From 67a30aba353edf66b8307395097eef5058050c16 Mon Sep 17 00:00:00 2001
From: Cyrille Bagard <nocbos@gmail.com>
Date: Tue, 3 May 2016 08:55:04 +0200
Subject: Fixed two bugs in the code buffer system.

---
 ChangeLog                    |  7 +++++++
 src/glibext/gbufferline.c    | 14 ++++++++++----
 src/glibext/gbuffersegment.c | 10 +++++++++-
 3 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 91fd10f..4334226 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+16-05-03  Cyrille Bagard <nocbos@gmail.com>
+
+	* src/glibext/gbufferline.c:
+	* src/glibext/gbuffersegment.c:
+	Fix two bugs in the code buffer system. The first one is about OOB access,
+	the second one is about feeding the parsed markup with invalid names.
+
 16-05-02  Cyrille Bagard <nocbos@gmail.com>
 
 	* src/gtkext/gtkgraphview.c:
diff --git a/src/glibext/gbufferline.c b/src/glibext/gbufferline.c
index 7e518cc..0593748 100644
--- a/src/glibext/gbufferline.c
+++ b/src/glibext/gbufferline.c
@@ -1549,6 +1549,7 @@ GBufferSegment *g_buffer_line_get_segment_at(const GBufferLine *line, const line
 
             result = get_segment_at(&line->columns[i], offset, dir, &consumed);
             *base += consumed;
+
         }
 
         /* La position fournie tombe dans une colonne vide ! */
@@ -1593,13 +1594,18 @@ GBufferSegment *g_buffer_line_get_segment_at(const GBufferLine *line, const line
 
     else /* if (i == BLC_COUNT) */
     {
-        if (force && last != BLC_COUNT)
+        if (force)
         {
  use_right_border:
 
-            result = get_last_segment(&line->columns[last]);
-            *base = last_base;
-            *offset = get_column_width(&line->columns[last]);
+            if (last != BLC_COUNT)
+            {
+                result = get_last_segment(&line->columns[last]);
+                *base = last_base;
+                *offset = get_column_width(&line->columns[last]);
+            }
+            else
+                result = NULL;
 
         }
         else
diff --git a/src/glibext/gbuffersegment.c b/src/glibext/gbuffersegment.c
index af77c38..3cbff1e 100644
--- a/src/glibext/gbuffersegment.c
+++ b/src/glibext/gbuffersegment.c
@@ -24,6 +24,7 @@
 #include "gbuffersegment.h"
 
 
+#include <malloc.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>
@@ -561,6 +562,7 @@ char *g_buffer_segment_get_text(const GBufferSegment *segment, bool markup)
 {
     char *result;                           /* Description à renvoyer      */
     char color[7];                          /* Couleur hexadécimale        */
+    char *valid;
 
     /* Résolution du cas simple */
     if (!markup)
@@ -625,7 +627,13 @@ char *g_buffer_segment_get_text(const GBufferSegment *segment, bool markup)
 
     result = stradd(result, ">");
 
-    result = stradd(result, segment->text);
+    valid = strdup(segment->text);
+    valid = strrpl(valid, "<", "&lt;");
+    valid = strrpl(valid, "&", "&amp;");
+
+    result = stradd(result, valid);
+
+    free(valid);
 
     result = stradd(result, "</span>");
 
-- 
cgit v0.11.2-87-g4458