diff options
| -rw-r--r-- | file.c | 11 | ||||
| -rw-r--r-- | form.c | 3 | 
2 files changed, 12 insertions, 2 deletions
@@ -5021,6 +5021,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)  	parsedtag_get_value(tag, ATTR_CELLSPACING, &x);  	parsedtag_get_value(tag, ATTR_CELLPADDING, &y);  	parsedtag_get_value(tag, ATTR_VSPACE, &z); +	if (x < 0) +	    x = 0; +	if (y < 0) +	    y = 0; +	if (z < 0) +	    z = 0;  	if (x > MAX_CELLSPACING)  	    x = MAX_CELLSPACING;  	if (y > MAX_CELLPADDING) @@ -6056,7 +6062,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)  			n_select = -1;  		    break;  		case HTML_N_SELECT_INT: -		    if (n_select >= 0) { +		    if (a_select && n_select >= 0) {  			FormItemList *item =  			    (FormItemList *)a_select[n_select]->url;  			item->select_option = select_option[n_select].first; @@ -7008,9 +7014,12 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf)  	obuf->table_level = MAX_TABLE - 1;      while (obuf->table_level >= 0) { +	int tmp = obuf->table_level;  	table_mode[obuf->table_level].pre_mode  	    &= ~(TBLM_SCRIPT | TBLM_STYLE | TBLM_PLAIN);  	HTMLlineproc1("</table>", h_env); +	if (obuf->table_level >= tmp) +	    break;      }  } @@ -442,7 +442,8 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)      switch (form->type) {      case FORM_INPUT_CHECKBOX:      case FORM_INPUT_RADIO: -	if (spos >= buf->currentLine->len || spos < 0) +	if (buf->currentLine == NULL || +	    spos >= buf->currentLine->len || spos < 0)  	    break;  	if (form->checked)  	    buf->currentLine->lineBuf[spos] = '*';  | 
