diff options
| -rw-r--r-- | debian/patches/020_debian.patch | 835 |
1 files changed, 694 insertions, 141 deletions
diff --git a/debian/patches/020_debian.patch b/debian/patches/020_debian.patch index 900ef87..9d17218 100644 --- a/debian/patches/020_debian.patch +++ b/debian/patches/020_debian.patch @@ -60,10 +60,233 @@ index 8f443c1..5fb6581 100755 $input = "w3m-control: GOTO_LINK"; } diff --git a/ChangeLog b/ChangeLog -index 88358ef..90443aa 100644 +index 88358ef..5e77a18 100644 --- a/ChangeLog +++ b/ChangeLog -@@ -1,3 +1,1303 @@ +@@ -1,3 +1,1526 @@ ++2017-01-02 Tatsuya Kinoshita <tats@debian.org> ++ ++ * NEWS: Update NEWS. ++ ++2016-12-24 Tatsuya Kinoshita <tats@debian.org> ++ ++ * libwc/wtf.c: ++ Prevent overflow beyond the end of string in wtf_parse1(). ++ Bug-Debian: https://github.com/tats/w3m/issues/68 ++ ++ * libwc/wtf.c: ++ Revert "Prevent overflow beyond the end of string in wtf_parse1()". ++ This reverts commit 998b6f91d4b02e8bf90b7744dfabc8cccdf9d4f9. ++ Bug-Debian: https://github.com/tats/w3m/issues/86 ++ cf. http://emacs-w3m.namazu.org/ml/msg12505.html ++ ++ * form.c: ++ Preserve one byte for end of string character in form_update_line(). ++ Bug-Debian: https://github.com/tats/w3m/issues/68#issuecomment-266214643 ++ ++ * form.c: ++ Prevent invalid form_update_line() call in formUpdateBuffer(). ++ Bug-Debian: https://github.com/tats/w3m/issues/82 ++ ++2016-12-20 Tatsuya Kinoshita <tats@debian.org> ++ ++ * form.c: ++ Revert "Preserve one byte for end of string character in form_update_line()". ++ This reverts commit a4152aaaea5cb51c9018880a1295e498c38889bf. ++ ++2016-12-18 Tatsuya Kinoshita <tats@debian.org> ++ ++ * file.c: Prevent heap-use-after-free read in HTMLlineproc0(). ++ Bug-Debian: https://github.com/tats/w3m/issues/81 ++ ++ * file.c: Prevent infinite loop in feed_textarea(). ++ Bug-Debian: https://github.com/tats/w3m/issues/85 ++ ++ * form.c: ++ Revert "Prevent overflow beyond the end of string in form_update_line()". ++ This reverts commit 9ccaa1dd0dac6f9b35a649ae9901c225421500f6. ++ ++ * form.c: ++ Revert "Prevent overflow beyond the end of string in form_update_line()". ++ This reverts commit e0efc127ff20cbeb931847af1c9b353056340fbd. ++ ++2016-12-15 Tatsuya Kinoshita <tats@debian.org> ++ ++ * libwc/wtf.c: ++ Prevent overflow beyond the end of string for wtf to wcs macros. ++ Bug-Debian: https://github.com/tats/w3m/issues/77 ++ ++ * libwc/wtf.c: ++ Revert "Prevent overflow beyond the end of string for wtf to wcs macros". ++ This reverts commit b4d27ba5ccffaa38e968c2bf3a8eeb9cd43928ff. ++ ++ * file.c, libwc/wtf.c, libwc/wtf.h: ++ Prevent overflow beyond the end of string in caller of get_mclen(). ++ Bug-Debian: https://github.com/tats/w3m/issues/59 ++ Bug-Debian: https://github.com/tats/w3m/issues/73 ++ Bug-Debian: https://github.com/tats/w3m/issues/74 ++ Bug-Debian: https://github.com/tats/w3m/issues/75 ++ Bug-Debian: https://github.com/tats/w3m/issues/76 ++ Bug-Debian: https://github.com/tats/w3m/issues/78 ++ Bug-Debian: https://github.com/tats/w3m/issues/79 ++ Bug-Debian: https://github.com/tats/w3m/issues/80 ++ Bug-Debian: https://github.com/tats/w3m/issues/83 ++ Bug-Debian: https://github.com/tats/w3m/issues/84 ++ ++ * file.c: ++ Revert "Prevent overflow beyond the end of string in proc_mchar()". ++ This reverts commit 512ed467d12615f5ef40d0d28272e5662d8438ea. ++ ++ * table.c: ++ Revert "Prevent overflow beyond the end of string in visible_length()". ++ This reverts commit a932f78a6d8c105036ffeedf01215c1f6a0e0b71. ++ ++ * table.c: ++ Revert "Prevent overflow beyond the end of string in skip_space()". ++ This reverts commit e757b43bcf8c439c167f62b6d3317ee9518cabbf. ++ ++ * table.c: ++ Revert "Prevent overflow beyond the end of string in visible_length_plain()". ++ This reverts commit f763b8ebf5441cb44d2c0234565fadd5eb1c87a5. ++ ++ * form.c: ++ Revert "Prevent overflow beyond the end of string in textfieldrep()". ++ This reverts commit 77d8d8d6576d8afc0f6b2e09bb88c7ca9dba58bb. ++ ++ * file.c: ++ Revert "Prevent overflow beyond the end of string in proc_mchar()". ++ This reverts commit e79d0ec2a00369a6af24007a1f2bb5e876e2c847. ++ ++2016-12-13 Tatsuya Kinoshita <tats@debian.org> ++ ++ * file.c: Prevent overflow beyond the end of string in proc_mchar(). ++ Bug-Debian: https://github.com/tats/w3m/issues/80 ++ cf. https://github.com/tats/w3m/issues/59 ++ ++ * form.c: Prevent overflow beyond the end of string in textfieldrep(). ++ Bug-Debian: https://github.com/tats/w3m/issues/79 ++ ++ * form.c: ++ Preserve one byte for end of string character in form_update_line(). ++ Bug-Debian: https://github.com/tats/w3m/issues/82 ++ cf. https://github.com/tats/w3m/issues/68#issuecomment-266214643 ++ ++2016-12-10 Tatsuya Kinoshita <tats@debian.org> ++ ++ * libwc/wtf.c: Prevent overflow beyond the end of string in wtf_len(). ++ cf. https://github.com/tats/w3m/issues/57 ++ ++ * etc.c: Prevent negative array index for realColumn in calcPosition(). ++ Bug-Debian: https://github.com/tats/w3m/issues/69 ++ ++ * libwc/wtf.c: ++ Prevent overflow beyond the end of string in wtf_parse1(). ++ Bug-Debian: https://github.com/tats/w3m/issues/68 ++ ++ * Str.c: Prevent heap-buffer-overflow in Strnew_size(). ++ Bug-Debian: https://github.com/tats/w3m/issues/72 ++ ++ * table.c: ++ Prevent overflow beyond the end of string in visible_length_plain(). ++ Bug-Debian: https://github.com/tats/w3m/issues/76 ++ ++ * libwc/wtf.c: ++ Prevent overflow beyond the end of string for wtf to wcs macros. ++ Bug-Debian: https://github.com/tats/w3m/issues/77 ++ ++ * form.c: ++ Prevent overflow beyond the end of string in form_update_line(). ++ Bug-Debian: https://github.com/tats/w3m/issues/78 ++ ++2016-12-08 Tatsuya Kinoshita <tats@debian.org> ++ ++ * form.c: ++ Prevent overflow beyond the end of string in form_update_line(). ++ Bug-Debian: https://github.com/tats/w3m/issues/75 ++ ++ * table.c: Prevent overflow beyond the end of string in skip_space(). ++ Bug-Debian: https://github.com/tats/w3m/issues/74 ++ ++ * table.c: ++ Prevent overflow beyond the end of string in visible_length(). ++ Bug-Debian: https://github.com/tats/w3m/issues/73 ++ ++ * libwc/wtf.c: ++ Prevent overflow beyond the end of string in wtf_strwidth(). ++ Bug-Debian: https://github.com/tats/w3m/issues/57 ++ ++ * libwc/wtf.c: ++ Revert "Prevent overflow beyond the end of string in wtf_strwidth()". ++ This reverts commit d345c0950dfdef065b7377ecad0e4bc1d2601bf8. ++ ++2016-12-07 Tatsuya Kinoshita <tats@debian.org> ++ ++ * file.c: Prevent heap-use-after-free in HTMLlineproc0(). ++ Bug-Debian: https://github.com/tats/w3m/issues/65 ++ ++ * file.c: Prevent negative values for offset and pos in push_link(). ++ Bug-Debian: https://github.com/tats/w3m/issues/64 ++ ++ * file.c: Prevent overflow beyond the end of string in proc_mchar(). ++ Bug-Debian: https://github.com/tats/w3m/issues/59 ++ ++ * libwc/wtf.c: ++ Prevent overflow beyond the end of string in wtf_strwidth(). ++ Bug-Debian: https://github.com/tats/w3m/issues/57 ++ ++2016-12-05 Yixun Lan <dlan@gentoo.org> ++ ++ * html.h: Explictily include <time.h> to avoid build err. ++ While disable ssl, we will got a undefine time_t err. ++ Bug-Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=601498 ++ Origin: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8ee43ba4e036db70fff258f3edb2f0335385e93f ++ ++2016-12-05 Tatsuya Kinoshita <tats@debian.org> ++ ++ * table.c: ++ Prevent array index out of bounds for tridvalue in feed_table_tag(). ++ Bug-Debian: https://github.com/tats/w3m/issues/71 ++ ++ * table.c: Prevent negative array index in set_integered_width(). ++ Bug-Debian: https://github.com/tats/w3m/issues/70 ++ ++ * table.c: ++ Prevent array index out of bounds for tabattr in feed_table_tag(). ++ Bug-Debian: https://github.com/tats/w3m/issues/60 ++ ++ * file.c: Prevent negative array index in process_textarea(). ++ Bug-Debian: https://github.com/tats/w3m/issues/58 ++ ++ * file.c: ++ Prevent negative array index for marks in HTMLlineproc2body(). ++ Bug-Debian: https://github.com/tats/w3m/issues/61 ++ ++ * file.c: ++ Prevent negative value of row for pushTable() in HTMLlineproc0(). ++ Bug-Debian: https://github.com/tats/w3m/issues/67 ++ ++ * file.c: Prevent negative array index in getMetaRefreshParam(). ++ Bug-Debian: https://github.com/tats/w3m/issues/63 ++ ++ * anchor.c: ++ Prevent negative array index for marks in shiftAnchorPosition(). ++ Bug-Debian: https://github.com/tats/w3m/issues/62 ++ ++2016-11-27 Kuang-che Wu <kcwu@google.com> ++ ++ * file.c: Fix uninitialized variable in process_img(). fix #44. ++ Bug-Debian: https://github.com/tats/w3m/issues/44 ++ Origin: https://github.com/tats/w3m/pull/50/commits/41a607b06e4475101de59e5c623b9e5f76594a21 ++ ++ * menu.c: Fix menu buffer-overflow. ++ Origin: https://github.com/tats/w3m/pull/49/commits/7e1c05dd90cf42a308e854881ea3813aed000d2e ++ ++2016-11-27 Tatsuya Kinoshita <tats@debian.org> ++ ++ * ChangeLog, NEWS: Add CVE IDs. ++ cf. https://security-tracker.debian.org/tracker/source-package/w3m ++ http://www.openwall.com/lists/oss-security/2016/11/24/1 ++ +2016-11-20 Tatsuya Kinoshita <tats@debian.org> + + * NEWS: Update NEWS. @@ -83,15 +306,15 @@ index 88358ef..90443aa 100644 + + * libwc/ucs.c, libwc/ucs.map: + Prevent global-buffer-overflow in wc_any_to_ucs(). -+ Bug-Debian: https://github.com/tats/w3m/issues/43 ++ Bug-Debian: https://github.com/tats/w3m/issues/43 [CVE-2016-9632] + +2016-11-17 Tatsuya Kinoshita <tats@debian.org> + + * url.c: Prevent global-buffer-overflow in parseURL(). -+ Bug-Debian: https://github.com/tats/w3m/issues/41 ++ Bug-Debian: https://github.com/tats/w3m/issues/41 [CVE-2016-9630] + + * file.c: Prevent deref null pointer in HTMLlineproc0(). -+ Bug-Debian: https://github.com/tats/w3m/issues/42 ++ Bug-Debian: https://github.com/tats/w3m/issues/42 [CVE-2016-9631] + +2016-11-15 Tatsuya Kinoshita <tats@debian.org> + @@ -108,16 +331,16 @@ index 88358ef..90443aa 100644 + This reverts commit f393faf55975a94217df479e1bd06ee4403c6958. + + * anchor.c: Prevent deref null pointer in shiftAnchorPosition(). -+ Bug-Debian: https://github.com/tats/w3m/issues/40 ++ Bug-Debian: https://github.com/tats/w3m/issues/40 [CVE-2016-9629] + +2016-11-14 Tatsuya Kinoshita <tats@debian.org> + + * file.c: Prevent null pointer deref due to bad form id. -+ Bug-Debian: https://github.com/tats/w3m/issues/39 ++ Bug-Debian: https://github.com/tats/w3m/issues/39 [CVE-2016-9628] + + * display.c, file.c, fm.h, symbol.c: + Prevent array index out of bounds for symbol. -+ Bug-Debian: https://github.com/tats/w3m/issues/38 ++ Bug-Debian: https://github.com/tats/w3m/issues/38 [CVE-2016-9627] + +2016-11-13 Tatsuya Kinoshita <tats@debian.org> + @@ -135,12 +358,12 @@ index 88358ef..90443aa 100644 +2016-11-09 Tatsuya Kinoshita <tats@debian.org> + + * table.c: Check indent_level to prevent infinite recursion. -+ Bug-Debian: https://github.com/tats/w3m/issues/37 ++ Bug-Debian: https://github.com/tats/w3m/issues/37 [CVE-2016-9626] + +2016-11-07 Tatsuya Kinoshita <tats@debian.org> + + * file.c: Prevent infinite recursion in HTMLlineproc0. -+ Bug-Debian: https://github.com/tats/w3m/issues/36 ++ Bug-Debian: https://github.com/tats/w3m/issues/36 [CVE-2016-9625] + + * NEWS, w3m-doc/install.html.in: + Update documents for included w3mdict.cgi. @@ -156,16 +379,16 @@ index 88358ef..90443aa 100644 +2016-11-07 Tatsuya Kinoshita <tats@debian.org> + + * form.c: Prevent dereference near-null pointer in formUpdateBuffer. -+ Bug-Debian: https://github.com/tats/w3m/issues/35 ++ Bug-Debian: https://github.com/tats/w3m/issues/35 [CVE-2016-9624] + + * file.c: Prevent crash after allocate string of negative size. -+ Bug-Debian: https://github.com/tats/w3m/issues/33 ++ Bug-Debian: https://github.com/tats/w3m/issues/33 [CVE-2016-9623] + + * file.c: Prevent memory exhausted due to repeat appending "</table>". -+ Bug-Debian: https://github.com/tats/w3m/issues/23 ++ Bug-Debian: https://github.com/tats/w3m/issues/23 [CVE-2016-9633] + + * file.c: Prevent null pointer dereference in HTMLlineproc2body. -+ Bug-Debian: https://github.com/tats/w3m/issues/32 ++ Bug-Debian: https://github.com/tats/w3m/issues/32 [CVE-2016-9622] + +2016-10-31 Tatsuya Kinoshita <tats@debian.org> + @@ -203,7 +426,7 @@ index 88358ef..90443aa 100644 + Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838952 + + * form.c: Prevent global-buffer-overflow write in formUpdateBuffer. -+ Bug-Debian: https://github.com/tats/w3m/issues/29 [CVE-2016-9429] ++ Bug-Debian: https://github.com/tats/w3m/issues/29 [CVE-2016-9429] [CVE-2016-9621] + + * form.c: Fix null pointer dereference in formUpdateBuffer. + Bug-Debian: https://github.com/tats/w3m/issues/28 [CVE-2016-9443] @@ -1419,15 +1642,25 @@ index 7d692f9..453072d 100644 do \ (cd $$dir && $(MAKE) $(MAKE_ARGS) uninstall); \ diff --git a/NEWS b/NEWS -index 66e309d..b80e8ed 100644 +index 66e309d..d8a99d3 100644 --- a/NEWS +++ b/NEWS -@@ -1,3 +1,55 @@ +@@ -1,3 +1,65 @@ ++Debian's w3m 0.5.3+git20170102 ++ ++* bug fixes ++ - fix multiple flaws with malformed text ++ (buffer overflow, use after free, infinite loop) ++ - fix uninitialized variable when not USE_IMAGE ++ +Debian's w3m 0.5.3+git20161120 + +* bug fixes + - fix multiple flaws with malformed text + (stack overflow, buffer overflow, null deref, out of memory) ++ [CVE-2016-9622], [CVE-2016-9623], [CVE-2016-9624], [CVE-2016-9625], ++ [CVE-2016-9626], [CVE-2016-9627], [CVE-2016-9628], [CVE-2016-9629], ++ [CVE-2016-9630], [CVE-2016-9631], [CVE-2016-9632], [CVE-2016-9633] + - fix stack overflow with nested table and textarea [CVE-2016-9439] + - fix suspend (^Z) behavior + @@ -1452,7 +1685,7 @@ index 66e309d..b80e8ed 100644 + [CVE-2016-9426], [CVE-2016-9428], [CVE-2016-9429], [CVE-2016-9430], + [CVE-2016-9431], [CVE-2016-9432], [CVE-2016-9433], [CVE-2016-9434], + [CVE-2016-9435], [CVE-2016-9436], [CVE-2016-9437], [CVE-2016-9438], -+ [CVE-2016-9440], [CVE-2016-9441], [CVE-2016-9443] ++ [CVE-2016-9440], [CVE-2016-9441], [CVE-2016-9443], [CVE-2016-9621] + - fix potential heap buffer corruption due to Strgrow [CVE-2016-9442] + - disable SSLv2 and SSLv3 by default [CVE-2014-3566] + - set ssl_verify_server to 1 by default @@ -1493,10 +1726,19 @@ index 8778d80..765c996 100644 If you can read Japanese, see doc-jp/*. If you can read both, read both and correct English. :-) diff --git a/Str.c b/Str.c -index e5a0982..d34129f 100644 +index e5a0982..61fe3ca 100644 --- a/Str.c +++ b/Str.c -@@ -56,7 +56,7 @@ Strnew_size(int n) +@@ -48,6 +48,8 @@ Str + Strnew_size(int n) + { + Str x = GC_MALLOC(sizeof(struct _Str)); ++ if (n < 0) ++ n = 0; + x->ptr = GC_MALLOC_ATOMIC(n + 1); + x->ptr[0] = '\0'; + x->area_size = n + 1; +@@ -56,7 +58,7 @@ Strnew_size(int n) } Str @@ -1505,7 +1747,7 @@ index e5a0982..d34129f 100644 { Str x; int n; -@@ -73,7 +73,7 @@ Strnew_charp(char *p) +@@ -73,7 +75,7 @@ Strnew_charp(char *p) } Str @@ -1514,7 +1756,7 @@ index e5a0982..d34129f 100644 { va_list ap; Str r = Strnew(); -@@ -87,7 +87,7 @@ Strnew_m_charp(char *p, ...) +@@ -87,7 +89,7 @@ Strnew_m_charp(char *p, ...) } Str @@ -1523,7 +1765,7 @@ index e5a0982..d34129f 100644 { Str x; -@@ -140,7 +140,7 @@ Strcopy(Str x, Str y) +@@ -140,7 +142,7 @@ Strcopy(Str x, Str y) } void @@ -1532,7 +1774,7 @@ index e5a0982..d34129f 100644 { int len; -@@ -160,7 +160,7 @@ Strcopy_charp(Str x, char *y) +@@ -160,7 +162,7 @@ Strcopy_charp(Str x, char *y) } void @@ -1541,7 +1783,7 @@ index e5a0982..d34129f 100644 { int len = n; -@@ -180,7 +180,7 @@ Strcopy_charp_n(Str x, char *y, int n) +@@ -180,7 +182,7 @@ Strcopy_charp_n(Str x, char *y, int n) } void @@ -1550,7 +1792,7 @@ index e5a0982..d34129f 100644 { int newlen; -@@ -209,7 +209,7 @@ Strcat(Str x, Str y) +@@ -209,7 +211,7 @@ Strcat(Str x, Str y) } void @@ -1559,7 +1801,7 @@ index e5a0982..d34129f 100644 { if (y == NULL) return; -@@ -232,8 +232,8 @@ Strgrow(Str x) +@@ -232,8 +234,8 @@ Strgrow(Str x) { char *old = x->ptr; int newlen; @@ -1570,7 +1812,7 @@ index e5a0982..d34129f 100644 newlen += 2; x->ptr = GC_MALLOC_ATOMIC(newlen); x->area_size = newlen; -@@ -278,8 +278,8 @@ void +@@ -278,8 +280,8 @@ void Strchop(Str s) { STR_LENGTH_CHECK(s); @@ -1581,7 +1823,7 @@ index e5a0982..d34129f 100644 s->length--; } s->ptr[s->length] = '\0'; -@@ -301,7 +301,7 @@ Strinsert_char(Str s, int pos, char c) +@@ -301,7 +303,7 @@ Strinsert_char(Str s, int pos, char c) } void @@ -1590,7 +1832,7 @@ index e5a0982..d34129f 100644 { STR_LENGTH_CHECK(s); while (*p) -@@ -530,11 +530,8 @@ Str +@@ -530,11 +532,8 @@ Str Strfgets(FILE * f) { Str s = Strnew(); @@ -1604,7 +1846,7 @@ index e5a0982..d34129f 100644 Strcat_char(s, c); if (c == '\n') break; -@@ -546,11 +543,8 @@ Str +@@ -546,11 +545,8 @@ Str Strfgetall(FILE * f) { Str s = Strnew(); @@ -1816,7 +2058,7 @@ index 0000000..fa0d391 + +#endif /* W3_ALLOC_H */ diff --git a/anchor.c b/anchor.c -index 27bbd56..10d6c1c 100644 +index 27bbd56..b6d121c 100644 --- a/anchor.c +++ b/anchor.c @@ -11,7 +11,7 @@ putAnchor(AnchorList *al, char *url, char *target, Anchor **anchor_return, @@ -1858,16 +2100,17 @@ index 27bbd56..10d6c1c 100644 '\0', line, pos); } -@@ -549,7 +551,7 @@ shiftAnchorPosition(AnchorList *al, HmarkerList *hl, int line, int pos, +@@ -549,7 +551,8 @@ shiftAnchorPosition(AnchorList *al, HmarkerList *hl, int line, int pos, break; if (a->start.pos > pos) { a->start.pos += shift; - if (hl->marks[a->hseq].line == line) -+ if (hl && hl->marks && hl->marks[a->hseq].line == line) ++ if (hl && hl->marks && ++ a->hseq >= 0 && hl->marks[a->hseq].line == line) hl->marks[a->hseq].pos = a->start.pos; } if (a->end.pos >= pos) -@@ -641,7 +643,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al) +@@ -641,7 +644,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al) { int i, j, k, col, ecol, pos; Anchor a_form, *a; @@ -1875,7 +2118,7 @@ index 27bbd56..10d6c1c 100644 Line *l, *ls; if (al == NULL || al->nanchor == 0) -@@ -668,7 +669,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al) +@@ -668,7 +670,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al) if (!ls) continue; } @@ -1883,7 +2126,7 @@ index 27bbd56..10d6c1c 100644 col = COLPOS(ls, a_form.start.pos); ecol = COLPOS(ls, a_form.end.pos); for (j = 0; l && j < a_form.rows; l = l->next, j++) { -@@ -685,6 +685,8 @@ addMultirowsForm(Buffer *buf, AnchorList *al) +@@ -685,6 +686,8 @@ addMultirowsForm(Buffer *buf, AnchorList *al) a->hseq = a_form.hseq; a->y = a_form.y; a->end.pos = pos + ecol - col; @@ -1892,7 +2135,7 @@ index 27bbd56..10d6c1c 100644 l->lineBuf[pos - 1] = '['; l->lineBuf[a->end.pos] = ']'; for (k = pos; k < a->end.pos; k++) -@@ -756,7 +758,7 @@ link_list_panel(Buffer *buf) +@@ -756,7 +759,7 @@ link_list_panel(Buffer *buf) p = parsedURL2Str(&pu)->ptr; u = html_quote(p); if (DecodeURL) @@ -1901,7 +2144,7 @@ index 27bbd56..10d6c1c 100644 else p = u; } -@@ -787,7 +789,7 @@ link_list_panel(Buffer *buf) +@@ -787,7 +790,7 @@ link_list_panel(Buffer *buf) p = parsedURL2Str(&pu)->ptr; u = html_quote(p); if (DecodeURL) @@ -1910,7 +2153,7 @@ index 27bbd56..10d6c1c 100644 else p = u; t = getAnchorText(buf, al, a); -@@ -809,16 +811,13 @@ link_list_panel(Buffer *buf) +@@ -809,16 +812,13 @@ link_list_panel(Buffer *buf) p = parsedURL2Str(&pu)->ptr; u = html_quote(p); if (DecodeURL) @@ -1929,7 +2172,7 @@ index 27bbd56..10d6c1c 100644 Strcat_m_charp(tmp, "<li><a href=\"", u, "\">", t, "</a><br>", p, "\n", NULL); a = retrieveAnchor(buf->formitem, a->start.line, a->start.pos); -@@ -842,19 +841,13 @@ link_list_panel(Buffer *buf) +@@ -842,19 +842,13 @@ link_list_panel(Buffer *buf) p = parsedURL2Str(&pu)->ptr; u = html_quote(p); if (DecodeURL) @@ -14183,9 +14426,18 @@ index fdd8f64..45dc95e 100644 if (UseAltEntity) return alt_latin1[c - 0xa0]; diff --git a/etc.c b/etc.c -index 8fe1215..dcc6edd 100644 +index 8fe1215..37c4f15 100644 --- a/etc.c +++ b/etc.c +@@ -498,7 +498,7 @@ calcPosition(char *l, Lineprop *pr, int len, int pos, int bpos, int mode) + static char *prevl = NULL; + int i, j; + +- if (l == NULL || len == 0) ++ if (l == NULL || len == 0 || pos < 0) + return bpos; + if (l == prevl && mode == CP_AUTO) { + if (pos <= len) @@ -1365,7 +1365,13 @@ setup_child(int child, int i, int f) if (!child) SETPGRP(); @@ -14201,7 +14453,7 @@ index 8fe1215..dcc6edd 100644 QuietMessage = TRUE; fmInitialized = FALSE; diff --git a/file.c b/file.c -index 567d41e..86af3a9 100644 +index 567d41e..4d15ff1 100644 --- a/file.c +++ b/file.c @@ -26,6 +26,8 @@ @@ -14496,7 +14748,22 @@ index 567d41e..86af3a9 100644 TRAP_OFF; return b; } -@@ -2469,6 +2455,7 @@ set_breakpoint(struct readbuffer *obuf, int tag_length) +@@ -2325,8 +2311,12 @@ push_link(int cmd, int offset, int pos) + struct link_stack *p; + p = New(struct link_stack); + p->cmd = cmd; +- p->offset = offset; +- p->pos = pos; ++ p->offset = (short)offset; ++ if (p->offset < 0) ++ p->offset = 0; ++ p->pos = (short)pos; ++ if (p->pos < 0) ++ p->pos = 0; + p->next = link_stack; + link_stack = p; + } +@@ -2469,6 +2459,7 @@ set_breakpoint(struct readbuffer *obuf, int tag_length) bcopy((void *)&obuf->anchor, (void *)&obuf->bp.anchor, sizeof(obuf->anchor)); obuf->bp.img_alt = obuf->img_alt; @@ -14504,7 +14771,7 @@ index 567d41e..86af3a9 100644 obuf->bp.in_bold = obuf->in_bold; obuf->bp.in_italic = obuf->in_italic; obuf->bp.in_under = obuf->in_under; -@@ -2486,6 +2473,7 @@ back_to_breakpoint(struct readbuffer *obuf) +@@ -2486,6 +2477,7 @@ back_to_breakpoint(struct readbuffer *obuf) bcopy((void *)&obuf->bp.anchor, (void *)&obuf->anchor, sizeof(obuf->anchor)); obuf->img_alt = obuf->bp.img_alt; @@ -14512,7 +14779,7 @@ index 567d41e..86af3a9 100644 obuf->in_bold = obuf->bp.in_bold; obuf->in_italic = obuf->bp.in_italic; obuf->in_under = obuf->bp.in_under; -@@ -2729,7 +2717,7 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, +@@ -2729,7 +2721,7 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, Str line = obuf->line, pass = NULL; char *hidden_anchor = NULL, *hidden_img = NULL, *hidden_bold = NULL, *hidden_under = NULL, *hidden_italic = NULL, *hidden_strike = NULL, @@ -14521,7 +14788,7 @@ index 567d41e..86af3a9 100644 #ifdef DEBUG if (w3m_debug) { -@@ -2761,6 +2749,12 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, +@@ -2761,6 +2753,12 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, hidden = hidden_img; } } @@ -14534,7 +14801,7 @@ index 567d41e..86af3a9 100644 if (obuf->in_bold) { if ((hidden_bold = has_hidden_link(obuf, HTML_B)) != NULL) { if (!hidden || hidden_bold < hidden) -@@ -2812,6 +2806,8 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, +@@ -2812,6 +2810,8 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, Strcat_charp(line, "</a>"); if (obuf->img_alt && !hidden_img) Strcat_charp(line, "</img_alt>"); @@ -14543,7 +14810,7 @@ index 567d41e..86af3a9 100644 if (obuf->in_bold && !hidden_bold) Strcat_charp(line, "</b>"); if (obuf->in_italic && !hidden_italic) -@@ -3022,6 +3018,18 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, +@@ -3022,6 +3022,18 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent, Strcat_charp(tmp, "\">"); push_tag(obuf, tmp->ptr, HTML_IMG_ALT); } @@ -14562,7 +14829,7 @@ index 567d41e..86af3a9 100644 if (!hidden_bold && obuf->in_bold) push_tag(obuf, "<B>", HTML_B); if (!hidden_italic && obuf->in_italic) -@@ -3228,7 +3236,7 @@ process_img(struct parsed_tag *tag, int width) +@@ -3228,7 +3240,7 @@ process_img(struct parsed_tag *tag, int width) if (!parsedtag_get_value(tag, ATTR_SRC, &p)) return tmp; @@ -14571,7 +14838,18 @@ index 567d41e..86af3a9 100644 q = NULL; parsedtag_get_value(tag, ATTR_ALT, &q); if (!pseudoInlines && (q == NULL || (*q == '\0' && ignore_null_img_alt))) -@@ -3322,12 +3330,7 @@ process_img(struct parsed_tag *tag, int width) +@@ -3255,9 +3267,9 @@ process_img(struct parsed_tag *tag, int width) + } + #endif + } ++ i = -1; + #ifdef USE_IMAGE + if (use_image) { +- i = -1; + if (parsedtag_get_value(tag, ATTR_HEIGHT, &i)) { + if (i > 0) { + i = (int)(i * image_scale / 100 + 0.5); +@@ -3322,12 +3334,7 @@ process_img(struct parsed_tag *tag, int width) Image image; ParsedURL u; @@ -14584,7 +14862,7 @@ index 567d41e..86af3a9 100644 image.url = parsedURL2Str(&u)->ptr; if (!uncompressed_file_type(u.file, &image.ext)) image.ext = filename_extension(u.file, TRUE); -@@ -3346,8 +3349,14 @@ process_img(struct parsed_tag *tag, int width) +@@ -3346,8 +3353,14 @@ process_img(struct parsed_tag *tag, int width) if (i < 0) i = pixel_per_line; } @@ -14601,7 +14879,7 @@ index 567d41e..86af3a9 100644 Strcat(tmp, Sprintf("<pre_int><img_alt hseq=\"%d\" src=\"", cur_iseq++)); pre_int = TRUE; -@@ -3378,19 +3387,21 @@ process_img(struct parsed_tag *tag, int width) +@@ -3378,19 +3391,21 @@ process_img(struct parsed_tag *tag, int width) if (i0 >= 0) Strcat(tmp, Sprintf(" height=%d", i0)); switch (align) { @@ -14631,7 +14909,7 @@ index 567d41e..86af3a9 100644 case ALIGN_BOTTOM: top = ni - 1; bottom = 0; -@@ -3408,7 +3419,12 @@ process_img(struct parsed_tag *tag, int width) +@@ -3408,7 +3423,12 @@ process_img(struct parsed_tag *tag, int width) } break; } @@ -14645,7 +14923,16 @@ index 567d41e..86af3a9 100644 if (xoffset) Strcat(tmp, Sprintf(" xoffset=%d", xoffset)); if (yoffset) -@@ -3548,7 +3564,7 @@ process_anchor(struct parsed_tag *tag, char *tagbuf) +@@ -3435,7 +3455,7 @@ process_img(struct parsed_tag *tag, int width) + if (use_image) { + if (n > nw) { + char *r; +- for (r = q, n = 0; r; r += get_mclen(r), n += get_mcwidth(r)) { ++ for (r = q, n = 0; *r; r += get_mclen(r), n += get_mcwidth(r)) { + if (n + get_mcwidth(r) > nw) + break; + } +@@ -3548,7 +3568,7 @@ process_anchor(struct parsed_tag *tag, char *tagbuf) Str process_input(struct parsed_tag *tag) { @@ -14654,7 +14941,7 @@ index 567d41e..86af3a9 100644 char *q, *p, *r, *p2, *s; Str tmp = NULL; char *qq = ""; -@@ -3567,9 +3583,9 @@ process_input(struct parsed_tag *tag) +@@ -3567,9 +3587,9 @@ process_input(struct parsed_tag *tag) parsedtag_get_value(tag, ATTR_VALUE, &q); r = ""; parsedtag_get_value(tag, ATTR_NAME, &r); @@ -14667,7 +14954,7 @@ index 567d41e..86af3a9 100644 parsedtag_get_value(tag, ATTR_MAXLENGTH, &i); p2 = NULL; parsedtag_get_value(tag, ATTR_ALT, &p2); -@@ -3623,9 +3639,10 @@ process_input(struct parsed_tag *tag) +@@ -3623,9 +3643,10 @@ process_input(struct parsed_tag *tag) Strcat(tmp, getLinkNumberStr(0)); Strcat_char(tmp, '('); } @@ -14680,7 +14967,7 @@ index 567d41e..86af3a9 100644 if (x) Strcat_charp(tmp, " checked"); if (y) -@@ -3670,18 +3687,18 @@ process_input(struct parsed_tag *tag) +@@ -3670,18 +3691,18 @@ process_input(struct parsed_tag *tag) case FORM_INPUT_PASSWORD: i = 0; if (q) { @@ -14703,7 +14990,7 @@ index 567d41e..86af3a9 100644 Strcat_char(tmp, ' '); } break; -@@ -3732,6 +3749,75 @@ process_input(struct parsed_tag *tag) +@@ -3732,6 +3753,75 @@ process_input(struct parsed_tag *tag) } Str @@ -14779,7 +15066,27 @@ index 567d41e..86af3a9 100644 process_select(struct parsed_tag *tag) { Str tmp = NULL; -@@ -4084,6 +4170,7 @@ process_form_int(struct parsed_tag *tag, int fid) +@@ -3926,7 +4016,7 @@ process_textarea(struct parsed_tag *tag, int width) + cur_textarea_size = 20; + if (parsedtag_get_value(tag, ATTR_COLS, &p)) { + cur_textarea_size = atoi(p); +- if (p[strlen(p) - 1] == '%') ++ if (strlen(p) > 0 && p[strlen(p) - 1] == '%') + cur_textarea_size = width * cur_textarea_size / 100 - 2; + if (cur_textarea_size <= 0) { + cur_textarea_size = 20; +@@ -4003,7 +4093,9 @@ feed_textarea(char *str) + Strcat_charp(textarea_str[n_textarea], "\r\n"); + str++; + } +- else if (*str != '\r') ++ else if (*str == '\r') ++ str++; ++ else + Strcat_char(textarea_str[n_textarea], *(str++)); + } + } +@@ -4084,6 +4176,7 @@ process_form_int(struct parsed_tag *tag, int fid) parsedtag_get_value(tag, ATTR_METHOD, &p); q = "!CURRENT_URL!"; parsedtag_get_value(tag, ATTR_ACTION, &q); @@ -14787,7 +15094,7 @@ index 567d41e..86af3a9 100644 r = NULL; #ifdef USE_M17N if (parsedtag_get_value(tag, ATTR_ACCEPT_CHARSET, &r)) -@@ -4113,7 +4200,7 @@ process_form_int(struct parsed_tag *tag, int fid) +@@ -4113,7 +4206,7 @@ process_form_int(struct parsed_tag *tag, int fid) forms = New_N(FormList *, forms_size); form_stack = NewAtom_N(int, forms_size); } @@ -14796,7 +15103,7 @@ index 567d41e..86af3a9 100644 forms_size += form_max; forms = New_Reuse(FormList *, forms, forms_size); form_stack = New_Reuse(int, form_stack, forms_size); -@@ -4284,15 +4371,15 @@ getMetaRefreshParam(char *q, Str *refresh_uri) +@@ -4284,15 +4377,16 @@ getMetaRefreshParam(char *q, Str *refresh_uri) while (*q) { if (!strncasecmp(q, "url=", 4)) { q += 4; @@ -14810,12 +15117,13 @@ index 567d41e..86af3a9 100644 - if (s_tmp->ptr[s_tmp->length - 1] == '\"') { /* " - */ -+ if (s_tmp->ptr[s_tmp->length - 1] == '\"' /* " */ -+ || s_tmp->ptr[s_tmp->length - 1] == '\'') { /* ' */ ++ if (s_tmp->length > 0 && ++ (s_tmp->ptr[s_tmp->length - 1] == '\"' || /* " */ ++ s_tmp->ptr[s_tmp->length - 1] == '\'')) { /* ' */ s_tmp->length--; s_tmp->ptr[s_tmp->length] = '\0'; } -@@ -4599,6 +4686,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -4599,6 +4693,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) case HTML_DD: CLOSE_A; CLOSE_DT; @@ -14828,7 +15136,7 @@ index 567d41e..86af3a9 100644 if (envs[h_env->envc].env == HTML_DL_COMPACT) { if (obuf->pos > envs[h_env->envc].indent) flushline(h_env, obuf, envs[h_env->envc].indent, 0, -@@ -4833,13 +4926,13 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -4833,13 +4933,13 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) #ifdef USE_IMAGE i = 0; if (parsedtag_get_value(tag, ATTR_TOP_MARGIN, &i)) { @@ -14846,7 +15154,7 @@ index 567d41e..86af3a9 100644 } #endif return 0; -@@ -4853,15 +4946,43 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -4853,15 +4953,43 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) case HTML_INPUT_ALT: i = 0; if (parsedtag_get_value(tag, ATTR_TOP_MARGIN, &i)) { @@ -14864,10 +15172,10 @@ index 567d41e..86af3a9 100644 + } + if (parsedtag_get_value(tag, ATTR_HSEQ, &hseq)) { + obuf->input_alt.hseq = hseq; - } ++ } + if (parsedtag_get_value(tag, ATTR_FID, &i)) { + obuf->input_alt.fid = i; -+ } + } + if (parsedtag_get_value(tag, ATTR_TYPE, &p)) { + obuf->input_alt.type = Strnew_charp(p); + } @@ -14894,7 +15202,7 @@ index 567d41e..86af3a9 100644 case HTML_TABLE: close_anchor(h_env, obuf); obuf->table_level++; -@@ -4884,6 +5005,8 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -4884,6 +5012,8 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) else w = BORDER_THIN; } @@ -14903,7 +15211,7 @@ index 567d41e..86af3a9 100644 if (parsedtag_get_value(tag, ATTR_WIDTH, &i)) { if (obuf->table_level == 0) width = REAL_WIDTH(i, h_env->limit - envs[h_env->envc].indent); -@@ -4892,9 +5015,24 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -4892,9 +5022,24 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) } if (parsedtag_exists(tag, ATTR_HBORDER)) w = BORDER_NOWIN; @@ -14928,7 +15236,7 @@ index 567d41e..86af3a9 100644 #ifdef ID_EXT parsedtag_get_value(tag, ATTR_ID, &id); #endif /* ID_EXT */ -@@ -4970,6 +5108,16 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -4970,6 +5115,16 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) case HTML_INPUT: close_anchor(h_env, obuf); tmp = process_input(tag); @@ -14945,7 +15253,7 @@ index 567d41e..86af3a9 100644 if (tmp) HTMLlineproc1(tmp->ptr, h_env); return 1; -@@ -5067,11 +5215,10 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) +@@ -5067,11 +5222,10 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env) } return 1; case HTML_BASE: @@ -14959,7 +15267,7 @@ index 567d41e..86af3a9 100644 parseURL(p, cur_baseURL, NULL); } #endif -@@ -5329,6 +5476,13 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5329,6 +5483,13 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) #ifdef MENU_SELECT Anchor **a_select = NULL; #endif @@ -14973,7 +15281,7 @@ index 567d41e..86af3a9 100644 if (out_size == 0) { out_size = LINELEN; -@@ -5523,16 +5677,17 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5523,16 +5684,17 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) hseq = 0; id = NULL; if (parsedtag_get_value(tag, ATTR_NAME, &id)) { @@ -14995,7 +15303,16 @@ index 567d41e..86af3a9 100644 parsedtag_get_value(tag, ATTR_TITLE, &s); parsedtag_get_value(tag, ATTR_ACCESSKEY, &t); parsedtag_get_value(tag, ATTR_HSEQ, &hseq); -@@ -5618,7 +5773,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5571,7 +5733,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) + a_href->end.pos = pos; + if (a_href->start.line == a_href->end.line && + a_href->start.pos == a_href->end.pos) { +- if (buf->hmarklist && ++ if (buf->hmarklist && a_href->hseq >= 0 && + a_href->hseq < buf->hmarklist->nmark) + buf->hmarklist->marks[a_href->hseq].invalid = 1; + a_href->hseq = -1; +@@ -5618,7 +5780,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) ParsedURL u; Image *image; @@ -15004,7 +15321,7 @@ index 567d41e..86af3a9 100644 a_img->image = image = New(Image); image->url = parsedURL2Str(&u)->ptr; if (!uncompressed_file_type(u.file, &image->ext)) -@@ -5639,7 +5794,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5639,7 +5801,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) image->map = q; image->ismap = ismap; image->touch = 0; @@ -15013,7 +15330,7 @@ index 567d41e..86af3a9 100644 IMG_FLAG_SKIP); } else if (iseq < 0) { -@@ -5678,7 +5833,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5678,7 +5840,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) parsedtag_get_value(tag, ATTR_FID, &form_id); parsedtag_get_value(tag, ATTR_TOP_MARGIN, &top); parsedtag_get_value(tag, ATTR_BOTTOM_MARGIN, &bottom); @@ -15023,7 +15340,7 @@ index 567d41e..86af3a9 100644 break; /* outside of <form>..</form> */ form = forms[form_id]; if (hseq > 0) { -@@ -5689,6 +5845,21 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5689,6 +5852,21 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) putHmarker(buf->hmarklist, currentLn(buf), hpos, hseq - 1); } @@ -15045,7 +15362,7 @@ index 567d41e..86af3a9 100644 if (!form->target) form->target = buf->baseTarget; if (a_textarea && -@@ -5761,8 +5932,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5761,8 +5939,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) break; if (parsedtag_get_value(tag, ATTR_HREF, &p)) { MapArea *a; @@ -15056,7 +15373,7 @@ index 567d41e..86af3a9 100644 t = NULL; parsedtag_get_value(tag, ATTR_TARGET, &t); q = ""; -@@ -5811,11 +5982,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5811,11 +5989,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) break; case HTML_BASE: if (parsedtag_get_value(tag, ATTR_HREF, &p)) { @@ -15073,7 +15390,7 @@ index 567d41e..86af3a9 100644 } if (parsedtag_get_value(tag, ATTR_TARGET, &p)) buf->baseTarget = -@@ -5830,8 +6004,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5830,8 +6011,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) int refresh_interval = getMetaRefreshParam(q, &tmp); #ifdef USE_ALARM if (tmp) { @@ -15084,7 +15401,7 @@ index 567d41e..86af3a9 100644 buf->event = setAlarmEvent(buf->event, refresh_interval, AL_IMPLICIT_ONCE, -@@ -5844,8 +6018,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5844,8 +6025,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) FUNCNAME_reload, NULL); #else if (tmp && refresh_interval == 0) { @@ -15095,7 +15412,7 @@ index 567d41e..86af3a9 100644 pushEvent(FUNCNAME_gorURL, p); } #endif -@@ -5864,14 +6038,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5864,14 +6045,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) case HTML_TEXTAREA_INT: if (parsedtag_get_value(tag, ATTR_TEXTAREANUMBER, &n_textarea) @@ -15112,7 +15429,7 @@ index 567d41e..86af3a9 100644 FormItemList *item = (FormItemList *)a_textarea[n_textarea]->url; item->init_value = item->value = -@@ -5881,7 +6055,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5881,7 +6062,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) #ifdef MENU_SELECT case HTML_SELECT_INT: if (parsedtag_get_value(tag, ATTR_SELECTNUMBER, &n_select) @@ -15121,7 +15438,7 @@ index 567d41e..86af3a9 100644 select_option[n_select].first = NULL; select_option[n_select].last = NULL; } -@@ -5889,7 +6063,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5889,7 +6070,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) n_select = -1; break; case HTML_N_SELECT_INT: @@ -15130,7 +15447,7 @@ index 567d41e..86af3a9 100644 FormItemList *item = (FormItemList *)a_select[n_select]->url; item->select_option = select_option[n_select].first; -@@ -5929,7 +6103,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5929,7 +6110,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) #ifdef ID_EXT id = NULL; if (parsedtag_get_value(tag, ATTR_ID, &id)) { @@ -15139,7 +15456,7 @@ index 567d41e..86af3a9 100644 registerName(buf, id, currentLn(buf), pos); } if (renderFrameSet && -@@ -5964,7 +6138,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) +@@ -5964,7 +6145,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) fclose(debug); #endif for (form_id = 1; form_id <= form_max; form_id++) @@ -15149,7 +15466,7 @@ index 567d41e..86af3a9 100644 buf->formlist = (form_max >= 0) ? forms[form_max] : NULL; if (n_textarea) addMultirowsForm(buf, buf->formitem); -@@ -5982,7 +6157,8 @@ addLink(Buffer *buf, struct parsed_tag *tag) +@@ -5982,7 +6164,8 @@ addLink(Buffer *buf, struct parsed_tag *tag) parsedtag_get_value(tag, ATTR_HREF, &href); if (href) @@ -15159,7 +15476,7 @@ index 567d41e..86af3a9 100644 parsedtag_get_value(tag, ATTR_TITLE, &title); parsedtag_get_value(tag, ATTR_TYPE, &ctype); parsedtag_get_value(tag, ATTR_REL, &rel); -@@ -6154,10 +6330,10 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) +@@ -6154,10 +6337,10 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) while (*line != '\0') { char *str, *p; int is_tag = FALSE; @@ -15174,7 +15491,16 @@ index 567d41e..86af3a9 100644 if (*line == '<' || obuf->status != R_ST_NORMAL) { /* -@@ -6239,7 +6415,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) +@@ -6173,7 +6356,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) + } + if (h_env->tagbuf->length == 0) + continue; +- str = h_env->tagbuf->ptr; ++ str = Strdup(h_env->tagbuf)->ptr; + if (*str == '<') { + if (str[1] && REALLY_THE_BEGINNING_OF_A_TAG(str)) + is_tag = TRUE; +@@ -6239,7 +6422,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) } proc_normal: @@ -15183,7 +15509,16 @@ index 567d41e..86af3a9 100644 /* * within table: in <table>..</table>, all input tokens * are fed to the table renderer, and then the renderer -@@ -6272,6 +6448,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) +@@ -6255,6 +6438,8 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) + if (obuf->table_level >= 0) { + struct table *tbl0 = tables[obuf->table_level]; + str = Sprintf("<table_alt tid=%d>", tbl0->ntable)->ptr; ++ if (tbl0->row < 0) ++ continue; + pushTable(tbl0, tbl); + tbl = tbl0; + tbl_mode = &table_mode[obuf->table_level]; +@@ -6272,6 +6457,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) do_blankline(h_env, obuf, indent, 0, h_env->limit); } save_fonteffect(h_env, obuf); @@ -15191,7 +15526,17 @@ index 567d41e..86af3a9 100644 renderTable(tbl, tbl_width, h_env); restore_fonteffect(h_env, obuf); obuf->flag &= ~RB_IGNORE_P; -@@ -6756,6 +6933,12 @@ init_henv(struct html_feed_environ *h_env, struct readbuffer *obuf, +@@ -6429,7 +6615,8 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) + indent = h_env->envs[h_env->envc].indent; + if (obuf->bp.pos - i > indent) { + Str line; +- append_tags(obuf); ++ append_tags(obuf); /* may reallocate the buffer */ ++ bp = obuf->line->ptr + obuf->bp.len; + line = Strnew_charp(bp); + Strshrink(obuf->line, obuf->line->length - obuf->bp.len); + #ifdef FORMAT_NICE +@@ -6756,6 +6943,12 @@ init_henv(struct html_feed_environ *h_env, struct readbuffer *obuf, obuf->nobr_level = 0; bzero((void *)&obuf->anchor, sizeof(obuf->anchor)); obuf->img_alt = 0; @@ -15204,7 +15549,7 @@ index 567d41e..86af3a9 100644 obuf->in_bold = 0; obuf->in_italic = 0; obuf->in_under = 0; -@@ -6791,6 +6974,15 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf) +@@ -6791,6 +6984,15 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf) push_tag(obuf, "</img_alt>", HTML_N_IMG_ALT); obuf->img_alt = NULL; } @@ -15220,7 +15565,7 @@ index 567d41e..86af3a9 100644 if (obuf->in_bold) { push_tag(obuf, "</b>", HTML_N_B); obuf->in_bold = 0; -@@ -6824,9 +7016,12 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf) +@@ -6824,9 +7026,12 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf) obuf->table_level = MAX_TABLE - 1; while (obuf->table_level >= 0) { @@ -15233,7 +15578,7 @@ index 567d41e..86af3a9 100644 } } -@@ -6848,6 +7043,8 @@ print_internal_information(struct html_feed_environ *henv) +@@ -6848,6 +7053,8 @@ print_internal_information(struct html_feed_environ *henv) if (form_max >= 0) { FormList *fp; for (i = 0; i <= form_max; i++) { @@ -15242,7 +15587,7 @@ index 567d41e..86af3a9 100644 fp = forms[i]; s = Sprintf("<form_int fid=\"%d\" action=\"%s\" method=\"%s\"", i, html_quote(fp->action->ptr), -@@ -6963,8 +7160,6 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal) +@@ -6963,8 +7170,6 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal) image_flag = IMG_FLAG_AUTO; else image_flag = IMG_FLAG_SKIP; @@ -15251,7 +15596,7 @@ index 567d41e..86af3a9 100644 #endif if (w3m_halfload) { -@@ -6987,6 +7182,9 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal) +@@ -6987,6 +7192,9 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal) htmlenv1.f = stdout; else htmlenv1.buf = newTextLineList(); @@ -15261,7 +15606,7 @@ index 567d41e..86af3a9 100644 if (SETJMP(AbortLoading) != 0) { HTMLlineproc1("<br>Transfer Interrupted!<br>", &htmlenv1); -@@ -7048,18 +7246,23 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal) +@@ -7048,18 +7256,23 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal) } #endif lineBuf2 = convertLine(f, lineBuf2, HTML_MODE, &charset, doc_charset); @@ -15287,7 +15632,7 @@ index 567d41e..86af3a9 100644 if (htmlenv1.title) newBuf->buffername = htmlenv1.title; if (w3m_halfdump) { -@@ -7096,16 +7299,17 @@ loadHTMLString(Str page) +@@ -7096,16 +7309,17 @@ loadHTMLString(Str page) MySignalHandler(*volatile prevtrap) (SIGNAL_ARG) = NULL; Buffer *newBuf; @@ -15307,7 +15652,7 @@ index 567d41e..86af3a9 100644 #ifdef USE_M17N newBuf->document_charset = InnerCharset; #endif -@@ -7115,6 +7319,7 @@ loadHTMLString(Str page) +@@ -7115,6 +7329,7 @@ loadHTMLString(Str page) #endif TRAP_OFF; @@ -15315,7 +15660,7 @@ index 567d41e..86af3a9 100644 newBuf->topLine = newBuf->firstLine; newBuf->lastLine = newBuf->currentLine; newBuf->currentLine = newBuf->firstLine; -@@ -7207,7 +7412,7 @@ loadGopherDir(URLFile *uf, ParsedURL *pu, wc_ces * charset) +@@ -7207,7 +7422,7 @@ loadGopherDir(URLFile *uf, ParsedURL *pu, wc_ces * charset) q = Strnew_m_charp("gopher://", host->ptr, ":", port->ptr, "/", file->ptr, NULL)->ptr; Strcat_m_charp(tmp, "<a href=\"", @@ -15324,7 +15669,7 @@ index 567d41e..86af3a9 100644 "\">", p, html_quote(name->ptr + 1), "</a>\n", NULL); } -@@ -7243,7 +7448,6 @@ loadBuffer(URLFile *uf, Buffer *volatile newBuf) +@@ -7243,7 +7458,6 @@ loadBuffer(URLFile *uf, Buffer *volatile newBuf) if (newBuf == NULL) newBuf = newBuffer(INIT_BUFFER_WIDTH); @@ -15332,7 +15677,7 @@ index 567d41e..86af3a9 100644 if (SETJMP(AbortLoading) != 0) { goto _end; -@@ -7331,6 +7535,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf) +@@ -7331,6 +7545,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf) URLFile f; MySignalHandler(*volatile prevtrap) (SIGNAL_ARG) = NULL; struct stat st; @@ -15340,7 +15685,7 @@ index 567d41e..86af3a9 100644 loadImage(newBuf, IMG_FLAG_STOP); image.url = uf->url; -@@ -7338,20 +7543,18 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf) +@@ -7338,20 +7553,18 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf) image.width = -1; image.height = -1; image.cache = NULL; @@ -15364,7 +15709,7 @@ index 567d41e..86af3a9 100644 TRAP_OFF; cache->loaded = IMG_FLAG_LOADED; -@@ -7371,6 +7574,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf) +@@ -7371,6 +7584,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf) init_stream(&f, SCM_LOCAL, newStrStream(tmp)); loadHTMLstream(&f, newBuf, src, TRUE); @@ -15372,7 +15717,7 @@ index 567d41e..86af3a9 100644 if (src) fclose(src); -@@ -7411,7 +7615,7 @@ conv_symbol(Line *l) +@@ -7411,7 +7625,7 @@ conv_symbol(Line *l) symbol = get_symbol(DisplayCharset, &w); #endif } @@ -15381,7 +15726,7 @@ index 567d41e..86af3a9 100644 #ifdef USE_M17N p += len - 1; pr += len - 1; -@@ -7580,8 +7784,11 @@ openGeneralPagerBuffer(InputStream stream) +@@ -7580,8 +7794,11 @@ openGeneralPagerBuffer(InputStream stream) #ifdef USE_M17N content_charset = 0; #endif @@ -15394,7 +15739,7 @@ index 567d41e..86af3a9 100644 readHeader(&uf, t_buf, TRUE, NULL); t = checkContentType(t_buf); if (t == NULL) -@@ -7609,14 +7816,13 @@ openGeneralPagerBuffer(InputStream stream) +@@ -7609,14 +7826,13 @@ openGeneralPagerBuffer(InputStream stream) #ifdef USE_IMAGE else if (activeImage && displayImage && !useExtImageViewer && !(w3m_dump & ~DUMP_FRAME) && !strncasecmp(t, "image/", 6)) { @@ -15411,7 +15756,7 @@ index 567d41e..86af3a9 100644 UFclose(&uf); if (buf == NULL || buf == NO_BUFFER) return buf; -@@ -7629,8 +7835,6 @@ openGeneralPagerBuffer(InputStream stream) +@@ -7629,8 +7845,6 @@ openGeneralPagerBuffer(InputStream stream) } } buf->real_type = t; @@ -15420,7 +15765,7 @@ index 567d41e..86af3a9 100644 return buf; } -@@ -7766,6 +7970,8 @@ save2tmp(URLFile uf, char *tmpf) +@@ -7766,6 +7980,8 @@ save2tmp(URLFile uf, char *tmpf) clen_t linelen = 0, trbyte = 0; MySignalHandler(*volatile prevtrap) (SIGNAL_ARG) = NULL; static JMP_BUF env_bak; @@ -15429,7 +15774,7 @@ index 567d41e..86af3a9 100644 ff = fopen(tmpf, "wb"); if (ff == NULL) { -@@ -7802,30 +8008,29 @@ save2tmp(URLFile uf, char *tmpf) +@@ -7802,30 +8018,29 @@ save2tmp(URLFile uf, char *tmpf) else #endif /* USE_NNTP */ { @@ -15472,7 +15817,7 @@ index 567d41e..86af3a9 100644 { Str tmpf, command; struct mailcap *mcap; -@@ -7834,7 +8039,7 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp, +@@ -7834,7 +8049,7 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp, char *header, *src = NULL, *ext = uf.ext; if (!(mcap = searchExtViewer(type))) @@ -15481,7 +15826,7 @@ index 567d41e..86af3a9 100644 if (mcap->nametemplate) { tmpf = unquote_mailcap(mcap->nametemplate, NULL, "", NULL, NULL); -@@ -7867,15 +8072,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp, +@@ -7867,15 +8082,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp, UFclose(&uf); myExec(command->ptr); } @@ -15499,7 +15844,7 @@ index 567d41e..86af3a9 100644 } } if (mcap->flags & (MAILCAP_HTMLOUTPUT | MAILCAP_COPIOUSOUTPUT)) { -@@ -7918,14 +8121,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp, +@@ -7918,14 +8131,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp, buf = NO_BUFFER; } if (buf && buf != NO_BUFFER) { @@ -15518,7 +15863,7 @@ index 567d41e..86af3a9 100644 } static int -@@ -7935,7 +8137,8 @@ _MoveFile(char *path1, char *path2) +@@ -7935,7 +8147,8 @@ _MoveFile(char *path1, char *path2) FILE *f2; int is_pipe; clen_t linelen = 0, trbyte = 0; @@ -15528,7 +15873,7 @@ index 567d41e..86af3a9 100644 f1 = openIS(path1); if (f1 == NULL) -@@ -7953,12 +8156,13 @@ _MoveFile(char *path1, char *path2) +@@ -7953,12 +8166,13 @@ _MoveFile(char *path1, char *path2) return -1; } current_content_length = 0; @@ -15546,7 +15891,7 @@ index 567d41e..86af3a9 100644 ISclose(f1); if (is_pipe) pclose(f2); -@@ -7998,7 +8202,7 @@ _doFileCopy(char *tmpf, char *defstr, int download) +@@ -7998,7 +8212,7 @@ _doFileCopy(char *tmpf, char *defstr, int download) else { if (q) { p = unescape_spaces(Strnew_charp(q))->ptr; @@ -15555,7 +15900,7 @@ index 567d41e..86af3a9 100644 } p = expandPath(p); if (checkOverWrite(p) < 0) -@@ -8317,21 +8521,23 @@ uncompress_stream(URLFile *uf, char **src) +@@ -8317,21 +8531,23 @@ uncompress_stream(URLFile *uf, char **src) } if (pid2 == 0) { /* child2 */ @@ -15584,7 +15929,7 @@ index 567d41e..86af3a9 100644 exit(0); } /* child1 */ -@@ -8378,7 +8584,7 @@ lessopen_stream(char *path) +@@ -8378,7 +8594,7 @@ lessopen_stream(char *path) } c = getc(fp); if (c == EOF) { @@ -15797,7 +16142,7 @@ index 8378939..96d3ab3 100644 global double image_scale init(100); #endif diff --git a/form.c b/form.c -index b7556ca..1aaaf19 100644 +index b7556ca..0605513 100644 --- a/form.c +++ b/form.c @@ -10,8 +10,10 @@ @@ -15835,7 +16180,17 @@ index b7556ca..1aaaf19 100644 } void -@@ -438,6 +442,9 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) +@@ -316,7 +320,8 @@ form_update_line(Line *line, char **str, int spos, int epos, int width, + pos += width - w; + + len = line->len + pos + spos - epos; +- buf = New_N(char, len); ++ buf = New_N(char, len + 1); ++ buf[len] = '\0'; + prop = New_N(Lineprop, len); + bcopy((void *)line->lineBuf, (void *)buf, spos * sizeof(char)); + bcopy((void *)line->propBuf, (void *)prop, spos * sizeof(Lineprop)); +@@ -438,6 +443,9 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) switch (form->type) { case FORM_INPUT_CHECKBOX: case FORM_INPUT_RADIO: @@ -15845,7 +16200,7 @@ index b7556ca..1aaaf19 100644 if (form->checked) buf->currentLine->lineBuf[spos] = '*'; else -@@ -455,8 +462,14 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) +@@ -455,8 +463,14 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) } else #endif /* MENU_SELECT */ @@ -15860,16 +16215,17 @@ index b7556ca..1aaaf19 100644 if (form->type == FORM_TEXTAREA) { int n = a->y - buf->currentLine->linenumber; if (n > 0) -@@ -477,6 +490,8 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) +@@ -477,6 +491,9 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form) spos = a->start.pos; epos = a->end.pos; } -+ if (a->start.line != a->end.line || spos > epos || epos >= l->len || spos < 0 || epos < 0) ++ if (a->start.line != a->end.line || spos > epos || epos >= l->len || ++ spos < 0 || epos < 0 || COLPOS(l, epos) < col) + break; pos = form_update_line(l, &p, spos, epos, COLPOS(l, epos) - col, rows > 1, form->type == FORM_INPUT_PASSWORD); -@@ -787,7 +802,7 @@ struct pre_form { +@@ -787,7 +804,7 @@ struct pre_form { static struct pre_form *PreForm = NULL; static struct pre_form * @@ -15878,7 +16234,7 @@ index b7556ca..1aaaf19 100644 { ParsedURL pu; struct pre_form *new; -@@ -796,21 +811,13 @@ add_pre_form(struct pre_form *prev, char *url, char *name, char *action) +@@ -796,21 +813,13 @@ add_pre_form(struct pre_form *prev, char *url, char *name, char *action) new = prev->next = New(struct pre_form); else new = PreForm = New(struct pre_form); @@ -15904,7 +16260,7 @@ index b7556ca..1aaaf19 100644 new->name = (name && *name) ? name : NULL; new->action = (action && *action) ? action : NULL; new->item = NULL; -@@ -834,7 +841,7 @@ add_pre_form_item(struct pre_form *pf, struct pre_form_item *prev, int type, +@@ -834,7 +843,7 @@ add_pre_form_item(struct pre_form *pf, struct pre_form_item *prev, int type, new->name = name; new->value = value; if (checked && *checked && (!strcmp(checked, "0") || @@ -15913,7 +16269,7 @@ index b7556ca..1aaaf19 100644 || !strcasecmp(checked, "no"))) new->checked = 0; else -@@ -875,6 +882,7 @@ loadPreForm(void) +@@ -875,6 +884,7 @@ loadPreForm(void) return; while (1) { char *p, *s, *arg; @@ -15921,7 +16277,7 @@ index b7556ca..1aaaf19 100644 line = Strfgets(fp); if (line->length == 0) -@@ -890,18 +898,20 @@ loadPreForm(void) +@@ -890,18 +900,20 @@ loadPreForm(void) if (*p == '#' || *p == '\0') continue; /* comment or empty line */ s = getWord(&p); @@ -15944,7 +16300,7 @@ index b7556ca..1aaaf19 100644 if (!strcmp(s, "form")) { if (!arg || !*arg) continue; -@@ -913,7 +923,7 @@ loadPreForm(void) +@@ -913,7 +925,7 @@ loadPreForm(void) } if (pf->item) { struct pre_form *prev = pf; @@ -16236,10 +16592,10 @@ index bca227e..d9f08e9 100644 {NULL, NULL, 0, 0}, /* 142 Undefined */ {NULL, NULL, 0, 0}, /* 143 Undefined */ diff --git a/html.h b/html.h -index 7abbd3b..c490655 100644 +index 7abbd3b..2a9a431 100644 --- a/html.h +++ b/html.h -@@ -1,20 +1,18 @@ +@@ -1,20 +1,20 @@ /* $Id: html.h,v 1.31 2010/08/14 01:29:40 htrb Exp $ */ #ifndef _HTML_H #define _HTML_H @@ -16251,7 +16607,8 @@ index 7abbd3b..c490655 100644 #endif /* USE_SSL */ -#include "istream.h" -- ++#include <time.h> + #define StrUFgets(f) StrISgets((f)->stream) #define StrmyUFgets(f) StrmyISgets((f)->stream) #define UFgetc(f) ISgetc((f)->stream) @@ -16262,7 +16619,7 @@ index 7abbd3b..c490655 100644 #define UFfileno(f) ISfileno((f)->stream) struct cmdtable { -@@ -62,11 +60,12 @@ typedef struct _ParsedURL { +@@ -62,11 +62,12 @@ typedef struct _ParsedURL { int is_nocache; } ParsedURL; @@ -16276,7 +16633,7 @@ index 7abbd3b..c490655 100644 char *ext; int compression; int content_encoding; -@@ -214,21 +213,22 @@ typedef struct { +@@ -214,21 +215,22 @@ typedef struct { #define HTML_BIG 122 #define HTML_N_BIG 123 #define HTML_BUTTON 124 @@ -18131,6 +18488,154 @@ index dfac6d9..bed5dff 100644 static wc_wchar_t ucs_cs94_conv(wc_ccs ccs, wc_uint16 c) { +diff --git a/libwc/wtf.c b/libwc/wtf.c +index b8cfdc7..94d95c1 100644 +--- a/libwc/wtf.c ++++ b/libwc/wtf.c +@@ -120,29 +120,36 @@ int + wtf_strwidth(wc_uchar *p) + { + int w = 0; ++ wc_uchar *q = p + strlen(p); + +- while (*p) { ++ while (p < q) { + w += wtf_width(p); + p += WTF_LEN_MAP[*p]; + } + return w; + } + +-/* + size_t + wtf_len1(wc_uchar *p) + { +- return (size_t)WTF_LEN_MAP[*p]; ++ size_t len, len_max = WTF_LEN_MAP[*p]; ++ ++ for (len = 0; *(p + len); len++) ++ if (len == len_max) ++ break; ++ if (len == 0) ++ len = 1; ++ return len; + } +-*/ + + size_t + wtf_len(wc_uchar *p) + { + wc_uchar *q = p; ++ wc_uchar *strz = p + strlen(p); + + q += WTF_LEN_MAP[*q]; +- while (*q && ! WTF_WIDTH_MAP[*q]) ++ while (q < strz && ! WTF_WIDTH_MAP[*q]) + q += WTF_LEN_MAP[*q]; + return q - p; + } +@@ -166,15 +173,17 @@ wtf_type(wc_uchar *p) + ((p)[3] = (((c) >> 7) & 0x7f) | 0x80), \ + ((p)[4] = ( (c) & 0x7f) | 0x80) + #define wtf_to_wcs16(p) \ ++ ((p)[0] == 0 || (p)[1] == 0 || (p)[2] == 0 ? 0 : \ + ((wc_uint32)((p)[0] & 0x03) << 14) \ + | ((wc_uint32)((p)[1] & 0x7f) << 7) \ +- | ((wc_uint32)((p)[2] & 0x7f) ) ++ | ((wc_uint32)((p)[2] & 0x7f) )) + #define wtf_to_wcs32(p) \ ++ ((p)[0] == 0 || (p)[1] == 0 || (p)[2] == 0 || (p)[3] == 0 || (p)[4] == 0 ? 0 : \ + ((wc_uint32)((p)[0] & 0x0f) << 28) \ + | ((wc_uint32)((p)[1] & 0x7f) << 21) \ + | ((wc_uint32)((p)[2] & 0x7f) << 14) \ + | ((wc_uint32)((p)[3] & 0x7f) << 7) \ +- | ((wc_uint32)((p)[4] & 0x7f) ) ++ | ((wc_uint32)((p)[4] & 0x7f) )) + + void + wtf_push(Str os, wc_ccs ccs, wc_uint32 code) +@@ -388,7 +397,7 @@ wtf_parse1(wc_uchar **p) + cc.code = *(q++); + } else if (*q > 0xa0) { + cc.ccs = wtf_gr_ccs; +- if (WC_CCS_IS_WIDE(cc.ccs)) { ++ if (WC_CCS_IS_WIDE(cc.ccs) && *(q+1)) { + cc.code = ((wc_uint32)*q << 8) | *(q+1); + q += 2; + } else +@@ -401,27 +410,47 @@ wtf_parse1(wc_uchar **p) + case WC_CCS_A_CS942: + case WC_CCS_A_PCS: + case WC_CCS_A_UNKNOWN: +- cc.ccs |= *(q++) & 0x7f; +- cc.code = *(q++); ++ if (*q && *(q+1)) { ++ cc.ccs |= *(q++) & 0x7f; ++ cc.code = *(q++); ++ } else { ++ cc.ccs = WC_CCS_US_ASCII; ++ cc.code = (wc_uint32)' '; ++ } + break; + case WC_CCS_A_CS94W: + case WC_CCS_A_CS96W: + case WC_CCS_A_PCSW: +- cc.ccs |= *(q++) & 0x7f; +- cc.code = ((wc_uint32)*q << 8) | *(q+1); +- q += 2; ++ if (*q && *(q+1) && *(q+2)) { ++ cc.ccs |= *(q++) & 0x7f; ++ cc.code = ((wc_uint32)*q << 8) | *(q+1); ++ q += 2; ++ } else { ++ cc.ccs = WC_CCS_US_ASCII; ++ cc.code = (wc_uint32)' '; ++ } + break; + case WC_CCS_A_WCS16: + case WC_CCS_A_WCS16W: +- cc.ccs |= (*q & 0x7c) >> 2; +- cc.code = wtf_to_wcs16(q); +- q += 3; ++ if (*q && *(q+1) && *(q+2)) { ++ cc.ccs |= (*q & 0x7c) >> 2; ++ cc.code = wtf_to_wcs16(q); ++ q += 3; ++ } else { ++ cc.ccs = WC_CCS_US_ASCII; ++ cc.code = (wc_uint32)' '; ++ } + break; + case WC_CCS_A_WCS32: + case WC_CCS_A_WCS32W: +- cc.ccs |= (*q & 0x70) >> 4; +- cc.code = wtf_to_wcs32(q); +- q += 5; ++ if (*q && *(q+1) && *(q+2) && *(q+3) && *(q+4)) { ++ cc.ccs |= (*q & 0x70) >> 4; ++ cc.code = wtf_to_wcs32(q); ++ q += 5; ++ } else { ++ cc.ccs = WC_CCS_US_ASCII; ++ cc.code = (wc_uint32)' '; ++ } + break; + default: + /* case 0: */ +diff --git a/libwc/wtf.h b/libwc/wtf.h +index ad47973..435526f 100644 +--- a/libwc/wtf.h ++++ b/libwc/wtf.h +@@ -59,8 +59,7 @@ extern void wtf_init(wc_ces ces1, wc_ces ces2); + #define wtf_width(p) (WcOption.use_wide ? (int)WTF_WIDTH_MAP[(wc_uchar)*(p)] \ + : ((int)WTF_WIDTH_MAP[(wc_uchar)*(p)] ? 1 : 0)) + extern int wtf_strwidth(wc_uchar *p); +-/* extern size_t wtf_len1(wc_uchar *p); */ +-#define wtf_len1(p) ((int)WTF_LEN_MAP[(wc_uchar)*(p)]) ++extern size_t wtf_len1(wc_uchar *p); + extern size_t wtf_len(wc_uchar *p); + /* extern int wtf_type(wc_uchar *p); */ + #define wtf_type(p) WTF_TYPE_MAP[(wc_uchar)*(p)] diff --git a/linein.c b/linein.c index b7e81b6..d8f9023 100644 --- a/linein.c @@ -20008,7 +20513,7 @@ index 64fd0ad..bc7a5be 100644 #define SWAPI(a,b) { int tmp = a; a = b; b = tmp; } diff --git a/menu.c b/menu.c -index 774b1bd..01acc31 100644 +index 774b1bd..b0c890d 100644 --- a/menu.c +++ b/menu.c @@ -57,6 +57,7 @@ static int mCancel(char c); @@ -20172,6 +20677,15 @@ index 774b1bd..01acc31 100644 Strcat_charp(str, p); break; } +@@ -1696,7 +1741,7 @@ initMenu(void) + FILE *mf; + MenuList *list; + +- w3mMenuList = New_N(MenuList, 3); ++ w3mMenuList = New_N(MenuList, 4); + w3mMenuList[0].id = "Main"; + w3mMenuList[0].menu = &MainMenu; + w3mMenuList[0].item = MainMenuItem; @@ -1845,10 +1890,8 @@ link_menu(Buffer *buf) Strcat_charp(str, " "); if (!l->url) @@ -26690,7 +27204,7 @@ index 50475ae..c047c56 100644 buf[i] = (*p == ' ') ? NBSP_CODE : *p; diff --git a/table.c b/table.c -index e1243ff..572ebd6 100644 +index e1243ff..221db92 100644 --- a/table.c +++ b/table.c @@ -188,7 +188,7 @@ dv2sv(double *dv, short *iv, int size) @@ -26728,6 +27242,24 @@ index e1243ff..572ebd6 100644 int alignment; TextLineListItem *ti; struct table *t = tbl->tables[id].ptr; +@@ -961,7 +960,7 @@ set_integered_width(struct table *t, double *dwidth, short *iwidth) + for (step = 0; step < 2; step++) { + for (i = 0; i <= t->maxcol; i += n) { + int nn; +- char *idx; ++ short *idx; + double nsum; + if (sum < 0.5) + return; +@@ -982,7 +981,7 @@ set_integered_width(struct table *t, double *dwidth, short *iwidth) + (double)rulewidth - mod[ii] > 0.5) + fixed[ii] = 1; + } +- idx = NewAtom_N(char, n); ++ idx = NewAtom_N(short, n); + for (k = 0; k < cell->maxcell; k++) { + int kk, w, width, m; + j = cell->index[k]; @@ -1624,6 +1623,15 @@ get_table_width(struct table *t, short *orgwidth, short *cellwidth, int flag) #define fixed_table_width(t)\ (get_table_width(t,t->fixed_width,t->cell.fixed_width,CHECK_MINIMUM)) @@ -26788,7 +27320,28 @@ index e1243ff..572ebd6 100644 setwidth(tbl, mode); feed_table_inline_tag(tbl, line, mode, -1); clearcontentssize(tbl, mode); -@@ -2600,12 +2620,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, +@@ -2546,8 +2566,10 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, + } + } + #ifdef ID_EXT +- if (parsedtag_get_value(tag, ATTR_ID, &p)) ++ if (parsedtag_get_value(tag, ATTR_ID, &p)) { ++ check_row(tbl, tbl->row); + tbl->tridvalue[tbl->row] = Strnew_charp(p); ++ } + #endif /* ID_EXT */ + tbl->trattr = align | valign; + break; +@@ -2572,7 +2594,7 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, + } + tbl->col++; + check_row(tbl, tbl->row); +- while (tbl->tabattr[tbl->row][tbl->col]) { ++ while (tbl->col < MAXCOL && tbl->tabattr[tbl->row][tbl->col]) { + tbl->col++; + } + if (tbl->col > MAXCOL - 1) { +@@ -2600,12 +2622,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, if ((tbl->row + rowspan) >= tbl->max_rowsize) check_row(tbl, tbl->row + rowspan); } @@ -26805,7 +27358,7 @@ index e1243ff..572ebd6 100644 if (parsedtag_get_value(tag, ATTR_ALIGN, &i)) { switch (i) { case ALIGN_LEFT: -@@ -2878,6 +2902,14 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, +@@ -2878,6 +2904,14 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, tmp = process_input(tag); feed_table1(tbl, tmp, mode, width); break; @@ -26820,7 +27373,7 @@ index e1243ff..572ebd6 100644 case HTML_SELECT: tmp = process_select(tag); if (tmp) -@@ -3010,7 +3042,6 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, +@@ -3010,7 +3044,6 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, break; case HTML_TABLE_ALT: id = -1; |