fix segfault when displaying empty blobs

When size is zero, subtracting one from it turns it into
ULONG_MAX which causes an out-of-bounds access on buf.

Signed-off-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>

1 files changed, 8 insertions, 5 deletions

diff --git a/ui-tree.c b/ui-tree.c
index c6159ec..553dbaa 100644
--- a/ui-tree.c
+++ b/ui-tree.c
@@ -22,17 +22,20 @@ static void print_text_buffer(char *buf, unsigned long size)
                 "<a class='no' id='n%1$d' name='n%1$d' href='#n%1$d'>%1$d</a>\n";
 
         html("<table summary='blob content' class='blob'>\n");
         html("<tr><td class='linenumbers'><pre>");
         idx = 0;
         lineno = 0;
-        htmlf(numberfmt, ++lineno);
-        while(idx < size - 1) { // skip absolute last newline
-                if (buf[idx] == '\n')
-                        htmlf(numberfmt, ++lineno);
-                idx++;
+
+        if (size) {
+                htmlf(numberfmt, ++lineno);
+                while(idx < size - 1) { // skip absolute last newline
+                        if (buf[idx] == '\n')
+                                htmlf(numberfmt, ++lineno);
+                        idx++;
+                }
         }
         html("</pre></td>\n");
         html("<td class='lines'><pre><code>");
         html_txt(buf);
         html("</code></pre></td></tr></table>\n");
 }