diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-08-08 15:02:24 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-19 05:11:40 +0000 |
| commit | f92e9ed28f277ec870e2786e707852ab7d4292a6 (patch) | |
| tree | 32bd3ef909608d7bf700c4ce0e619b72e2afce39 /file.c | |
| parent | Fix segfault on bogus text for wc_N_to_johab1 (diff) | |
| download | w3m-f92e9ed28f277ec870e2786e707852ab7d4292a6.tar.gz w3m-f92e9ed28f277ec870e2786e707852ab7d4292a6.zip | |
Prevent segfault with malformed input type
Bug-Debian: https://github.com/tats/w3m/issues/7 [CVE-2016-9430]
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=59b91cd8e30c86f23476fa81ae005cabff49ebb6
Diffstat (limited to 'file.c')
| -rw-r--r-- | file.c | 10 |
1 files changed, 6 insertions, 4 deletions
@@ -3622,9 +3622,10 @@ process_input(struct parsed_tag *tag) Strcat(tmp, getLinkNumberStr(0)); Strcat_char(tmp, '('); } - Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=%s " + Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=\"%s\" " "name=\"%s\" width=%d maxlength=%d value=\"%s\"", - cur_hseq++, cur_form_id, p, html_quote(r), w, i, qq)); + cur_hseq++, cur_form_id, html_quote(p), + html_quote(r), w, i, qq)); if (x) Strcat_charp(tmp, " checked"); if (y) @@ -3772,9 +3773,10 @@ process_button(struct parsed_tag *tag) } // Strcat_charp(tmp, "<pre_int>"); - Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=%s " + Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=\"%s\" " "name=\"%s\" value=\"%s\">", - cur_hseq++, cur_form_id, p, html_quote(r), qq)); + cur_hseq++, cur_form_id, html_quote(p), + html_quote(r), qq)); return tmp; } |