From 0e83fe23216870c9a856360d7d928324cbaef07a Mon Sep 17 00:00:00 2001 From: Matt Schwager Date: Thu, 18 Jun 2026 08:11:26 -0400 Subject: [PATCH] Fixes #813, correct bounds checking in SmartyPants.render --- ext/redcarpet/html_smartypants.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ext/redcarpet/html_smartypants.c b/ext/redcarpet/html_smartypants.c index 3806fd1d..eaf60533 100644 --- a/ext/redcarpet/html_smartypants.c +++ b/ext/redcarpet/html_smartypants.c @@ -162,7 +162,7 @@ smartypants_squote(struct buf *ob, struct smartypants_data *smrt, uint8_t previo // Tom's, isn't, I'm, I'd if ((t1 == 's' || t1 == 't' || t1 == 'm' || t1 == 'd') && - (size == 3 || word_boundary(text[2]))) { + (size <= 3 || word_boundary(text[2]))) { BUFPUTSL(ob, "’"); return 0; } @@ -174,7 +174,7 @@ smartypants_squote(struct buf *ob, struct smartypants_data *smrt, uint8_t previo if (((t1 == 'r' && t2 == 'e') || (t1 == 'l' && t2 == 'l') || (t1 == 'v' && t2 == 'e')) && - (size == 4 || word_boundary(text[3]))) { + (size <= 4 || word_boundary(text[3]))) { BUFPUTSL(ob, "’"); return 0; } @@ -327,7 +327,7 @@ smartypants_cb__number(struct buf *ob, struct smartypants_data *smrt, uint8_t pr static size_t smartypants_cb__dquote(struct buf *ob, struct smartypants_data *smrt, uint8_t previous_char, const uint8_t *text, size_t size) { - if (!smartypants_quotes(ob, previous_char, size > 0 ? text[1] : 0, 'd', &smrt->in_dquote)) + if (!smartypants_quotes(ob, previous_char, size > 1 ? text[1] : 0, 'd', &smrt->in_dquote)) BUFPUTSL(ob, """); return 0; @@ -382,7 +382,7 @@ smartypants_cb__ltag(struct buf *ob, struct smartypants_data *smrt, uint8_t prev // Pretty tricky: since people may refer to something or someone // with a link but use the possessive form right after it, we need // to check whether a single quote is next to a closing " tag. - if (next_to_closing_a && strncmp("'", text+(i+1), 5) == 0) { + if (next_to_closing_a && i + 1 + 5 <= size && strncmp("'", text+(i+1), 5) == 0) { bufput(ob, "’", 7); i += 5; }