Skip to content

st/widget: Fix memory corruption when removing "" style class

strstr() in find_class_name() will always consider "" a match so the loop was not stopping at the end of the class_list. None of the matches within the class_list would satisfy the return conditions, unless the class_list was either an empty string as well or has a trailing space. So this ends up with a match outside of the allocated string that happens to satisfy these conditions by chance.

Fix this by always considering "" a non-match. Also because this would now mean that add_class_name() would keep adding spaces when trying to add "" due to this being never found, exit early in that case. And for consistency add a similar check to remove_class_name() as well.

Closes: #7152 (closed)

Merge request reports