diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-07 12:50:56 +0000 | 
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2017-01-06 13:08:22 +0000 | 
| commit | 0e0c6781425dc8f65566e34b1cfa8be83d35a8eb (patch) | |
| tree | 2166a19272ea0ee2eaecdaef4d90b0f92d116b83 | |
| parent | Prevent array index out of bounds for tridvalue in feed_table_tag() (diff) | |
| download | w3m-0e0c6781425dc8f65566e34b1cfa8be83d35a8eb.tar.gz w3m-0e0c6781425dc8f65566e34b1cfa8be83d35a8eb.zip | |
Prevent negative values for offset and pos in push_link()
Bug-Debian: https://github.com/tats/w3m/issues/64
Bug-Debian: https://github.com/tats/w3m/issues/66
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=ecf57714191b77142da74035b748262cdc80dfb7
| -rw-r--r-- | file.c | 8 | 
1 files changed, 6 insertions, 2 deletions
| @@ -2307,8 +2307,12 @@ push_link(int cmd, int offset, int pos)      struct link_stack *p;      p = New(struct link_stack);      p->cmd = cmd; -    p->offset = offset; -    p->pos = pos; +    p->offset = (short)offset; +    if (p->offset < 0) +	p->offset = 0; +    p->pos = (short)pos; +    if (p->pos < 0) +	p->pos = 0;      p->next = link_stack;      link_stack = p;  } | 
