aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTatsuya Kinoshita <tats@debian.org>2016-12-07 12:50:56 +0000
committerTatsuya Kinoshita <tats@debian.org>2016-12-07 12:57:37 +0000
commitecf57714191b77142da74035b748262cdc80dfb7 (patch)
tree7b899940dd4e6a59b5e3fd1ba07b7afa4966b84f
parentPrevent overflow beyond the end of string in proc_mchar() (diff)
downloadw3m-ecf57714191b77142da74035b748262cdc80dfb7.tar.gz
w3m-ecf57714191b77142da74035b748262cdc80dfb7.zip
Prevent negative values for offset and pos in push_link()
Bug-Debian: https://github.com/tats/w3m/issues/64
-rw-r--r--file.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/file.c b/file.c
index 134df82..35034ce 100644
--- a/file.c
+++ b/file.c
@@ -2311,8 +2311,12 @@ push_link(int cmd, int offset, int pos)
struct link_stack *p;
p = New(struct link_stack);
p->cmd = cmd;
- p->offset = offset;
- p->pos = pos;
+ p->offset = (short)offset;
+ if (p->offset < 0)
+ p->offset = 0;
+ p->pos = (short)pos;
+ if (p->pos < 0)
+ p->pos = 0;
p->next = link_stack;
link_stack = p;
}