diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-11-07 10:02:42 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-07 10:02:42 +0000 |
| commit | af592aa5f154f1b0366513ddc2f545032a7b8721 (patch) | |
| tree | 179e13445a67efb0b67b00c6f50d7b5c21647235 | |
| parent | Prevent memory exhausted due to repeat appending "</table>" (diff) | |
| download | w3m-af592aa5f154f1b0366513ddc2f545032a7b8721.tar.gz w3m-af592aa5f154f1b0366513ddc2f545032a7b8721.zip | |
Prevent crash after allocate string of negative size
Bug-Debian: https://github.com/tats/w3m/issues/33
| -rw-r--r-- | file.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -5021,6 +5021,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) parsedtag_get_value(tag, ATTR_CELLSPACING, &x); parsedtag_get_value(tag, ATTR_CELLPADDING, &y); parsedtag_get_value(tag, ATTR_VSPACE, &z); + if (x < 0) + x = 0; + if (y < 0) + y = 0; + if (z < 0) + z = 0; if (x > MAX_CELLSPACING) x = MAX_CELLSPACING; if (y > MAX_CELLPADDING) |