diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:50:56 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2017-01-06 13:08:22 +0000 |
| commit | 0e0c6781425dc8f65566e34b1cfa8be83d35a8eb (patch) | |
| tree | 2166a19272ea0ee2eaecdaef4d90b0f92d116b83 | |
| parent | Prevent array index out of bounds for tridvalue in feed_table_tag() (diff) | |
| download | w3m-0e0c6781425dc8f65566e34b1cfa8be83d35a8eb.tar.gz w3m-0e0c6781425dc8f65566e34b1cfa8be83d35a8eb.zip | |
Prevent negative values for offset and pos in push_link()
Bug-Debian: https://github.com/tats/w3m/issues/64
Bug-Debian: https://github.com/tats/w3m/issues/66
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=ecf57714191b77142da74035b748262cdc80dfb7
| -rw-r--r-- | file.c | 8 |
1 files changed, 6 insertions, 2 deletions
@@ -2307,8 +2307,12 @@ push_link(int cmd, int offset, int pos) struct link_stack *p; p = New(struct link_stack); p->cmd = cmd; - p->offset = offset; - p->pos = pos; + p->offset = (short)offset; + if (p->offset < 0) + p->offset = 0; + p->pos = (short)pos; + if (p->pos < 0) + p->pos = 0; p->next = link_stack; link_stack = p; } |