diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-08-17 10:47:19 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-08-17 10:47:19 +0000 |
| commit | a25fd09f74fb83499396935a96d63bb7cb8e2c58 (patch) | |
| tree | bd6253483c701f480377482c722f074c28bc3ac9 /file.c | |
| parent | Update ChangeLog (diff) | |
| download | w3m-a25fd09f74fb83499396935a96d63bb7cb8e2c58.tar.gz w3m-a25fd09f74fb83499396935a96d63bb7cb8e2c58.zip | |
Prevent negative array index for selectnumber and textareanumber
Bug-Debian: https://github.com/tats/w3m/issues/12
Diffstat (limited to '')
| -rw-r--r-- | file.c | 8 |
1 files changed, 4 insertions, 4 deletions
@@ -69,7 +69,7 @@ static int cur_status; #ifdef MENU_SELECT /* menu based <select> */ FormSelectOption *select_option; -static int max_select = MAX_SELECT; +int max_select = MAX_SELECT; static int n_select; static int cur_option_maxwidth; #endif /* MENU_SELECT */ @@ -81,7 +81,7 @@ static int cur_textarea_rows; static int cur_textarea_readonly; static int n_textarea; static int ignore_nl_textarea; -static int max_textarea = MAX_TEXTAREA; +int max_textarea = MAX_TEXTAREA; static int http_response_code; @@ -6014,7 +6014,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) case HTML_TEXTAREA_INT: if (parsedtag_get_value(tag, ATTR_TEXTAREANUMBER, &n_textarea) - && n_textarea < max_textarea) { + && n_textarea >= 0 && n_textarea < max_textarea) { textarea_str[n_textarea] = Strnew(); } else @@ -6031,7 +6031,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) #ifdef MENU_SELECT case HTML_SELECT_INT: if (parsedtag_get_value(tag, ATTR_SELECTNUMBER, &n_select) - && n_select < max_select) { + && n_select >= 0 && n_select < max_select) { select_option[n_select].first = NULL; select_option[n_select].last = NULL; } |