diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-11-07 10:02:42 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-19 12:24:53 +0000 |
| commit | c82340f857dc6de9f5d818716cd9162062cfb143 (patch) | |
| tree | 11c2e0f6cc58bc47e286f65b493b10654d785f57 | |
| parent | Prevent null pointer dereference in HTMLlineproc2body (diff) | |
| download | w3m-c82340f857dc6de9f5d818716cd9162062cfb143.tar.gz w3m-c82340f857dc6de9f5d818716cd9162062cfb143.zip | |
Prevent crash after allocate string of negative size
Bug-Debian: https://github.com/tats/w3m/issues/33
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=af592aa5f154f1b0366513ddc2f545032a7b8721
| -rw-r--r-- | file.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -4999,6 +4999,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) parsedtag_get_value(tag, ATTR_CELLSPACING, &x); parsedtag_get_value(tag, ATTR_CELLPADDING, &y); parsedtag_get_value(tag, ATTR_VSPACE, &z); + if (x < 0) + x = 0; + if (y < 0) + y = 0; + if (z < 0) + z = 0; #ifdef ID_EXT parsedtag_get_value(tag, ATTR_ID, &id); #endif /* ID_EXT */ |