Replaced strstr by safer strnstr. Improved string_split and added sanity check before accessing constant poo.

src/runtime/gravity_core.c

@@ -1543,7 +1543,7 @@ static bool operator_string_sub (gravity_vm *vm, gravity_value_t *args, uint16_t
 	gravity_string_t *s2 = VALUE_AS_STRING(v2);
 	
 	// subtract s2 from s1
-	char *found = strstr(s1->s, s2->s);
+	char *found = strnstr(s1->s, s2->s, (size_t)s1->len);
 	if (!found) RETURN_VALUE(VALUE_FROM_STRING(vm, s1->s, s1->len), rindex);
 	
 	// substring found
@@ -1632,7 +1632,7 @@ static bool string_index (gravity_vm *vm, gravity_value_t *args, uint16_t nargs,
 	gravity_string_t *str_to_index = VALUE_AS_STRING(GET_VALUE(1));
 
 	// search for the string
-	char *ptr = strstr(main_str->s, str_to_index->s);
+	char *ptr = strnstr(main_str->s, str_to_index->s, (size_t)main_str->len);
 
 	// if it doesn't exist, return null
 	if (ptr == NULL) {
@@ -1868,16 +1868,19 @@ static bool string_split (gravity_vm *vm, gravity_value_t *args, uint16_t nargs,
 	
 	// split loop
 	char *original = string->s;
+    uint32_t slen = string->len;
 	while (1) {
-		char *p = strstr(original, sep);
+		char *p = strnstr(original, sep, (size_t)slen);
 		if (p == NULL) {
-			marray_push(gravity_value_t, list->array, VALUE_FROM_STRING(vm, original, (uint32_t)strlen(original)));
+            if (marray_size(list->array) == 0) slen = 0;
+			marray_push(gravity_value_t, list->array, VALUE_FROM_STRING(vm, original, string->len - slen));
 			break;
 		}
 		marray_push(gravity_value_t, list->array, VALUE_FROM_STRING(vm, original, (uint32_t)(p-original)));
 		
-		// update original pointer
+        // update pointer and slen
 		original = p + seplen;
+        slen = (uint32_t)(original - string->s);        
 	}
 	RETURN_VALUE(VALUE_FROM_OBJECT(list), rindex);
 }

src/runtime/gravity_vm.c

@@ -416,7 +416,7 @@ static bool gravity_vm_exec (gravity_vm *vm) {
 				DEBUG_VM("LOADK %d %d", r1, index);
 				
 				// constant pool case
-				if (index < CPOOL_INDEX_MAX) {
+				if (index < marray_size(func->cpool)) {
 					gravity_value_t v = gravity_function_cpool_get(func, index);
 					SETVALUE(r1, v);
 					DISPATCH();