[gtkhtml] Bug #625171 - Crash while pasting text with links

[Milan Crha <mcrha src gnome org>]

commit db629e7fe3c2bed9dbd5461283909af008bf90ee
Author: Milan Crha <mcrha redhat com>
Date:   Fri Jul 30 11:02:11 2010 +0200

    Bug #625171 - Crash while pasting text with links

 gtkhtml/htmlengine-edit-cut-and-paste.c |   13 ++++++++-----
 gtkhtml/htmltext.c                      |    2 +-
 2 files changed, 9 insertions(+), 6 deletions(-)
---
diff --git a/gtkhtml/htmlengine-edit-cut-and-paste.c b/gtkhtml/htmlengine-edit-cut-and-paste.c
index aee80df..457f0f2 100644
--- a/gtkhtml/htmlengine-edit-cut-and-paste.c
+++ b/gtkhtml/htmlengine-edit-cut-and-paste.c
@@ -1396,16 +1396,19 @@ use_pictograms (HTMLEngine *e)
 void
 html_engine_insert_text_with_extra_attributes (HTMLEngine *e, const gchar *ptext, gint len, PangoAttrList *attrs)
 {
-	gchar *nl, *text = NULL;
+	gchar *nl, *sanitized_text = NULL;
+	const gchar *text;
 	gint alen;
 	gsize bytes;
 
-	bytes = html_text_sanitize (ptext, &text, &len);
-	if (!len || !text) {
-		g_free (text);
+	bytes = html_text_sanitize (ptext, &sanitized_text, &len);
+	if (!len || !sanitized_text) {
+		g_free (sanitized_text);
 		return;
 	}
 
+	text = sanitized_text;
+
 	html_undo_level_begin (e->undo, "Insert text", "Delete text");
 	/* FIXME add insert text event */
 	gtk_html_editor_event_command (e->widget, GTK_HTML_COMMAND_INSERT_PARAGRAPH, TRUE);
@@ -1449,7 +1452,7 @@ html_engine_insert_text_with_extra_attributes (HTMLEngine *e, const gchar *ptext
 	} while (nl);
 	html_undo_level_end (e->undo, e);
 
-	g_free (text);
+	g_free (sanitized_text);
 }
 
 void
diff --git a/gtkhtml/htmltext.c b/gtkhtml/htmltext.c
index 00ace28..ed68804 100644
--- a/gtkhtml/htmltext.c
+++ b/gtkhtml/htmltext.c
@@ -3228,7 +3228,7 @@ html_text_magic_link (HTMLText *text, HTMLEngine *engine, guint offset)
 	cur = str = html_text_get_text (text, offset);
 
 	/* check forward to ensure chars are < 0x80, could be removed once we have utf8 regex */
-	while (TRUE) {
+	while (cur && *cur) {
 		cur = g_utf8_next_char (cur);
 		if (!*cur)
 			break;