diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-11-14 12:16:45 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-14 12:22:13 +0000 |
| commit | 9db438094e5f0d84842bcbd248f282594ccb3c89 (patch) | |
| tree | ac3eab17a3dee3dca467968e864bf58f917a08df | |
| parent | Prevent array index out of bounds for symbol (diff) | |
| download | w3m-9db438094e5f0d84842bcbd248f282594ccb3c89.tar.gz w3m-9db438094e5f0d84842bcbd248f282594ccb3c89.zip | |
Prevent null pointer deref due to bad form id
Bug-Debian: https://github.com/tats/w3m/issues/39
| -rw-r--r-- | file.c | 5 |
1 files changed, 4 insertions, 1 deletions
@@ -5833,7 +5833,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) parsedtag_get_value(tag, ATTR_FID, &form_id); parsedtag_get_value(tag, ATTR_TOP_MARGIN, &top); parsedtag_get_value(tag, ATTR_BOTTOM_MARGIN, &bottom); - if (form_id < 0 || form_id > form_max || forms == NULL) + if (form_id < 0 || form_id > form_max || + forms == NULL || forms[form_id] == NULL) break; /* outside of <form>..</form> */ form = forms[form_id]; if (hseq > 0) { @@ -7041,6 +7042,8 @@ print_internal_information(struct html_feed_environ *henv) if (form_max >= 0) { FormList *fp; for (i = 0; i <= form_max; i++) { + if (forms[i] == NULL) + continue; fp = forms[i]; s = Sprintf("<form_int fid=\"%d\" action=\"%s\" method=\"%s\"", i, html_quote(fp->action->ptr), |