;
 	else
           col += strlen((char *)t->data);
       }
       else
diff --git a/htmldoc/htmlsep.cxx b/htmldoc/htmlsep.cxx
index 6c200246e..ce79aaa68 100644
--- a/htmldoc/htmlsep.cxx
+++ b/htmldoc/htmlsep.cxx
@@ -589,11 +589,11 @@ write_node(FILE   *out,		/* I - Output file */
 	if (t->preformatted)
 	{
           for (ptr = t->data; *ptr; ptr ++)
             fputs((char *)iso8859(*ptr), out);
 
-	  if (t->data[strlen((char *)t->data) - 1] == '\n')
+	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
             col = 0;
 	  else
             col += strlen((char *)t->data);
 	}
 	else

Vulnerable code:  * Copyright 2011-2019 by Michael R Sweet.
	  if (t->data[strlen((char *)t->data) - 1] == '\n')
	if (t->data[strlen((char *)t->data) - 1] == '\n')
	  if (t->data[strlen((char *)t->data) - 1] == '\n')
Fixed code: - Fixed a crash bug with bogus text (Issue #426)
 * Copyright 2011-2021 by Michael R Sweet.
	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
	if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')