diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-11-21 14:45:18 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-21 14:45:18 +0000 |
| commit | ba971378ebc1c15abd199b7043e5783661536108 (patch) | |
| tree | b195883c33a1fee043eee97e16b585afc6f497f1 /debian | |
| parent | New patch 917_strgrow.patch to fix potential heap buffer corruption (diff) | |
| download | w3m-ba971378ebc1c15abd199b7043e5783661536108.tar.gz w3m-ba971378ebc1c15abd199b7043e5783661536108.zip | |
New patch 918_form-value.patch to fix null deref [CVE-2016-9443]
Diffstat (limited to '')
| -rw-r--r-- | debian/patches/918_form-value.patch | 22 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
2 files changed, 23 insertions, 0 deletions
diff --git a/debian/patches/918_form-value.patch b/debian/patches/918_form-value.patch new file mode 100644 index 0000000..a2d5709 --- /dev/null +++ b/debian/patches/918_form-value.patch @@ -0,0 +1,22 @@ +Subject: Fix null pointer dereference in formUpdateBuffer +Author: Tatsuya Kinoshita <tats@debian.org> +Bug-Debian: https://github.com/tats/w3m/issues/28 [CVE-2016-9443] +Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=ec9eb22e008a69ea9dc21fdca4b9b836679965ee +Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=22d29c3d11bdfec80164789a99c36cc674340914 + +diff --git a/form.c b/form.c +index 20b7310..e891df1 100644 +--- a/form.c ++++ b/form.c +@@ -459,7 +459,11 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) + } + else + #endif /* MENU_SELECT */ ++ { ++ if (!form->value) ++ break; + p = form->value->ptr; ++ } + l = buf->currentLine; + if (!l) + break; diff --git a/debian/patches/series b/debian/patches/series index 223af6d..8a33fdf 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -53,3 +53,4 @@ 915_table-alt.patch 916_anchor.patch 917_strgrow.patch +918_form-value.patch |