diff options
| author | Kuang-che Wu <kcwu@google.com> | 2016-08-18 10:35:41 +0000 |
|---|---|---|
| committer | Tatsuya Kinoshita <tats@debian.org> | 2016-11-19 05:11:41 +0000 |
| commit | 6f6b8ddb7f6ffddc1a361cde429dca546fefc50b (patch) | |
| tree | 0c76e54bfb2f2cc9963f659fb3763e3616f20366 /table.c | |
| parent | Prevent segfault with malformed input_alt (diff) | |
| download | w3m-6f6b8ddb7f6ffddc1a361cde429dca546fefc50b.tar.gz w3m-6f6b8ddb7f6ffddc1a361cde429dca546fefc50b.zip | |
Fix table rowspan and colspan
Origin: https://github.com/tats/w3m/pull/19
Bug-Debian: https://github.com/tats/w3m/issues/8 [CVE-2016-9422]
Diffstat (limited to 'table.c')
| -rw-r--r-- | table.c | 4 |
1 files changed, 4 insertions, 0 deletions
@@ -2600,12 +2600,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, if ((tbl->row + rowspan) >= tbl->max_rowsize) check_row(tbl, tbl->row + rowspan); } + if (rowspan < 1) + rowspan = 1; if (parsedtag_get_value(tag, ATTR_COLSPAN, &colspan)) { if ((tbl->col + colspan) >= MAXCOL) { /* Can't expand column */ colspan = MAXCOL - tbl->col; } } + if (colspan < 1) + colspan = 1; if (parsedtag_get_value(tag, ATTR_ALIGN, &i)) { switch (i) { case ALIGN_LEFT: |