Prevent overflow beyond the end of string in textfieldrep()

Bug-Debian: https://github.com/tats/w3m/issues/79

1 files changed, 2 insertions, 0 deletions

diff --git a/form.c b/form.c
index fdad786..9c40b44 100644
--- a/form.c
+++ b/form.c
@@ -526,6 +526,8 @@ textfieldrep(Str s, int width)
     for (i = 0; i < s->length; i += c_len) {
 	c_type = get_mctype((unsigned char *)&s->ptr[i]);
 	c_len = get_mclen(&s->ptr[i]);
+	if (i + c_len > s->length)
+	    break;
 	if (s->ptr[i] == '\r')
 	    continue;
 	k = j + get_mcwidth(&s->ptr[i]);