diff options
| author | Fumitoshi UKAI <ukai@debian.or.jp> | 2001-11-20 13:17:13 +0000 |
|---|---|---|
| committer | Fumitoshi UKAI <ukai@debian.or.jp> | 2001-11-20 13:17:13 +0000 |
| commit | 05809b3647bfcb8d653fe8bb01f0f59226f6a6b4 (patch) | |
| tree | a1630d700df15f26199ebe87b4905764b4e3987e /frame.c | |
| parent | remove XXMakefile config.h (diff) | |
| download | w3m-05809b3647bfcb8d653fe8bb01f0f59226f6a6b4.tar.gz w3m-05809b3647bfcb8d653fe8bb01f0f59226f6a6b4.zip | |
fix possible buffer overrun
Diffstat (limited to 'frame.c')
| -rw-r--r-- | frame.c | 10 |
1 files changed, 7 insertions, 3 deletions
@@ -1,4 +1,4 @@ -/* $Id: frame.c,v 1.4 2001/11/16 22:02:00 ukai Exp $ */ +/* $Id: frame.c,v 1.5 2001/11/20 13:17:13 ukai Exp $ */ #include "fm.h" #include "parsetagx.h" #include "myctype.h" @@ -38,8 +38,10 @@ newFrameSet(struct parsed_tag *tag) if (cols) { length[i] = p = cols; while (*p != '\0') - if (*p++ == ',') + if (*p++ == ',') { length[++i] = p; + if (i >= sizeof(length) / sizeof(length[0]) - 2) break; + } length[++i] = p + 1; } if (i > 1) { @@ -74,8 +76,10 @@ newFrameSet(struct parsed_tag *tag) if (rows) { length[i] = p = rows; while (*p != '\0') - if (*p++ == ',') + if (*p++ == ',') { length[++i] = p; + if (i >= sizeof(length) / sizeof(length[0]) - 2) break; + } length[++i] = p + 1; } if (i > 1) { |