diff options
author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:50:56 +0000 |
---|---|---|
committer | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:57:37 +0000 |
commit | ecf57714191b77142da74035b748262cdc80dfb7 (patch) | |
tree | 7b899940dd4e6a59b5e3fd1ba07b7afa4966b84f | |
parent | Prevent overflow beyond the end of string in proc_mchar() (diff) | |
download | w3m-ecf57714191b77142da74035b748262cdc80dfb7.tar.gz w3m-ecf57714191b77142da74035b748262cdc80dfb7.zip |
Prevent negative values for offset and pos in push_link()
Bug-Debian: https://github.com/tats/w3m/issues/64
-rw-r--r-- | file.c | 8 |
1 files changed, 6 insertions, 2 deletions
@@ -2311,8 +2311,12 @@ push_link(int cmd, int offset, int pos) struct link_stack *p; p = New(struct link_stack); p->cmd = cmd; - p->offset = offset; - p->pos = pos; + p->offset = (short)offset; + if (p->offset < 0) + p->offset = 0; + p->pos = (short)pos; + if (p->pos < 0) + p->pos = 0; p->next = link_stack; link_stack = p; } |