From db65071db5a99035ffa525ba30e86d9b0e27bf4c Mon Sep 17 00:00:00 2001
From: Yiheng Cao <65160922+Crispy-fried-chicken@users.noreply.github.com>
Date: Tue, 3 Sep 2024 19:12:10 +0800
Subject: [PATCH] core: fix integer overflow in string_free_split functions
 (issue #2178)

---
 src/core/core-string.c | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/core/core-string.c b/src/core/core-string.c
index 994215f7c..d63822880 100644
--- a/src/core/core-string.c
+++ b/src/core/core-string.c
@@ -2849,12 +2849,12 @@ string_split_shell (const char *string, int *num_items)
 void
 string_free_split (char **split_string)
 {
-    int i;
+    char **ptr;
 
     if (split_string)
     {
-        for (i = 0; split_string[i]; i++)
-            free (split_string[i]);
+        for (ptr = split_string; *ptr; ptr++)
+            free (*ptr);
         free (split_string);
     }
 }
@@ -2866,12 +2866,12 @@ string_free_split (char **split_string)
 void
 string_free_split_shared (char **split_string)
 {
-    int i;
+    char **ptr;
 
     if (split_string)
     {
-        for (i = 0; split_string[i]; i++)
-            string_shared_free (split_string[i]);
+        for (ptr = split_string; *ptr; ptr++)
+            string_shared_free (*ptr);
         free (split_string);
     }
 }
@@ -3033,12 +3033,12 @@ string_split_command (const char *command, char separator)
 void
 string_free_split_command (char **split_command)
 {
-    int i;
+    char **ptr;
 
     if (split_command)
     {
-        for (i = 0; split_command[i]; i++)
-            free (split_command[i]);
+        for (ptr = split_command; *ptr; ptr++)
+            free (*ptr);
         free (split_command);
     }
 }
@@ -3102,14 +3102,12 @@ string_split_tags (const char *tags, int *num_tags)
 void
 string_free_split_tags (char ***split_tags)
 {
-    int i;
+    char ***ptr;
 
     if (split_tags)
     {
-        for (i = 0; split_tags[i]; i++)
-        {
-            string_free_split_shared (split_tags[i]);
-        }
+        for (ptr = split_tags; *ptr; ptr++)
+            string_free_split_shared (*ptr);
         free (split_tags);
     }
 }