From a1e030a9679ae515c090193b74aaa4ce9daa09d7 Mon Sep 17 00:00:00 2001
From: albert-github <albert.tests@gmail.com>
Date: Wed, 10 Apr 2019 15:40:38 +0200
Subject: issue #6917 Crash in php with UTF-8 character

Problem is that a value is fed to isspace that is not in the correct range and has to be converted to this range.

compare also Assertion failure generation documentation (fdefe70a955c8140f080974319bbf97364d3e610 of March 30 2016).
---
 src/util.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/util.cpp b/src/util.cpp
index f92df68..f63e742 100644
--- a/src/util.cpp
+++ b/src/util.cpp
@@ -1869,7 +1869,7 @@ QCString removeRedundantWhiteSpace(const QCString &s)
       case '@':  // '@name' -> ' @name'
       case '$':  // '$name' -> ' $name'
       case '\'': // ''name' -> '' name'
-        if (i>0 && i<l-1 && pc!='=' && pc!=':' && !isspace(pc) &&
+        if (i>0 && i<l-1 && pc!='=' && pc!=':' && !isspace((uchar)pc) &&
             isId(nc) && osp<8) // ")id" -> ") id"
         {
           *dst++=' ';
@@ -1913,14 +1913,14 @@ QCString removeRedundantWhiteSpace(const QCString &s)
       default:
         *dst++=c;
         if (c=='t' && csp==5 && i<l-1 && // found 't' in 'const'
-             !(isId(nc) || nc==')' || nc==',' || isspace(nc))
+             !(isId(nc) || nc==')' || nc==',' || isspace((uchar)nc))
            ) // prevent const ::A from being converted to const::A
         {
           *dst++=' ';
           csp=0;
         }
         else if (c=='l' && vsp==7 && i<l-1 && // found 'l' in 'virtual'
-             !(isId(nc) || nc==')' || nc==',' || isspace(nc))
+             !(isId(nc) || nc==')' || nc==',' || isspace((uchar)nc))
             ) // prevent virtual ::A from being converted to virtual::A
         {
           *dst++=' ';
@@ -7200,7 +7200,7 @@ bool findAndRemoveWord(QCString &s,const QCString &word)
     {
       if (i>0 && isspace((uchar)s.at(i-1))) 
         i--,l++;
-      else if (i+l<(int)s.length() && isspace(s.at(i+l))) 
+      else if (i+l<(int)s.length() && isspace((uchar)s.at(i+l)))
         l++;
       s = s.left(i)+s.mid(i+l); // remove word + spacing
       return TRUE;
-- 
cgit v0.12


From 5428d2fe73e5e80bcf580d0c0506c0e3cff23cc6 Mon Sep 17 00:00:00 2001
From: albert-github <albert.tests@gmail.com>
Date: Fri, 19 Apr 2019 16:10:19 +0200
Subject: issue #6917 Crash in php with UTF-8 character

Also in HTML tag handling.
---
 src/doctokenizer.l | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/doctokenizer.l b/src/doctokenizer.l
index 5cf5f02..7b402ca 100644
--- a/src/doctokenizer.l
+++ b/src/doctokenizer.l
@@ -211,7 +211,7 @@ static void handleHtmlTag()
   {
     char c=tagText.at(i);
     // skip spaces
-    while (i<(int)yyleng && isspace(c)) { c=tagText.at(++i); }
+    while (i<(int)yyleng && isspace((uchar)c)) { c=tagText.at(++i); }
     // check for end of the tag
     if (c == '>') break;
     // Check for XML style "empty" tag.
@@ -222,17 +222,17 @@ static void handleHtmlTag()
     }
     startName=i;
     // search for end of name
-    while (i<(int)yyleng && !isspace(c) && c!='=') { c=tagText.at(++i); }
+    while (i<(int)yyleng && !isspace((uchar)c) && c!='=') { c=tagText.at(++i); }
     endName=i;
     HtmlAttrib opt;
     opt.name  = tagText.mid(startName,endName-startName).lower(); 
     // skip spaces
-    while (i<(int)yyleng && isspace(c)) { c=tagText.at(++i); } 
+    while (i<(int)yyleng && isspace((uchar)c)) { c=tagText.at(++i); } 
     if (tagText.at(i)=='=') // option has value
     {
       c=tagText.at(++i);
       // skip spaces
-      while (i<(int)yyleng && isspace(c)) { c=tagText.at(++i); } 
+      while (i<(int)yyleng && isspace((uchar)c)) { c=tagText.at(++i); } 
       if (tagText.at(i)=='\'') // option '...'
       {
         c=tagText.at(++i);
@@ -256,7 +256,7 @@ static void handleHtmlTag()
       {
 	startAttrib=i;
 	// search for separator or end symbol
-        while (i<(int)yyleng && !isspace(c) && c!='>') { c=tagText.at(++i); } 
+        while (i<(int)yyleng && !isspace((uchar)c) && c!='>') { c=tagText.at(++i); } 
 	endAttrib=i;
 	if (i<(int)yyleng) c=tagText.at(++i);
       }
-- 
cgit v0.12