Skip to content

Commit

Permalink
LibGUI: Prevent crashes/hangs when deleting words backwards
Browse files Browse the repository at this point in the history
When the user hits <Ctrl-Backspace> where the previous content has the
format [Punctuation|Seperator]+ before the cursor, there will be a
size_t index underflow in TextDocument::first_word_break_before,
which returns an invalid word break position with a huge column index
(18446744073709551615, -1 in size_t). The invalid text position later
used for executing RemoveTextCommand will cause a crash.

The while loop condition in TextDocument::first_word_break_before is
not right, the loop will never stop when the target.column() becomes
0 inside.
  • Loading branch information
lixk28 committed Jun 7, 2023
1 parent 0eb7c24 commit 3e9f9c4
Showing 1 changed file with 2 additions and 5 deletions.
7 changes: 2 additions & 5 deletions Userland/Libraries/LibGUI/TextDocument.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -754,15 +754,12 @@ TextPosition TextDocument::first_word_break_before(TextPosition const& position,

target.set_column(target.column() - modifier);

if (target.column() == 0)
return target;

while (target.column() < line.length()) {
while (target.column() > 0) {
if (auto index = Unicode::previous_word_segmentation_boundary(line.view(), target.column()); index.has_value()) {
auto view_between_target_and_index = line.view().substring_view(*index, target.column() - *index);

if (should_continue_beyond_word(view_between_target_and_index)) {
target.set_column(*index - 1);
target.set_column(*index == 0 ? 0 : *index - 1);
continue;
}

Expand Down

0 comments on commit 3e9f9c4

Please sign in to comment.