diff options
| author | Tatsuya Kinoshita <tats@debian.org> | 2016-08-24 10:05:39 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-19 05:15:15 +0000 |
| commit | 63e5fe1fc4a875e89942c0ebe068e717381cc78f (patch) | |
| tree | 1163fb6029493998e91414fc4cdfea3a73c01359 /table.c | |
| parent | Prevent segfault for formUpdateBuffer (diff) | |
| download | w3m-63e5fe1fc4a875e89942c0ebe068e717381cc78f.tar.gz w3m-63e5fe1fc4a875e89942c0ebe068e717381cc78f.zip | |
Prevent segfault with malformed table_alt
Bug-Debian: https://github.com/tats/w3m/issues/24 [CVE-2016-9441]
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=a6257663824c63abb3c62c4dd62455fe6f63d958
Diffstat (limited to 'table.c')
| -rw-r--r-- | table.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -761,7 +761,7 @@ do_refill(struct table *tbl, int row, int col, int maxlimit) struct parsed_tag *tag; if ((tag = parse_tag(&p, TRUE)) != NULL) parsedtag_get_value(tag, ATTR_TID, &id); - if (id >= 0 && id < tbl->ntable) { + if (id >= 0 && id < tbl->ntable && tbl->tables[id].ptr) { int alignment; TextLineListItem *ti; struct table *t = tbl->tables[id].ptr; |