diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-11-21 15:04:12 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-21 15:06:00 +0000 |
| commit | 17e45e42893900d1b4072284f3f6e3c14d9ebc4d (patch) | |
| tree | b5f33a3d303b9c2761a2560409e70062d9afc283 | |
| parent | New patch 922_lineproc.patch to fix null deref (diff) | |
| download | w3m-17e45e42893900d1b4072284f3f6e3c14d9ebc4d.tar.gz w3m-17e45e42893900d1b4072284f3f6e3c14d9ebc4d.zip | |
New patch 923_tagproc.patch to fix negative size allocation
| -rw-r--r-- | debian/patches/923_tagproc.patch | 22 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
2 files changed, 23 insertions, 0 deletions
diff --git a/debian/patches/923_tagproc.patch b/debian/patches/923_tagproc.patch new file mode 100644 index 0000000..6859d79 --- /dev/null +++ b/debian/patches/923_tagproc.patch @@ -0,0 +1,22 @@ +Subject: Prevent crash after allocate string of negative size +Author: Tatsuya Kinoshita <tats@debian.org> +Bug-Debian: https://github.com/tats/w3m/issues/33 +Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=af592aa5f154f1b0366513ddc2f545032a7b8721 + +diff --git a/file.c b/file.c +index 32ad98a..ecc1e2f 100644 +--- a/file.c ++++ b/file.c +@@ -4999,6 +4999,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) + parsedtag_get_value(tag, ATTR_CELLSPACING, &x); + parsedtag_get_value(tag, ATTR_CELLPADDING, &y); + parsedtag_get_value(tag, ATTR_VSPACE, &z); ++ if (x < 0) ++ x = 0; ++ if (y < 0) ++ y = 0; ++ if (z < 0) ++ z = 0; + #ifdef ID_EXT + parsedtag_get_value(tag, ATTR_ID, &id); + #endif /* ID_EXT */ diff --git a/debian/patches/series b/debian/patches/series index ed3146a..5750bcd 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -58,3 +58,4 @@ 920_table.patch 921_cotable.patch 922_lineproc.patch +923_tagproc.patch |