Merge pull request #1586 from profanity-im/mentions

Fix invalid reads on mentions in MUC

1 files changed, 6 insertions, 5 deletions

diff --git a/src/ui/mucwin.c b/src/ui/mucwin.c
index 54778acb..a0717282 100644
--- a/src/ui/mucwin.c
+++ b/src/ui/mucwin.c
@@ -386,12 +386,14 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co
     int last_pos = 0;
     int pos;
     GSList* curr = mentions;
+    glong mynick_len = g_utf8_strlen(mynick, -1);
+
     while (curr) {
         pos = GPOINTER_TO_INT(curr->data);
 
-        char *before_str = g_utf8_substring(message, last_pos, last_pos + pos - last_pos);
+        char *before_str = g_utf8_substring(message, last_pos, pos);
 
-        if (strncmp(before_str, "/me ", 4) == 0) {
+        if (last_pos == 0 && strncmp(before_str, "/me ", 4) == 0) {
             win_print_them(window, THEME_ROOMMENTION, ch, flags, "");
             win_append_highlight(window, THEME_ROOMMENTION, "*%s ", from);
             win_append_highlight(window, THEME_ROOMMENTION, "%s", before_str + 4);
@@ -404,7 +406,6 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co
         }
         g_free(before_str);
 
-        glong mynick_len = g_utf8_strlen(mynick, -1);
         char* mynick_str = g_utf8_substring(message, pos, pos + mynick_len);
         win_append_highlight(window, THEME_ROOMMENTION_TERM, "%s", mynick_str);
         g_free(mynick_str);
@@ -416,9 +417,9 @@ _mucwin_print_mention(ProfWin* window, const char* const message, const char* co
 
     glong message_len = g_utf8_strlen(message, -1);
     if (last_pos < message_len) {
-        char* rest = g_utf8_substring(message, last_pos, last_pos + message_len);
+        // get tail without allocating a new string
+        char* rest = g_utf8_offset_to_pointer(message, last_pos);
         win_appendln_highlight(window, THEME_ROOMMENTION, "%s", rest);
-        g_free(rest);
     } else {
         win_appendln_highlight(window, THEME_ROOMMENTION, "");
     }