literal->data is probably NULL terminated, but just in case let's check literal->len first.

Author: phillmv

src/inlines.c

@@ -1144,7 +1144,7 @@ static cmark_node *handle_close_bracket(cmark_parser *parser, subject *subj) {
     // look back to the opening '[', and skip ahead to the next character
     // if we're looking at a '[^' sequence, and there is other text or nodes
     // after the ^, let's call it a footnote reference.
-    if (literal->data[0] == '^' && (literal->len > 1 || opener->inl_text->next->next)) {
+    if ((literal->len > 0 && literal->data[0] == '^') && (literal->len > 1 || opener->inl_text->next->next)) {
 
       // Before we got this far, the `handle_close_bracket` function may have
       // advanced the current state beyond our footnote's actual closing