Language: C
Label: safe
CWE: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Code:
static bool meta_set(RAnal *a, RAnalMetaType type, int subtype, ut64 from, ut64 to, const char *str) {
	if (to < from) {
		return false;
	}
	RSpace *space = r_spaces_current (&a->meta_spaces);
	RIntervalNode *node = find_node_at (a, type, space, from);
	RAnalMetaItem *item = node ? node->data : R_NEW0 (RAnalMetaItem);
	if (!item) {
		return false;
	}
	item->type = type;
	item->subtype = subtype;
	item->space = space;
	free (item->str);
	if (R_STR_ISNOTEMPTY (str)) {
		item->str = strdup (str);
		// this breaks the `ecHw` command
		// (highlights word in current instruction, which uses ansi
		// r_str_ansi_strip (item->str);
	} else {
		item->str = NULL;
	}
	R_DIRTY (a);
	if (!node) {
		r_interval_tree_insert (&a->meta, from, to, item);
	} else if (node->end != to) {
		r_interval_tree_resize (&a->meta, node, from, to);
	}
	return true;
}