aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTatsuya Kinoshita <tats@debian.org>2016-12-17 16:20:14 +0000
committerTatsuya Kinoshita <tats@debian.org>2016-12-17 16:20:14 +0000
commitaa2077e06fc11f65ba1773e8f5da83d98057e829 (patch)
tree2ba3bd112a53f2de4a051e410656c762a895de7b
parentPrevent infinite loop in feed_textarea() (diff)
downloadw3m-aa2077e06fc11f65ba1773e8f5da83d98057e829.tar.gz
w3m-aa2077e06fc11f65ba1773e8f5da83d98057e829.zip
Prevent heap-use-after-free read in HTMLlineproc0()
Bug-Debian: https://github.com/tats/w3m/issues/81
-rw-r--r--file.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/file.c b/file.c
index 97287ab..4d15ff1 100644
--- a/file.c
+++ b/file.c
@@ -6356,7 +6356,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
}
if (h_env->tagbuf->length == 0)
continue;
- str = h_env->tagbuf->ptr;
+ str = Strdup(h_env->tagbuf)->ptr;
if (*str == '<') {
if (str[1] && REALLY_THE_BEGINNING_OF_A_TAG(str))
is_tag = TRUE;