fix segfault when displaying empty blobs

When size is zero, subtracting one from it turns it into
ULONG_MAX which causes an out-of-bounds access on buf.

Signed-off-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/ui-tree.c b/ui-tree.c
index c6159ec..553dbaa 100644
--- a/ui-tree.c
+++ b/ui-tree.c
@@ -4,54 +4,57 @@
  *
  * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
  */
 
 #include <ctype.h>
 #include "cgit.h"
 #include "html.h"
 #include "ui-shared.h"
 
 char *curr_rev;
 char *match_path;
 int header = 0;
 
 static void print_text_buffer(char *buf, unsigned long size)
 {
 	unsigned long lineno, idx;
 	const char *numberfmt =
 		"<a class='no' id='n%1$d' name='n%1$d' href='#n%1$d'>%1$d</a>\n";
 
 	html("<table summary='blob content' class='blob'>\n");
 	html("<tr><td class='linenumbers'><pre>");
 	idx = 0;
 	lineno = 0;
+
+	if (size) {
 	htmlf(numberfmt, ++lineno);
 	while(idx < size - 1) { // skip absolute last newline
 		if (buf[idx] == '\n')
 			htmlf(numberfmt, ++lineno);
 		idx++;
 	}
+	}
 	html("</pre></td>\n");
 	html("<td class='lines'><pre><code>");
 	html_txt(buf);
 	html("</code></pre></td></tr></table>\n");
 }
 
 #define ROWLEN 32
 
 static void print_binary_buffer(char *buf, unsigned long size)
 {
 	unsigned long ofs, idx;
 	static char ascii[ROWLEN + 1];
 
 	html("<table summary='blob content' class='bin-blob'>\n");
 	html("<tr><th>ofs</th><th>hex dump</th><th>ascii</th></tr>");
 	for (ofs = 0; ofs < size; ofs += ROWLEN, buf += ROWLEN) {
 		htmlf("<tr><td class='right'>%04x</td><td class='hex'>", ofs);
 		for (idx = 0; idx < ROWLEN && ofs + idx < size; idx++)
 			htmlf("%*s%02x",
 			      idx == 16 ? 4 : 1, "",
 			      buf[idx] & 0xff);
 		html(" </td><td class='hex'>");
 		for (idx = 0; idx < ROWLEN && ofs + idx < size; idx++)
 			ascii[idx] = isgraph(buf[idx]) ? buf[idx] : '.';