diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:50:56 +0000 | 
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:57:37 +0000 | 
| commit | ecf57714191b77142da74035b748262cdc80dfb7 (patch) | |
| tree | 7b899940dd4e6a59b5e3fd1ba07b7afa4966b84f | |
| parent | Prevent overflow beyond the end of string in proc_mchar() (diff) | |
| download | w3m-ecf57714191b77142da74035b748262cdc80dfb7.tar.gz w3m-ecf57714191b77142da74035b748262cdc80dfb7.zip | |
Prevent negative values for offset and pos in push_link()
Bug-Debian: https://github.com/tats/w3m/issues/64
| -rw-r--r-- | file.c | 8 | 
1 files changed, 6 insertions, 2 deletions
| @@ -2311,8 +2311,12 @@ push_link(int cmd, int offset, int pos)      struct link_stack *p;      p = New(struct link_stack);      p->cmd = cmd; -    p->offset = offset; -    p->pos = pos; +    p->offset = (short)offset; +    if (p->offset < 0) +	p->offset = 0; +    p->pos = (short)pos; +    if (p->pos < 0) +	p->pos = 0;      p->next = link_stack;      link_stack = p;  } | 
