Fix out of bounds memory access (off by one)

If fgets reads a line that only contains a `\n`, then the pointer `eol`
will point to the first byte in that buffer. The subsequent dereference
of `*(eol -1 )` will access the byte before that buffer.

This fix makes sure that that length of the current line read by fgets
is at least 2 bytes long.

Signed-off-by: Max Kunzelmann <max@mxzero.net>
Signed-off-by: Lukas Fleischer <lfleischer@calcurse.org>

1 files changed, 1 insertions, 1 deletions

diff --git a/src/ical.c b/src/ical.c
index 6d2d8d2..a8ce0a4 100644
--- a/src/ical.c
+++ b/src/ical.c
@@ -691,7 +691,7 @@ static int ical_readline(FILE * fdi, char *buf, char *lstore, unsigned *ln)
 	while (fgets(lstore, BUFSIZ, fdi) != NULL) {
 		(*ln)++;
 		if ((eol = strchr(lstore, '\n')) != NULL) {
-			if (*(eol - 1) == '\r')
+			if (strlen(lstore) > 1 && *(eol - 1) == '\r')
 				*(eol - 1) = '\0';
 			else
 				*eol = '\0';