aboutsummaryrefslogtreecommitdiffstats
path: root/table.c
diff options
context:
space:
mode:
authorKuang-che Wu <kcwu@google.com>2016-08-18 10:35:41 +0000
committerTatsuya Kinoshita <tats@debian.org>2016-11-19 05:11:41 +0000
commit6f6b8ddb7f6ffddc1a361cde429dca546fefc50b (patch)
tree0c76e54bfb2f2cc9963f659fb3763e3616f20366 /table.c
parentPrevent segfault with malformed input_alt (diff)
downloadw3m-6f6b8ddb7f6ffddc1a361cde429dca546fefc50b.tar.gz
w3m-6f6b8ddb7f6ffddc1a361cde429dca546fefc50b.zip
Fix table rowspan and colspan
Origin: https://github.com/tats/w3m/pull/19 Bug-Debian: https://github.com/tats/w3m/issues/8 [CVE-2016-9422]
Diffstat (limited to '')
-rw-r--r--table.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/table.c b/table.c
index d376284..deeab0a 100644
--- a/table.c
+++ b/table.c
@@ -2600,12 +2600,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
if ((tbl->row + rowspan) >= tbl->max_rowsize)
check_row(tbl, tbl->row + rowspan);
}
+ if (rowspan < 1)
+ rowspan = 1;
if (parsedtag_get_value(tag, ATTR_COLSPAN, &colspan)) {
if ((tbl->col + colspan) >= MAXCOL) {
/* Can't expand column */
colspan = MAXCOL - tbl->col;
}
}
+ if (colspan < 1)
+ colspan = 1;
if (parsedtag_get_value(tag, ATTR_ALIGN, &i)) {
switch (i) {
case ALIGN_LEFT: