Fix out-of-bounds read

[o9000]

When the direction is right-to-left, i == -1 so memory is read one byte before the string before the pointer is checked against the bound.

[joeftiger]

You only changed the order of the && expression, this has no benefit at all except maybe for one boolean check.

[o9000]

Yes it does. When i is -1, in the last step of the loop, lc is config_title_layout - 1, so *lc != '\0' may crash.

…

On Wed, Jan 13, 2021 at 1:07 AM joeftiger ***@***.***> wrote: You only cha ged the order kf the && expression, this has no benefit at all except maybe for one boolean check. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#26 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADCGYUMMZAY7SHKDUOY3SMTSZTP2PANCNFSM4DGQHYTQ> .