jpeg pushed a commit to branch master. http://git.enlightenment.org/core/efl.git/commit/?id=0cb048f9b681d43fe905d948e4f7b8e51bed9aa4
commit 0cb048f9b681d43fe905d948e4f7b8e51bed9aa4 Author: Jean-Philippe Andre <jp.an...@samsung.com> Date: Tue Dec 10 11:39:15 2013 +0900 Evas textblock: Fix crash with empty markups values Markup parsing will segv if a value string is empty, as in "<style=>". Sure, this is invalid, but hey, it could definitely be used from an app or even by a user writing his own markups :) The internal doc says this function expects an item to be of the form "key=val" but there are no checks beyond the presence of "=" in the string before calling it. --- src/lib/evas/canvas/evas_object_textblock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/lib/evas/canvas/evas_object_textblock.c b/src/lib/evas/canvas/evas_object_textblock.c index 41cd764..f1c3018 100644 --- a/src/lib/evas/canvas/evas_object_textblock.c +++ b/src/lib/evas/canvas/evas_object_textblock.c @@ -2362,6 +2362,7 @@ _format_param_parse(const char *item, const char **key, Eina_Tmpstr **val) else len = strlen(start); tmp = (char*) eina_tmpstr_add_length(start, len); + if (!tmp) goto end; for (d = tmp, s = tmp; *s; s++) { @@ -2373,6 +2374,7 @@ _format_param_parse(const char *item, const char **key, Eina_Tmpstr **val) } *d = '\0'; +end: *val = tmp; } @@ -2450,7 +2452,7 @@ _format_fill(Evas_Object *eo_obj, Evas_Object_Textblock_Format *fmt, const char Eina_Tmpstr *val = NULL; _format_param_parse(item, &key, &val); - _format_command(eo_obj, fmt, key, val); + if ((key) && (val)) _format_command(eo_obj, fmt, key, val); eina_stringshare_del(key); eina_tmpstr_del(val); } --