diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-12-17 16:20:14 +0000 | 
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-12-17 16:20:14 +0000 | 
| commit | aa2077e06fc11f65ba1773e8f5da83d98057e829 (patch) | |
| tree | 2ba3bd112a53f2de4a051e410656c762a895de7b | |
| parent | Prevent infinite loop in feed_textarea() (diff) | |
| download | w3m-aa2077e06fc11f65ba1773e8f5da83d98057e829.tar.gz w3m-aa2077e06fc11f65ba1773e8f5da83d98057e829.zip | |
Prevent heap-use-after-free read in HTMLlineproc0()
Bug-Debian: https://github.com/tats/w3m/issues/81
| -rw-r--r-- | file.c | 2 | 
1 files changed, 1 insertions, 1 deletions
| @@ -6356,7 +6356,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)  	    }  	    if (h_env->tagbuf->length == 0)  		continue; -	    str = h_env->tagbuf->ptr; +	    str = Strdup(h_env->tagbuf)->ptr;  	    if (*str == '<') {  		if (str[1] && REALLY_THE_BEGINNING_OF_A_TAG(str))  		    is_tag = TRUE; | 
