[w3m-dev 02845]

* regex.c (newRegex0): check regex->storage[STORAGE_MAX]
From: Fumitoshi UKAI  <ukai@debian.or.jp>

2 files changed, 10 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 02a12ca..6dd393f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2002-01-16  Fumitoshi UKAI  <ukai@debian.or.jp>
+
+	* [w3m-dev 02845]
+	* regex.c (newRegex0): check regex->storage[STORAGE_MAX]
+
 2002-01-16  Hironori Sakamoto <hsaka@mth.biglobe.ne.jp>
 
 	* [w3m-dev 02843] w3mmail.cgi.in update
@@ -1983,4 +1988,4 @@
 	* release-0-2-1
 	* import w3m-0.2.1
 
-$Id: ChangeLog,v 1.224 2002/01/15 17:46:01 ukai Exp $
+$Id: ChangeLog,v 1.225 2002/01/15 18:26:13 ukai Exp $
diff --git a/regex.c b/regex.c
index 4795f24..6135f20 100644
--- a/regex.c
+++ b/regex.c
@@ -1,4 +1,4 @@
-/* $Id: regex.c,v 1.10 2002/01/11 02:24:13 a-ito Exp $ */
+/* $Id: regex.c,v 1.11 2002/01/15 18:26:13 ukai Exp $ */
 /* 
  * regex: Regular expression pattern match library
  * 
@@ -172,6 +172,9 @@ newRegex0(char **ex, int igncase, Regex *regex, char **msg, int level)
 #endif
 		else
 		    *(st_ptr++) = (unsigned char)*(p++);
+		if (st_ptr >= &regex->storage[STORAGE_MAX])
+		    *msg = "Regular expression too long";
+		return NULL;
 	    }
 	    *(st_ptr++) = '\0';
 	    re->p.pattern = r;