diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-08-18 10:26:58 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-19 05:11:41 +0000 |
| commit | 49ddfa787151349912d649beeb18029347f11042 (patch) | |
| tree | 4e1b3ecb99666bb306d065af886f93da5e52a817 | |
| parent | Prevent segfault with incorrect button type (diff) | |
| download | w3m-49ddfa787151349912d649beeb18029347f11042.tar.gz w3m-49ddfa787151349912d649beeb18029347f11042.zip | |
Prevent segfault with malformed input_alt
Bug-Debian: https://github.com/tats/w3m/issues/18 [CVE-2016-9438]
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=010b68580dc50ce183df11cc79721936ab5c4f25
| -rw-r--r-- | file.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -3021,9 +3021,9 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, tmp = Sprintf("<INPUT_ALT hseq=\"%d\" fid=\"%d\" name=\"%s\" type=\"%s\" value=\"%s\">", obuf->input_alt.hseq, obuf->input_alt.fid, - obuf->input_alt.name->ptr, - obuf->input_alt.type->ptr, - obuf->input_alt.value->ptr); + obuf->input_alt.name ? obuf->input_alt.name->ptr : "", + obuf->input_alt.type ? obuf->input_alt.type->ptr : "", + obuf->input_alt.value ? obuf->input_alt.value->ptr : ""); push_tag(obuf, tmp->ptr, HTML_INPUT_ALT); } if (!hidden_bold && obuf->in_bold) |