aboutsummaryrefslogtreecommitdiffstats
path: root/debian
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--debian/patches/020_debian.patch835
1 files changed, 694 insertions, 141 deletions
diff --git a/debian/patches/020_debian.patch b/debian/patches/020_debian.patch
index 900ef87..9d17218 100644
--- a/debian/patches/020_debian.patch
+++ b/debian/patches/020_debian.patch
@@ -60,10 +60,233 @@ index 8f443c1..5fb6581 100755
$input = "w3m-control: GOTO_LINK";
}
diff --git a/ChangeLog b/ChangeLog
-index 88358ef..90443aa 100644
+index 88358ef..5e77a18 100644
--- a/ChangeLog
+++ b/ChangeLog
-@@ -1,3 +1,1303 @@
+@@ -1,3 +1,1526 @@
++2017-01-02 Tatsuya Kinoshita <tats@debian.org>
++
++ * NEWS: Update NEWS.
++
++2016-12-24 Tatsuya Kinoshita <tats@debian.org>
++
++ * libwc/wtf.c:
++ Prevent overflow beyond the end of string in wtf_parse1().
++ Bug-Debian: https://github.com/tats/w3m/issues/68
++
++ * libwc/wtf.c:
++ Revert "Prevent overflow beyond the end of string in wtf_parse1()".
++ This reverts commit 998b6f91d4b02e8bf90b7744dfabc8cccdf9d4f9.
++ Bug-Debian: https://github.com/tats/w3m/issues/86
++ cf. http://emacs-w3m.namazu.org/ml/msg12505.html
++
++ * form.c:
++ Preserve one byte for end of string character in form_update_line().
++ Bug-Debian: https://github.com/tats/w3m/issues/68#issuecomment-266214643
++
++ * form.c:
++ Prevent invalid form_update_line() call in formUpdateBuffer().
++ Bug-Debian: https://github.com/tats/w3m/issues/82
++
++2016-12-20 Tatsuya Kinoshita <tats@debian.org>
++
++ * form.c:
++ Revert "Preserve one byte for end of string character in form_update_line()".
++ This reverts commit a4152aaaea5cb51c9018880a1295e498c38889bf.
++
++2016-12-18 Tatsuya Kinoshita <tats@debian.org>
++
++ * file.c: Prevent heap-use-after-free read in HTMLlineproc0().
++ Bug-Debian: https://github.com/tats/w3m/issues/81
++
++ * file.c: Prevent infinite loop in feed_textarea().
++ Bug-Debian: https://github.com/tats/w3m/issues/85
++
++ * form.c:
++ Revert "Prevent overflow beyond the end of string in form_update_line()".
++ This reverts commit 9ccaa1dd0dac6f9b35a649ae9901c225421500f6.
++
++ * form.c:
++ Revert "Prevent overflow beyond the end of string in form_update_line()".
++ This reverts commit e0efc127ff20cbeb931847af1c9b353056340fbd.
++
++2016-12-15 Tatsuya Kinoshita <tats@debian.org>
++
++ * libwc/wtf.c:
++ Prevent overflow beyond the end of string for wtf to wcs macros.
++ Bug-Debian: https://github.com/tats/w3m/issues/77
++
++ * libwc/wtf.c:
++ Revert "Prevent overflow beyond the end of string for wtf to wcs macros".
++ This reverts commit b4d27ba5ccffaa38e968c2bf3a8eeb9cd43928ff.
++
++ * file.c, libwc/wtf.c, libwc/wtf.h:
++ Prevent overflow beyond the end of string in caller of get_mclen().
++ Bug-Debian: https://github.com/tats/w3m/issues/59
++ Bug-Debian: https://github.com/tats/w3m/issues/73
++ Bug-Debian: https://github.com/tats/w3m/issues/74
++ Bug-Debian: https://github.com/tats/w3m/issues/75
++ Bug-Debian: https://github.com/tats/w3m/issues/76
++ Bug-Debian: https://github.com/tats/w3m/issues/78
++ Bug-Debian: https://github.com/tats/w3m/issues/79
++ Bug-Debian: https://github.com/tats/w3m/issues/80
++ Bug-Debian: https://github.com/tats/w3m/issues/83
++ Bug-Debian: https://github.com/tats/w3m/issues/84
++
++ * file.c:
++ Revert "Prevent overflow beyond the end of string in proc_mchar()".
++ This reverts commit 512ed467d12615f5ef40d0d28272e5662d8438ea.
++
++ * table.c:
++ Revert "Prevent overflow beyond the end of string in visible_length()".
++ This reverts commit a932f78a6d8c105036ffeedf01215c1f6a0e0b71.
++
++ * table.c:
++ Revert "Prevent overflow beyond the end of string in skip_space()".
++ This reverts commit e757b43bcf8c439c167f62b6d3317ee9518cabbf.
++
++ * table.c:
++ Revert "Prevent overflow beyond the end of string in visible_length_plain()".
++ This reverts commit f763b8ebf5441cb44d2c0234565fadd5eb1c87a5.
++
++ * form.c:
++ Revert "Prevent overflow beyond the end of string in textfieldrep()".
++ This reverts commit 77d8d8d6576d8afc0f6b2e09bb88c7ca9dba58bb.
++
++ * file.c:
++ Revert "Prevent overflow beyond the end of string in proc_mchar()".
++ This reverts commit e79d0ec2a00369a6af24007a1f2bb5e876e2c847.
++
++2016-12-13 Tatsuya Kinoshita <tats@debian.org>
++
++ * file.c: Prevent overflow beyond the end of string in proc_mchar().
++ Bug-Debian: https://github.com/tats/w3m/issues/80
++ cf. https://github.com/tats/w3m/issues/59
++
++ * form.c: Prevent overflow beyond the end of string in textfieldrep().
++ Bug-Debian: https://github.com/tats/w3m/issues/79
++
++ * form.c:
++ Preserve one byte for end of string character in form_update_line().
++ Bug-Debian: https://github.com/tats/w3m/issues/82
++ cf. https://github.com/tats/w3m/issues/68#issuecomment-266214643
++
++2016-12-10 Tatsuya Kinoshita <tats@debian.org>
++
++ * libwc/wtf.c: Prevent overflow beyond the end of string in wtf_len().
++ cf. https://github.com/tats/w3m/issues/57
++
++ * etc.c: Prevent negative array index for realColumn in calcPosition().
++ Bug-Debian: https://github.com/tats/w3m/issues/69
++
++ * libwc/wtf.c:
++ Prevent overflow beyond the end of string in wtf_parse1().
++ Bug-Debian: https://github.com/tats/w3m/issues/68
++
++ * Str.c: Prevent heap-buffer-overflow in Strnew_size().
++ Bug-Debian: https://github.com/tats/w3m/issues/72
++
++ * table.c:
++ Prevent overflow beyond the end of string in visible_length_plain().
++ Bug-Debian: https://github.com/tats/w3m/issues/76
++
++ * libwc/wtf.c:
++ Prevent overflow beyond the end of string for wtf to wcs macros.
++ Bug-Debian: https://github.com/tats/w3m/issues/77
++
++ * form.c:
++ Prevent overflow beyond the end of string in form_update_line().
++ Bug-Debian: https://github.com/tats/w3m/issues/78
++
++2016-12-08 Tatsuya Kinoshita <tats@debian.org>
++
++ * form.c:
++ Prevent overflow beyond the end of string in form_update_line().
++ Bug-Debian: https://github.com/tats/w3m/issues/75
++
++ * table.c: Prevent overflow beyond the end of string in skip_space().
++ Bug-Debian: https://github.com/tats/w3m/issues/74
++
++ * table.c:
++ Prevent overflow beyond the end of string in visible_length().
++ Bug-Debian: https://github.com/tats/w3m/issues/73
++
++ * libwc/wtf.c:
++ Prevent overflow beyond the end of string in wtf_strwidth().
++ Bug-Debian: https://github.com/tats/w3m/issues/57
++
++ * libwc/wtf.c:
++ Revert "Prevent overflow beyond the end of string in wtf_strwidth()".
++ This reverts commit d345c0950dfdef065b7377ecad0e4bc1d2601bf8.
++
++2016-12-07 Tatsuya Kinoshita <tats@debian.org>
++
++ * file.c: Prevent heap-use-after-free in HTMLlineproc0().
++ Bug-Debian: https://github.com/tats/w3m/issues/65
++
++ * file.c: Prevent negative values for offset and pos in push_link().
++ Bug-Debian: https://github.com/tats/w3m/issues/64
++
++ * file.c: Prevent overflow beyond the end of string in proc_mchar().
++ Bug-Debian: https://github.com/tats/w3m/issues/59
++
++ * libwc/wtf.c:
++ Prevent overflow beyond the end of string in wtf_strwidth().
++ Bug-Debian: https://github.com/tats/w3m/issues/57
++
++2016-12-05 Yixun Lan <dlan@gentoo.org>
++
++ * html.h: Explictily include <time.h> to avoid build err.
++ While disable ssl, we will got a undefine time_t err.
++ Bug-Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=601498
++ Origin: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8ee43ba4e036db70fff258f3edb2f0335385e93f
++
++2016-12-05 Tatsuya Kinoshita <tats@debian.org>
++
++ * table.c:
++ Prevent array index out of bounds for tridvalue in feed_table_tag().
++ Bug-Debian: https://github.com/tats/w3m/issues/71
++
++ * table.c: Prevent negative array index in set_integered_width().
++ Bug-Debian: https://github.com/tats/w3m/issues/70
++
++ * table.c:
++ Prevent array index out of bounds for tabattr in feed_table_tag().
++ Bug-Debian: https://github.com/tats/w3m/issues/60
++
++ * file.c: Prevent negative array index in process_textarea().
++ Bug-Debian: https://github.com/tats/w3m/issues/58
++
++ * file.c:
++ Prevent negative array index for marks in HTMLlineproc2body().
++ Bug-Debian: https://github.com/tats/w3m/issues/61
++
++ * file.c:
++ Prevent negative value of row for pushTable() in HTMLlineproc0().
++ Bug-Debian: https://github.com/tats/w3m/issues/67
++
++ * file.c: Prevent negative array index in getMetaRefreshParam().
++ Bug-Debian: https://github.com/tats/w3m/issues/63
++
++ * anchor.c:
++ Prevent negative array index for marks in shiftAnchorPosition().
++ Bug-Debian: https://github.com/tats/w3m/issues/62
++
++2016-11-27 Kuang-che Wu <kcwu@google.com>
++
++ * file.c: Fix uninitialized variable in process_img(). fix #44.
++ Bug-Debian: https://github.com/tats/w3m/issues/44
++ Origin: https://github.com/tats/w3m/pull/50/commits/41a607b06e4475101de59e5c623b9e5f76594a21
++
++ * menu.c: Fix menu buffer-overflow.
++ Origin: https://github.com/tats/w3m/pull/49/commits/7e1c05dd90cf42a308e854881ea3813aed000d2e
++
++2016-11-27 Tatsuya Kinoshita <tats@debian.org>
++
++ * ChangeLog, NEWS: Add CVE IDs.
++ cf. https://security-tracker.debian.org/tracker/source-package/w3m
++ http://www.openwall.com/lists/oss-security/2016/11/24/1
++
+2016-11-20 Tatsuya Kinoshita <tats@debian.org>
+
+ * NEWS: Update NEWS.
@@ -83,15 +306,15 @@ index 88358ef..90443aa 100644
+
+ * libwc/ucs.c, libwc/ucs.map:
+ Prevent global-buffer-overflow in wc_any_to_ucs().
-+ Bug-Debian: https://github.com/tats/w3m/issues/43
++ Bug-Debian: https://github.com/tats/w3m/issues/43 [CVE-2016-9632]
+
+2016-11-17 Tatsuya Kinoshita <tats@debian.org>
+
+ * url.c: Prevent global-buffer-overflow in parseURL().
-+ Bug-Debian: https://github.com/tats/w3m/issues/41
++ Bug-Debian: https://github.com/tats/w3m/issues/41 [CVE-2016-9630]
+
+ * file.c: Prevent deref null pointer in HTMLlineproc0().
-+ Bug-Debian: https://github.com/tats/w3m/issues/42
++ Bug-Debian: https://github.com/tats/w3m/issues/42 [CVE-2016-9631]
+
+2016-11-15 Tatsuya Kinoshita <tats@debian.org>
+
@@ -108,16 +331,16 @@ index 88358ef..90443aa 100644
+ This reverts commit f393faf55975a94217df479e1bd06ee4403c6958.
+
+ * anchor.c: Prevent deref null pointer in shiftAnchorPosition().
-+ Bug-Debian: https://github.com/tats/w3m/issues/40
++ Bug-Debian: https://github.com/tats/w3m/issues/40 [CVE-2016-9629]
+
+2016-11-14 Tatsuya Kinoshita <tats@debian.org>
+
+ * file.c: Prevent null pointer deref due to bad form id.
-+ Bug-Debian: https://github.com/tats/w3m/issues/39
++ Bug-Debian: https://github.com/tats/w3m/issues/39 [CVE-2016-9628]
+
+ * display.c, file.c, fm.h, symbol.c:
+ Prevent array index out of bounds for symbol.
-+ Bug-Debian: https://github.com/tats/w3m/issues/38
++ Bug-Debian: https://github.com/tats/w3m/issues/38 [CVE-2016-9627]
+
+2016-11-13 Tatsuya Kinoshita <tats@debian.org>
+
@@ -135,12 +358,12 @@ index 88358ef..90443aa 100644
+2016-11-09 Tatsuya Kinoshita <tats@debian.org>
+
+ * table.c: Check indent_level to prevent infinite recursion.
-+ Bug-Debian: https://github.com/tats/w3m/issues/37
++ Bug-Debian: https://github.com/tats/w3m/issues/37 [CVE-2016-9626]
+
+2016-11-07 Tatsuya Kinoshita <tats@debian.org>
+
+ * file.c: Prevent infinite recursion in HTMLlineproc0.
-+ Bug-Debian: https://github.com/tats/w3m/issues/36
++ Bug-Debian: https://github.com/tats/w3m/issues/36 [CVE-2016-9625]
+
+ * NEWS, w3m-doc/install.html.in:
+ Update documents for included w3mdict.cgi.
@@ -156,16 +379,16 @@ index 88358ef..90443aa 100644
+2016-11-07 Tatsuya Kinoshita <tats@debian.org>
+
+ * form.c: Prevent dereference near-null pointer in formUpdateBuffer.
-+ Bug-Debian: https://github.com/tats/w3m/issues/35
++ Bug-Debian: https://github.com/tats/w3m/issues/35 [CVE-2016-9624]
+
+ * file.c: Prevent crash after allocate string of negative size.
-+ Bug-Debian: https://github.com/tats/w3m/issues/33
++ Bug-Debian: https://github.com/tats/w3m/issues/33 [CVE-2016-9623]
+
+ * file.c: Prevent memory exhausted due to repeat appending "</table>".
-+ Bug-Debian: https://github.com/tats/w3m/issues/23
++ Bug-Debian: https://github.com/tats/w3m/issues/23 [CVE-2016-9633]
+
+ * file.c: Prevent null pointer dereference in HTMLlineproc2body.
-+ Bug-Debian: https://github.com/tats/w3m/issues/32
++ Bug-Debian: https://github.com/tats/w3m/issues/32 [CVE-2016-9622]
+
+2016-10-31 Tatsuya Kinoshita <tats@debian.org>
+
@@ -203,7 +426,7 @@ index 88358ef..90443aa 100644
+ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838952
+
+ * form.c: Prevent global-buffer-overflow write in formUpdateBuffer.
-+ Bug-Debian: https://github.com/tats/w3m/issues/29 [CVE-2016-9429]
++ Bug-Debian: https://github.com/tats/w3m/issues/29 [CVE-2016-9429] [CVE-2016-9621]
+
+ * form.c: Fix null pointer dereference in formUpdateBuffer.
+ Bug-Debian: https://github.com/tats/w3m/issues/28 [CVE-2016-9443]
@@ -1419,15 +1642,25 @@ index 7d692f9..453072d 100644
do \
(cd $$dir && $(MAKE) $(MAKE_ARGS) uninstall); \
diff --git a/NEWS b/NEWS
-index 66e309d..b80e8ed 100644
+index 66e309d..d8a99d3 100644
--- a/NEWS
+++ b/NEWS
-@@ -1,3 +1,55 @@
+@@ -1,3 +1,65 @@
++Debian's w3m 0.5.3+git20170102
++
++* bug fixes
++ - fix multiple flaws with malformed text
++ (buffer overflow, use after free, infinite loop)
++ - fix uninitialized variable when not USE_IMAGE
++
+Debian's w3m 0.5.3+git20161120
+
+* bug fixes
+ - fix multiple flaws with malformed text
+ (stack overflow, buffer overflow, null deref, out of memory)
++ [CVE-2016-9622], [CVE-2016-9623], [CVE-2016-9624], [CVE-2016-9625],
++ [CVE-2016-9626], [CVE-2016-9627], [CVE-2016-9628], [CVE-2016-9629],
++ [CVE-2016-9630], [CVE-2016-9631], [CVE-2016-9632], [CVE-2016-9633]
+ - fix stack overflow with nested table and textarea [CVE-2016-9439]
+ - fix suspend (^Z) behavior
+
@@ -1452,7 +1685,7 @@ index 66e309d..b80e8ed 100644
+ [CVE-2016-9426], [CVE-2016-9428], [CVE-2016-9429], [CVE-2016-9430],
+ [CVE-2016-9431], [CVE-2016-9432], [CVE-2016-9433], [CVE-2016-9434],
+ [CVE-2016-9435], [CVE-2016-9436], [CVE-2016-9437], [CVE-2016-9438],
-+ [CVE-2016-9440], [CVE-2016-9441], [CVE-2016-9443]
++ [CVE-2016-9440], [CVE-2016-9441], [CVE-2016-9443], [CVE-2016-9621]
+ - fix potential heap buffer corruption due to Strgrow [CVE-2016-9442]
+ - disable SSLv2 and SSLv3 by default [CVE-2014-3566]
+ - set ssl_verify_server to 1 by default
@@ -1493,10 +1726,19 @@ index 8778d80..765c996 100644
If you can read Japanese, see doc-jp/*.
If you can read both, read both and correct English. :-)
diff --git a/Str.c b/Str.c
-index e5a0982..d34129f 100644
+index e5a0982..61fe3ca 100644
--- a/Str.c
+++ b/Str.c
-@@ -56,7 +56,7 @@ Strnew_size(int n)
+@@ -48,6 +48,8 @@ Str
+ Strnew_size(int n)
+ {
+ Str x = GC_MALLOC(sizeof(struct _Str));
++ if (n < 0)
++ n = 0;
+ x->ptr = GC_MALLOC_ATOMIC(n + 1);
+ x->ptr[0] = '\0';
+ x->area_size = n + 1;
+@@ -56,7 +58,7 @@ Strnew_size(int n)
}
Str
@@ -1505,7 +1747,7 @@ index e5a0982..d34129f 100644
{
Str x;
int n;
-@@ -73,7 +73,7 @@ Strnew_charp(char *p)
+@@ -73,7 +75,7 @@ Strnew_charp(char *p)
}
Str
@@ -1514,7 +1756,7 @@ index e5a0982..d34129f 100644
{
va_list ap;
Str r = Strnew();
-@@ -87,7 +87,7 @@ Strnew_m_charp(char *p, ...)
+@@ -87,7 +89,7 @@ Strnew_m_charp(char *p, ...)
}
Str
@@ -1523,7 +1765,7 @@ index e5a0982..d34129f 100644
{
Str x;
-@@ -140,7 +140,7 @@ Strcopy(Str x, Str y)
+@@ -140,7 +142,7 @@ Strcopy(Str x, Str y)
}
void
@@ -1532,7 +1774,7 @@ index e5a0982..d34129f 100644
{
int len;
-@@ -160,7 +160,7 @@ Strcopy_charp(Str x, char *y)
+@@ -160,7 +162,7 @@ Strcopy_charp(Str x, char *y)
}
void
@@ -1541,7 +1783,7 @@ index e5a0982..d34129f 100644
{
int len = n;
-@@ -180,7 +180,7 @@ Strcopy_charp_n(Str x, char *y, int n)
+@@ -180,7 +182,7 @@ Strcopy_charp_n(Str x, char *y, int n)
}
void
@@ -1550,7 +1792,7 @@ index e5a0982..d34129f 100644
{
int newlen;
-@@ -209,7 +209,7 @@ Strcat(Str x, Str y)
+@@ -209,7 +211,7 @@ Strcat(Str x, Str y)
}
void
@@ -1559,7 +1801,7 @@ index e5a0982..d34129f 100644
{
if (y == NULL)
return;
-@@ -232,8 +232,8 @@ Strgrow(Str x)
+@@ -232,8 +234,8 @@ Strgrow(Str x)
{
char *old = x->ptr;
int newlen;
@@ -1570,7 +1812,7 @@ index e5a0982..d34129f 100644
newlen += 2;
x->ptr = GC_MALLOC_ATOMIC(newlen);
x->area_size = newlen;
-@@ -278,8 +278,8 @@ void
+@@ -278,8 +280,8 @@ void
Strchop(Str s)
{
STR_LENGTH_CHECK(s);
@@ -1581,7 +1823,7 @@ index e5a0982..d34129f 100644
s->length--;
}
s->ptr[s->length] = '\0';
-@@ -301,7 +301,7 @@ Strinsert_char(Str s, int pos, char c)
+@@ -301,7 +303,7 @@ Strinsert_char(Str s, int pos, char c)
}
void
@@ -1590,7 +1832,7 @@ index e5a0982..d34129f 100644
{
STR_LENGTH_CHECK(s);
while (*p)
-@@ -530,11 +530,8 @@ Str
+@@ -530,11 +532,8 @@ Str
Strfgets(FILE * f)
{
Str s = Strnew();
@@ -1604,7 +1846,7 @@ index e5a0982..d34129f 100644
Strcat_char(s, c);
if (c == '\n')
break;
-@@ -546,11 +543,8 @@ Str
+@@ -546,11 +545,8 @@ Str
Strfgetall(FILE * f)
{
Str s = Strnew();
@@ -1816,7 +2058,7 @@ index 0000000..fa0d391
+
+#endif /* W3_ALLOC_H */
diff --git a/anchor.c b/anchor.c
-index 27bbd56..10d6c1c 100644
+index 27bbd56..b6d121c 100644
--- a/anchor.c
+++ b/anchor.c
@@ -11,7 +11,7 @@ putAnchor(AnchorList *al, char *url, char *target, Anchor **anchor_return,
@@ -1858,16 +2100,17 @@ index 27bbd56..10d6c1c 100644
'\0', line, pos);
}
-@@ -549,7 +551,7 @@ shiftAnchorPosition(AnchorList *al, HmarkerList *hl, int line, int pos,
+@@ -549,7 +551,8 @@ shiftAnchorPosition(AnchorList *al, HmarkerList *hl, int line, int pos,
break;
if (a->start.pos > pos) {
a->start.pos += shift;
- if (hl->marks[a->hseq].line == line)
-+ if (hl && hl->marks && hl->marks[a->hseq].line == line)
++ if (hl && hl->marks &&
++ a->hseq >= 0 && hl->marks[a->hseq].line == line)
hl->marks[a->hseq].pos = a->start.pos;
}
if (a->end.pos >= pos)
-@@ -641,7 +643,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
+@@ -641,7 +644,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
{
int i, j, k, col, ecol, pos;
Anchor a_form, *a;
@@ -1875,7 +2118,7 @@ index 27bbd56..10d6c1c 100644
Line *l, *ls;
if (al == NULL || al->nanchor == 0)
-@@ -668,7 +669,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
+@@ -668,7 +670,6 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
if (!ls)
continue;
}
@@ -1883,7 +2126,7 @@ index 27bbd56..10d6c1c 100644
col = COLPOS(ls, a_form.start.pos);
ecol = COLPOS(ls, a_form.end.pos);
for (j = 0; l && j < a_form.rows; l = l->next, j++) {
-@@ -685,6 +685,8 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
+@@ -685,6 +686,8 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
a->hseq = a_form.hseq;
a->y = a_form.y;
a->end.pos = pos + ecol - col;
@@ -1892,7 +2135,7 @@ index 27bbd56..10d6c1c 100644
l->lineBuf[pos - 1] = '[';
l->lineBuf[a->end.pos] = ']';
for (k = pos; k < a->end.pos; k++)
-@@ -756,7 +758,7 @@ link_list_panel(Buffer *buf)
+@@ -756,7 +759,7 @@ link_list_panel(Buffer *buf)
p = parsedURL2Str(&pu)->ptr;
u = html_quote(p);
if (DecodeURL)
@@ -1901,7 +2144,7 @@ index 27bbd56..10d6c1c 100644
else
p = u;
}
-@@ -787,7 +789,7 @@ link_list_panel(Buffer *buf)
+@@ -787,7 +790,7 @@ link_list_panel(Buffer *buf)
p = parsedURL2Str(&pu)->ptr;
u = html_quote(p);
if (DecodeURL)
@@ -1910,7 +2153,7 @@ index 27bbd56..10d6c1c 100644
else
p = u;
t = getAnchorText(buf, al, a);
-@@ -809,16 +811,13 @@ link_list_panel(Buffer *buf)
+@@ -809,16 +812,13 @@ link_list_panel(Buffer *buf)
p = parsedURL2Str(&pu)->ptr;
u = html_quote(p);
if (DecodeURL)
@@ -1929,7 +2172,7 @@ index 27bbd56..10d6c1c 100644
Strcat_m_charp(tmp, "<li><a href=\"", u, "\">", t, "</a><br>", p,
"\n", NULL);
a = retrieveAnchor(buf->formitem, a->start.line, a->start.pos);
-@@ -842,19 +841,13 @@ link_list_panel(Buffer *buf)
+@@ -842,19 +842,13 @@ link_list_panel(Buffer *buf)
p = parsedURL2Str(&pu)->ptr;
u = html_quote(p);
if (DecodeURL)
@@ -14183,9 +14426,18 @@ index fdd8f64..45dc95e 100644
if (UseAltEntity)
return alt_latin1[c - 0xa0];
diff --git a/etc.c b/etc.c
-index 8fe1215..dcc6edd 100644
+index 8fe1215..37c4f15 100644
--- a/etc.c
+++ b/etc.c
+@@ -498,7 +498,7 @@ calcPosition(char *l, Lineprop *pr, int len, int pos, int bpos, int mode)
+ static char *prevl = NULL;
+ int i, j;
+
+- if (l == NULL || len == 0)
++ if (l == NULL || len == 0 || pos < 0)
+ return bpos;
+ if (l == prevl && mode == CP_AUTO) {
+ if (pos <= len)
@@ -1365,7 +1365,13 @@ setup_child(int child, int i, int f)
if (!child)
SETPGRP();
@@ -14201,7 +14453,7 @@ index 8fe1215..dcc6edd 100644
QuietMessage = TRUE;
fmInitialized = FALSE;
diff --git a/file.c b/file.c
-index 567d41e..86af3a9 100644
+index 567d41e..4d15ff1 100644
--- a/file.c
+++ b/file.c
@@ -26,6 +26,8 @@
@@ -14496,7 +14748,22 @@ index 567d41e..86af3a9 100644
TRAP_OFF;
return b;
}
-@@ -2469,6 +2455,7 @@ set_breakpoint(struct readbuffer *obuf, int tag_length)
+@@ -2325,8 +2311,12 @@ push_link(int cmd, int offset, int pos)
+ struct link_stack *p;
+ p = New(struct link_stack);
+ p->cmd = cmd;
+- p->offset = offset;
+- p->pos = pos;
++ p->offset = (short)offset;
++ if (p->offset < 0)
++ p->offset = 0;
++ p->pos = (short)pos;
++ if (p->pos < 0)
++ p->pos = 0;
+ p->next = link_stack;
+ link_stack = p;
+ }
+@@ -2469,6 +2459,7 @@ set_breakpoint(struct readbuffer *obuf, int tag_length)
bcopy((void *)&obuf->anchor, (void *)&obuf->bp.anchor,
sizeof(obuf->anchor));
obuf->bp.img_alt = obuf->img_alt;
@@ -14504,7 +14771,7 @@ index 567d41e..86af3a9 100644
obuf->bp.in_bold = obuf->in_bold;
obuf->bp.in_italic = obuf->in_italic;
obuf->bp.in_under = obuf->in_under;
-@@ -2486,6 +2473,7 @@ back_to_breakpoint(struct readbuffer *obuf)
+@@ -2486,6 +2477,7 @@ back_to_breakpoint(struct readbuffer *obuf)
bcopy((void *)&obuf->bp.anchor, (void *)&obuf->anchor,
sizeof(obuf->anchor));
obuf->img_alt = obuf->bp.img_alt;
@@ -14512,7 +14779,7 @@ index 567d41e..86af3a9 100644
obuf->in_bold = obuf->bp.in_bold;
obuf->in_italic = obuf->bp.in_italic;
obuf->in_under = obuf->bp.in_under;
-@@ -2729,7 +2717,7 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
+@@ -2729,7 +2721,7 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
Str line = obuf->line, pass = NULL;
char *hidden_anchor = NULL, *hidden_img = NULL, *hidden_bold = NULL,
*hidden_under = NULL, *hidden_italic = NULL, *hidden_strike = NULL,
@@ -14521,7 +14788,7 @@ index 567d41e..86af3a9 100644
#ifdef DEBUG
if (w3m_debug) {
-@@ -2761,6 +2749,12 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
+@@ -2761,6 +2753,12 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
hidden = hidden_img;
}
}
@@ -14534,7 +14801,7 @@ index 567d41e..86af3a9 100644
if (obuf->in_bold) {
if ((hidden_bold = has_hidden_link(obuf, HTML_B)) != NULL) {
if (!hidden || hidden_bold < hidden)
-@@ -2812,6 +2806,8 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
+@@ -2812,6 +2810,8 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
Strcat_charp(line, "</a>");
if (obuf->img_alt && !hidden_img)
Strcat_charp(line, "</img_alt>");
@@ -14543,7 +14810,7 @@ index 567d41e..86af3a9 100644
if (obuf->in_bold && !hidden_bold)
Strcat_charp(line, "</b>");
if (obuf->in_italic && !hidden_italic)
-@@ -3022,6 +3018,18 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
+@@ -3022,6 +3022,18 @@ flushline(struct html_feed_environ *h_env, struct readbuffer *obuf, int indent,
Strcat_charp(tmp, "\">");
push_tag(obuf, tmp->ptr, HTML_IMG_ALT);
}
@@ -14562,7 +14829,7 @@ index 567d41e..86af3a9 100644
if (!hidden_bold && obuf->in_bold)
push_tag(obuf, "<B>", HTML_B);
if (!hidden_italic && obuf->in_italic)
-@@ -3228,7 +3236,7 @@ process_img(struct parsed_tag *tag, int width)
+@@ -3228,7 +3240,7 @@ process_img(struct parsed_tag *tag, int width)
if (!parsedtag_get_value(tag, ATTR_SRC, &p))
return tmp;
@@ -14571,7 +14838,18 @@ index 567d41e..86af3a9 100644
q = NULL;
parsedtag_get_value(tag, ATTR_ALT, &q);
if (!pseudoInlines && (q == NULL || (*q == '\0' && ignore_null_img_alt)))
-@@ -3322,12 +3330,7 @@ process_img(struct parsed_tag *tag, int width)
+@@ -3255,9 +3267,9 @@ process_img(struct parsed_tag *tag, int width)
+ }
+ #endif
+ }
++ i = -1;
+ #ifdef USE_IMAGE
+ if (use_image) {
+- i = -1;
+ if (parsedtag_get_value(tag, ATTR_HEIGHT, &i)) {
+ if (i > 0) {
+ i = (int)(i * image_scale / 100 + 0.5);
+@@ -3322,12 +3334,7 @@ process_img(struct parsed_tag *tag, int width)
Image image;
ParsedURL u;
@@ -14584,7 +14862,7 @@ index 567d41e..86af3a9 100644
image.url = parsedURL2Str(&u)->ptr;
if (!uncompressed_file_type(u.file, &image.ext))
image.ext = filename_extension(u.file, TRUE);
-@@ -3346,8 +3349,14 @@ process_img(struct parsed_tag *tag, int width)
+@@ -3346,8 +3353,14 @@ process_img(struct parsed_tag *tag, int width)
if (i < 0)
i = pixel_per_line;
}
@@ -14601,7 +14879,7 @@ index 567d41e..86af3a9 100644
Strcat(tmp,
Sprintf("<pre_int><img_alt hseq=\"%d\" src=\"", cur_iseq++));
pre_int = TRUE;
-@@ -3378,19 +3387,21 @@ process_img(struct parsed_tag *tag, int width)
+@@ -3378,19 +3391,21 @@ process_img(struct parsed_tag *tag, int width)
if (i0 >= 0)
Strcat(tmp, Sprintf(" height=%d", i0));
switch (align) {
@@ -14631,7 +14909,7 @@ index 567d41e..86af3a9 100644
case ALIGN_BOTTOM:
top = ni - 1;
bottom = 0;
-@@ -3408,7 +3419,12 @@ process_img(struct parsed_tag *tag, int width)
+@@ -3408,7 +3423,12 @@ process_img(struct parsed_tag *tag, int width)
}
break;
}
@@ -14645,7 +14923,16 @@ index 567d41e..86af3a9 100644
if (xoffset)
Strcat(tmp, Sprintf(" xoffset=%d", xoffset));
if (yoffset)
-@@ -3548,7 +3564,7 @@ process_anchor(struct parsed_tag *tag, char *tagbuf)
+@@ -3435,7 +3455,7 @@ process_img(struct parsed_tag *tag, int width)
+ if (use_image) {
+ if (n > nw) {
+ char *r;
+- for (r = q, n = 0; r; r += get_mclen(r), n += get_mcwidth(r)) {
++ for (r = q, n = 0; *r; r += get_mclen(r), n += get_mcwidth(r)) {
+ if (n + get_mcwidth(r) > nw)
+ break;
+ }
+@@ -3548,7 +3568,7 @@ process_anchor(struct parsed_tag *tag, char *tagbuf)
Str
process_input(struct parsed_tag *tag)
{
@@ -14654,7 +14941,7 @@ index 567d41e..86af3a9 100644
char *q, *p, *r, *p2, *s;
Str tmp = NULL;
char *qq = "";
-@@ -3567,9 +3583,9 @@ process_input(struct parsed_tag *tag)
+@@ -3567,9 +3587,9 @@ process_input(struct parsed_tag *tag)
parsedtag_get_value(tag, ATTR_VALUE, &q);
r = "";
parsedtag_get_value(tag, ATTR_NAME, &r);
@@ -14667,7 +14954,7 @@ index 567d41e..86af3a9 100644
parsedtag_get_value(tag, ATTR_MAXLENGTH, &i);
p2 = NULL;
parsedtag_get_value(tag, ATTR_ALT, &p2);
-@@ -3623,9 +3639,10 @@ process_input(struct parsed_tag *tag)
+@@ -3623,9 +3643,10 @@ process_input(struct parsed_tag *tag)
Strcat(tmp, getLinkNumberStr(0));
Strcat_char(tmp, '(');
}
@@ -14680,7 +14967,7 @@ index 567d41e..86af3a9 100644
if (x)
Strcat_charp(tmp, " checked");
if (y)
-@@ -3670,18 +3687,18 @@ process_input(struct parsed_tag *tag)
+@@ -3670,18 +3691,18 @@ process_input(struct parsed_tag *tag)
case FORM_INPUT_PASSWORD:
i = 0;
if (q) {
@@ -14703,7 +14990,7 @@ index 567d41e..86af3a9 100644
Strcat_char(tmp, ' ');
}
break;
-@@ -3732,6 +3749,75 @@ process_input(struct parsed_tag *tag)
+@@ -3732,6 +3753,75 @@ process_input(struct parsed_tag *tag)
}
Str
@@ -14779,7 +15066,27 @@ index 567d41e..86af3a9 100644
process_select(struct parsed_tag *tag)
{
Str tmp = NULL;
-@@ -4084,6 +4170,7 @@ process_form_int(struct parsed_tag *tag, int fid)
+@@ -3926,7 +4016,7 @@ process_textarea(struct parsed_tag *tag, int width)
+ cur_textarea_size = 20;
+ if (parsedtag_get_value(tag, ATTR_COLS, &p)) {
+ cur_textarea_size = atoi(p);
+- if (p[strlen(p) - 1] == '%')
++ if (strlen(p) > 0 && p[strlen(p) - 1] == '%')
+ cur_textarea_size = width * cur_textarea_size / 100 - 2;
+ if (cur_textarea_size <= 0) {
+ cur_textarea_size = 20;
+@@ -4003,7 +4093,9 @@ feed_textarea(char *str)
+ Strcat_charp(textarea_str[n_textarea], "\r\n");
+ str++;
+ }
+- else if (*str != '\r')
++ else if (*str == '\r')
++ str++;
++ else
+ Strcat_char(textarea_str[n_textarea], *(str++));
+ }
+ }
+@@ -4084,6 +4176,7 @@ process_form_int(struct parsed_tag *tag, int fid)
parsedtag_get_value(tag, ATTR_METHOD, &p);
q = "!CURRENT_URL!";
parsedtag_get_value(tag, ATTR_ACTION, &q);
@@ -14787,7 +15094,7 @@ index 567d41e..86af3a9 100644
r = NULL;
#ifdef USE_M17N
if (parsedtag_get_value(tag, ATTR_ACCEPT_CHARSET, &r))
-@@ -4113,7 +4200,7 @@ process_form_int(struct parsed_tag *tag, int fid)
+@@ -4113,7 +4206,7 @@ process_form_int(struct parsed_tag *tag, int fid)
forms = New_N(FormList *, forms_size);
form_stack = NewAtom_N(int, forms_size);
}
@@ -14796,7 +15103,7 @@ index 567d41e..86af3a9 100644
forms_size += form_max;
forms = New_Reuse(FormList *, forms, forms_size);
form_stack = New_Reuse(int, form_stack, forms_size);
-@@ -4284,15 +4371,15 @@ getMetaRefreshParam(char *q, Str *refresh_uri)
+@@ -4284,15 +4377,16 @@ getMetaRefreshParam(char *q, Str *refresh_uri)
while (*q) {
if (!strncasecmp(q, "url=", 4)) {
q += 4;
@@ -14810,12 +15117,13 @@ index 567d41e..86af3a9 100644
- if (s_tmp->ptr[s_tmp->length - 1] == '\"') { /* "
- */
-+ if (s_tmp->ptr[s_tmp->length - 1] == '\"' /* " */
-+ || s_tmp->ptr[s_tmp->length - 1] == '\'') { /* ' */
++ if (s_tmp->length > 0 &&
++ (s_tmp->ptr[s_tmp->length - 1] == '\"' || /* " */
++ s_tmp->ptr[s_tmp->length - 1] == '\'')) { /* ' */
s_tmp->length--;
s_tmp->ptr[s_tmp->length] = '\0';
}
-@@ -4599,6 +4686,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -4599,6 +4693,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
case HTML_DD:
CLOSE_A;
CLOSE_DT;
@@ -14828,7 +15136,7 @@ index 567d41e..86af3a9 100644
if (envs[h_env->envc].env == HTML_DL_COMPACT) {
if (obuf->pos > envs[h_env->envc].indent)
flushline(h_env, obuf, envs[h_env->envc].indent, 0,
-@@ -4833,13 +4926,13 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -4833,13 +4933,13 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
#ifdef USE_IMAGE
i = 0;
if (parsedtag_get_value(tag, ATTR_TOP_MARGIN, &i)) {
@@ -14846,7 +15154,7 @@ index 567d41e..86af3a9 100644
}
#endif
return 0;
-@@ -4853,15 +4946,43 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -4853,15 +4953,43 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
case HTML_INPUT_ALT:
i = 0;
if (parsedtag_get_value(tag, ATTR_TOP_MARGIN, &i)) {
@@ -14864,10 +15172,10 @@ index 567d41e..86af3a9 100644
+ }
+ if (parsedtag_get_value(tag, ATTR_HSEQ, &hseq)) {
+ obuf->input_alt.hseq = hseq;
- }
++ }
+ if (parsedtag_get_value(tag, ATTR_FID, &i)) {
+ obuf->input_alt.fid = i;
-+ }
+ }
+ if (parsedtag_get_value(tag, ATTR_TYPE, &p)) {
+ obuf->input_alt.type = Strnew_charp(p);
+ }
@@ -14894,7 +15202,7 @@ index 567d41e..86af3a9 100644
case HTML_TABLE:
close_anchor(h_env, obuf);
obuf->table_level++;
-@@ -4884,6 +5005,8 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -4884,6 +5012,8 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
else
w = BORDER_THIN;
}
@@ -14903,7 +15211,7 @@ index 567d41e..86af3a9 100644
if (parsedtag_get_value(tag, ATTR_WIDTH, &i)) {
if (obuf->table_level == 0)
width = REAL_WIDTH(i, h_env->limit - envs[h_env->envc].indent);
-@@ -4892,9 +5015,24 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -4892,9 +5022,24 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
}
if (parsedtag_exists(tag, ATTR_HBORDER))
w = BORDER_NOWIN;
@@ -14928,7 +15236,7 @@ index 567d41e..86af3a9 100644
#ifdef ID_EXT
parsedtag_get_value(tag, ATTR_ID, &id);
#endif /* ID_EXT */
-@@ -4970,6 +5108,16 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -4970,6 +5115,16 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
case HTML_INPUT:
close_anchor(h_env, obuf);
tmp = process_input(tag);
@@ -14945,7 +15253,7 @@ index 567d41e..86af3a9 100644
if (tmp)
HTMLlineproc1(tmp->ptr, h_env);
return 1;
-@@ -5067,11 +5215,10 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
+@@ -5067,11 +5222,10 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
}
return 1;
case HTML_BASE:
@@ -14959,7 +15267,7 @@ index 567d41e..86af3a9 100644
parseURL(p, cur_baseURL, NULL);
}
#endif
-@@ -5329,6 +5476,13 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5329,6 +5483,13 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
#ifdef MENU_SELECT
Anchor **a_select = NULL;
#endif
@@ -14973,7 +15281,7 @@ index 567d41e..86af3a9 100644
if (out_size == 0) {
out_size = LINELEN;
-@@ -5523,16 +5677,17 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5523,16 +5684,17 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
hseq = 0;
id = NULL;
if (parsedtag_get_value(tag, ATTR_NAME, &id)) {
@@ -14995,7 +15303,16 @@ index 567d41e..86af3a9 100644
parsedtag_get_value(tag, ATTR_TITLE, &s);
parsedtag_get_value(tag, ATTR_ACCESSKEY, &t);
parsedtag_get_value(tag, ATTR_HSEQ, &hseq);
-@@ -5618,7 +5773,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5571,7 +5733,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+ a_href->end.pos = pos;
+ if (a_href->start.line == a_href->end.line &&
+ a_href->start.pos == a_href->end.pos) {
+- if (buf->hmarklist &&
++ if (buf->hmarklist && a_href->hseq >= 0 &&
+ a_href->hseq < buf->hmarklist->nmark)
+ buf->hmarklist->marks[a_href->hseq].invalid = 1;
+ a_href->hseq = -1;
+@@ -5618,7 +5780,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
ParsedURL u;
Image *image;
@@ -15004,7 +15321,7 @@ index 567d41e..86af3a9 100644
a_img->image = image = New(Image);
image->url = parsedURL2Str(&u)->ptr;
if (!uncompressed_file_type(u.file, &image->ext))
-@@ -5639,7 +5794,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5639,7 +5801,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
image->map = q;
image->ismap = ismap;
image->touch = 0;
@@ -15013,7 +15330,7 @@ index 567d41e..86af3a9 100644
IMG_FLAG_SKIP);
}
else if (iseq < 0) {
-@@ -5678,7 +5833,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5678,7 +5840,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
parsedtag_get_value(tag, ATTR_FID, &form_id);
parsedtag_get_value(tag, ATTR_TOP_MARGIN, &top);
parsedtag_get_value(tag, ATTR_BOTTOM_MARGIN, &bottom);
@@ -15023,7 +15340,7 @@ index 567d41e..86af3a9 100644
break; /* outside of <form>..</form> */
form = forms[form_id];
if (hseq > 0) {
-@@ -5689,6 +5845,21 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5689,6 +5852,21 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
putHmarker(buf->hmarklist, currentLn(buf),
hpos, hseq - 1);
}
@@ -15045,7 +15362,7 @@ index 567d41e..86af3a9 100644
if (!form->target)
form->target = buf->baseTarget;
if (a_textarea &&
-@@ -5761,8 +5932,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5761,8 +5939,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
break;
if (parsedtag_get_value(tag, ATTR_HREF, &p)) {
MapArea *a;
@@ -15056,7 +15373,7 @@ index 567d41e..86af3a9 100644
t = NULL;
parsedtag_get_value(tag, ATTR_TARGET, &t);
q = "";
-@@ -5811,11 +5982,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5811,11 +5989,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
break;
case HTML_BASE:
if (parsedtag_get_value(tag, ATTR_HREF, &p)) {
@@ -15073,7 +15390,7 @@ index 567d41e..86af3a9 100644
}
if (parsedtag_get_value(tag, ATTR_TARGET, &p))
buf->baseTarget =
-@@ -5830,8 +6004,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5830,8 +6011,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
int refresh_interval = getMetaRefreshParam(q, &tmp);
#ifdef USE_ALARM
if (tmp) {
@@ -15084,7 +15401,7 @@ index 567d41e..86af3a9 100644
buf->event = setAlarmEvent(buf->event,
refresh_interval,
AL_IMPLICIT_ONCE,
-@@ -5844,8 +6018,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5844,8 +6025,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
FUNCNAME_reload, NULL);
#else
if (tmp && refresh_interval == 0) {
@@ -15095,7 +15412,7 @@ index 567d41e..86af3a9 100644
pushEvent(FUNCNAME_gorURL, p);
}
#endif
-@@ -5864,14 +6038,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5864,14 +6045,14 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
case HTML_TEXTAREA_INT:
if (parsedtag_get_value(tag, ATTR_TEXTAREANUMBER,
&n_textarea)
@@ -15112,7 +15429,7 @@ index 567d41e..86af3a9 100644
FormItemList *item =
(FormItemList *)a_textarea[n_textarea]->url;
item->init_value = item->value =
-@@ -5881,7 +6055,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5881,7 +6062,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
#ifdef MENU_SELECT
case HTML_SELECT_INT:
if (parsedtag_get_value(tag, ATTR_SELECTNUMBER, &n_select)
@@ -15121,7 +15438,7 @@ index 567d41e..86af3a9 100644
select_option[n_select].first = NULL;
select_option[n_select].last = NULL;
}
-@@ -5889,7 +6063,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5889,7 +6070,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
n_select = -1;
break;
case HTML_N_SELECT_INT:
@@ -15130,7 +15447,7 @@ index 567d41e..86af3a9 100644
FormItemList *item =
(FormItemList *)a_select[n_select]->url;
item->select_option = select_option[n_select].first;
-@@ -5929,7 +6103,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5929,7 +6110,7 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
#ifdef ID_EXT
id = NULL;
if (parsedtag_get_value(tag, ATTR_ID, &id)) {
@@ -15139,7 +15456,7 @@ index 567d41e..86af3a9 100644
registerName(buf, id, currentLn(buf), pos);
}
if (renderFrameSet &&
-@@ -5964,7 +6138,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
+@@ -5964,7 +6145,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
fclose(debug);
#endif
for (form_id = 1; form_id <= form_max; form_id++)
@@ -15149,7 +15466,7 @@ index 567d41e..86af3a9 100644
buf->formlist = (form_max >= 0) ? forms[form_max] : NULL;
if (n_textarea)
addMultirowsForm(buf, buf->formitem);
-@@ -5982,7 +6157,8 @@ addLink(Buffer *buf, struct parsed_tag *tag)
+@@ -5982,7 +6164,8 @@ addLink(Buffer *buf, struct parsed_tag *tag)
parsedtag_get_value(tag, ATTR_HREF, &href);
if (href)
@@ -15159,7 +15476,7 @@ index 567d41e..86af3a9 100644
parsedtag_get_value(tag, ATTR_TITLE, &title);
parsedtag_get_value(tag, ATTR_TYPE, &ctype);
parsedtag_get_value(tag, ATTR_REL, &rel);
-@@ -6154,10 +6330,10 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
+@@ -6154,10 +6337,10 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
while (*line != '\0') {
char *str, *p;
int is_tag = FALSE;
@@ -15174,7 +15491,16 @@ index 567d41e..86af3a9 100644
if (*line == '<' || obuf->status != R_ST_NORMAL) {
/*
-@@ -6239,7 +6415,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
+@@ -6173,7 +6356,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
+ }
+ if (h_env->tagbuf->length == 0)
+ continue;
+- str = h_env->tagbuf->ptr;
++ str = Strdup(h_env->tagbuf)->ptr;
+ if (*str == '<') {
+ if (str[1] && REALLY_THE_BEGINNING_OF_A_TAG(str))
+ is_tag = TRUE;
+@@ -6239,7 +6422,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
}
proc_normal:
@@ -15183,7 +15509,16 @@ index 567d41e..86af3a9 100644
/*
* within table: in <table>..</table>, all input tokens
* are fed to the table renderer, and then the renderer
-@@ -6272,6 +6448,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
+@@ -6255,6 +6438,8 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
+ if (obuf->table_level >= 0) {
+ struct table *tbl0 = tables[obuf->table_level];
+ str = Sprintf("<table_alt tid=%d>", tbl0->ntable)->ptr;
++ if (tbl0->row < 0)
++ continue;
+ pushTable(tbl0, tbl);
+ tbl = tbl0;
+ tbl_mode = &table_mode[obuf->table_level];
+@@ -6272,6 +6457,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
do_blankline(h_env, obuf, indent, 0, h_env->limit);
}
save_fonteffect(h_env, obuf);
@@ -15191,7 +15526,17 @@ index 567d41e..86af3a9 100644
renderTable(tbl, tbl_width, h_env);
restore_fonteffect(h_env, obuf);
obuf->flag &= ~RB_IGNORE_P;
-@@ -6756,6 +6933,12 @@ init_henv(struct html_feed_environ *h_env, struct readbuffer *obuf,
+@@ -6429,7 +6615,8 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
+ indent = h_env->envs[h_env->envc].indent;
+ if (obuf->bp.pos - i > indent) {
+ Str line;
+- append_tags(obuf);
++ append_tags(obuf); /* may reallocate the buffer */
++ bp = obuf->line->ptr + obuf->bp.len;
+ line = Strnew_charp(bp);
+ Strshrink(obuf->line, obuf->line->length - obuf->bp.len);
+ #ifdef FORMAT_NICE
+@@ -6756,6 +6943,12 @@ init_henv(struct html_feed_environ *h_env, struct readbuffer *obuf,
obuf->nobr_level = 0;
bzero((void *)&obuf->anchor, sizeof(obuf->anchor));
obuf->img_alt = 0;
@@ -15204,7 +15549,7 @@ index 567d41e..86af3a9 100644
obuf->in_bold = 0;
obuf->in_italic = 0;
obuf->in_under = 0;
-@@ -6791,6 +6974,15 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf)
+@@ -6791,6 +6984,15 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf)
push_tag(obuf, "</img_alt>", HTML_N_IMG_ALT);
obuf->img_alt = NULL;
}
@@ -15220,7 +15565,7 @@ index 567d41e..86af3a9 100644
if (obuf->in_bold) {
push_tag(obuf, "</b>", HTML_N_B);
obuf->in_bold = 0;
-@@ -6824,9 +7016,12 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf)
+@@ -6824,9 +7026,12 @@ completeHTMLstream(struct html_feed_environ *h_env, struct readbuffer *obuf)
obuf->table_level = MAX_TABLE - 1;
while (obuf->table_level >= 0) {
@@ -15233,7 +15578,7 @@ index 567d41e..86af3a9 100644
}
}
-@@ -6848,6 +7043,8 @@ print_internal_information(struct html_feed_environ *henv)
+@@ -6848,6 +7053,8 @@ print_internal_information(struct html_feed_environ *henv)
if (form_max >= 0) {
FormList *fp;
for (i = 0; i <= form_max; i++) {
@@ -15242,7 +15587,7 @@ index 567d41e..86af3a9 100644
fp = forms[i];
s = Sprintf("<form_int fid=\"%d\" action=\"%s\" method=\"%s\"",
i, html_quote(fp->action->ptr),
-@@ -6963,8 +7160,6 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal)
+@@ -6963,8 +7170,6 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal)
image_flag = IMG_FLAG_AUTO;
else
image_flag = IMG_FLAG_SKIP;
@@ -15251,7 +15596,7 @@ index 567d41e..86af3a9 100644
#endif
if (w3m_halfload) {
-@@ -6987,6 +7182,9 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal)
+@@ -6987,6 +7192,9 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal)
htmlenv1.f = stdout;
else
htmlenv1.buf = newTextLineList();
@@ -15261,7 +15606,7 @@ index 567d41e..86af3a9 100644
if (SETJMP(AbortLoading) != 0) {
HTMLlineproc1("<br>Transfer Interrupted!<br>", &htmlenv1);
-@@ -7048,18 +7246,23 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal)
+@@ -7048,18 +7256,23 @@ loadHTMLstream(URLFile *f, Buffer *newBuf, FILE * src, int internal)
}
#endif
lineBuf2 = convertLine(f, lineBuf2, HTML_MODE, &charset, doc_charset);
@@ -15287,7 +15632,7 @@ index 567d41e..86af3a9 100644
if (htmlenv1.title)
newBuf->buffername = htmlenv1.title;
if (w3m_halfdump) {
-@@ -7096,16 +7299,17 @@ loadHTMLString(Str page)
+@@ -7096,16 +7309,17 @@ loadHTMLString(Str page)
MySignalHandler(*volatile prevtrap) (SIGNAL_ARG) = NULL;
Buffer *newBuf;
@@ -15307,7 +15652,7 @@ index 567d41e..86af3a9 100644
#ifdef USE_M17N
newBuf->document_charset = InnerCharset;
#endif
-@@ -7115,6 +7319,7 @@ loadHTMLString(Str page)
+@@ -7115,6 +7329,7 @@ loadHTMLString(Str page)
#endif
TRAP_OFF;
@@ -15315,7 +15660,7 @@ index 567d41e..86af3a9 100644
newBuf->topLine = newBuf->firstLine;
newBuf->lastLine = newBuf->currentLine;
newBuf->currentLine = newBuf->firstLine;
-@@ -7207,7 +7412,7 @@ loadGopherDir(URLFile *uf, ParsedURL *pu, wc_ces * charset)
+@@ -7207,7 +7422,7 @@ loadGopherDir(URLFile *uf, ParsedURL *pu, wc_ces * charset)
q = Strnew_m_charp("gopher://", host->ptr, ":", port->ptr,
"/", file->ptr, NULL)->ptr;
Strcat_m_charp(tmp, "<a href=\"",
@@ -15324,7 +15669,7 @@ index 567d41e..86af3a9 100644
"\">", p, html_quote(name->ptr + 1), "</a>\n", NULL);
}
-@@ -7243,7 +7448,6 @@ loadBuffer(URLFile *uf, Buffer *volatile newBuf)
+@@ -7243,7 +7458,6 @@ loadBuffer(URLFile *uf, Buffer *volatile newBuf)
if (newBuf == NULL)
newBuf = newBuffer(INIT_BUFFER_WIDTH);
@@ -15332,7 +15677,7 @@ index 567d41e..86af3a9 100644
if (SETJMP(AbortLoading) != 0) {
goto _end;
-@@ -7331,6 +7535,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf)
+@@ -7331,6 +7545,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf)
URLFile f;
MySignalHandler(*volatile prevtrap) (SIGNAL_ARG) = NULL;
struct stat st;
@@ -15340,7 +15685,7 @@ index 567d41e..86af3a9 100644
loadImage(newBuf, IMG_FLAG_STOP);
image.url = uf->url;
-@@ -7338,20 +7543,18 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf)
+@@ -7338,20 +7553,18 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf)
image.width = -1;
image.height = -1;
image.cache = NULL;
@@ -15364,7 +15709,7 @@ index 567d41e..86af3a9 100644
TRAP_OFF;
cache->loaded = IMG_FLAG_LOADED;
-@@ -7371,6 +7574,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf)
+@@ -7371,6 +7584,7 @@ loadImageBuffer(URLFile *uf, Buffer *newBuf)
init_stream(&f, SCM_LOCAL, newStrStream(tmp));
loadHTMLstream(&f, newBuf, src, TRUE);
@@ -15372,7 +15717,7 @@ index 567d41e..86af3a9 100644
if (src)
fclose(src);
-@@ -7411,7 +7615,7 @@ conv_symbol(Line *l)
+@@ -7411,7 +7625,7 @@ conv_symbol(Line *l)
symbol = get_symbol(DisplayCharset, &w);
#endif
}
@@ -15381,7 +15726,7 @@ index 567d41e..86af3a9 100644
#ifdef USE_M17N
p += len - 1;
pr += len - 1;
-@@ -7580,8 +7784,11 @@ openGeneralPagerBuffer(InputStream stream)
+@@ -7580,8 +7794,11 @@ openGeneralPagerBuffer(InputStream stream)
#ifdef USE_M17N
content_charset = 0;
#endif
@@ -15394,7 +15739,7 @@ index 567d41e..86af3a9 100644
readHeader(&uf, t_buf, TRUE, NULL);
t = checkContentType(t_buf);
if (t == NULL)
-@@ -7609,14 +7816,13 @@ openGeneralPagerBuffer(InputStream stream)
+@@ -7609,14 +7826,13 @@ openGeneralPagerBuffer(InputStream stream)
#ifdef USE_IMAGE
else if (activeImage && displayImage && !useExtImageViewer &&
!(w3m_dump & ~DUMP_FRAME) && !strncasecmp(t, "image/", 6)) {
@@ -15411,7 +15756,7 @@ index 567d41e..86af3a9 100644
UFclose(&uf);
if (buf == NULL || buf == NO_BUFFER)
return buf;
-@@ -7629,8 +7835,6 @@ openGeneralPagerBuffer(InputStream stream)
+@@ -7629,8 +7845,6 @@ openGeneralPagerBuffer(InputStream stream)
}
}
buf->real_type = t;
@@ -15420,7 +15765,7 @@ index 567d41e..86af3a9 100644
return buf;
}
-@@ -7766,6 +7970,8 @@ save2tmp(URLFile uf, char *tmpf)
+@@ -7766,6 +7980,8 @@ save2tmp(URLFile uf, char *tmpf)
clen_t linelen = 0, trbyte = 0;
MySignalHandler(*volatile prevtrap) (SIGNAL_ARG) = NULL;
static JMP_BUF env_bak;
@@ -15429,7 +15774,7 @@ index 567d41e..86af3a9 100644
ff = fopen(tmpf, "wb");
if (ff == NULL) {
-@@ -7802,30 +8008,29 @@ save2tmp(URLFile uf, char *tmpf)
+@@ -7802,30 +8018,29 @@ save2tmp(URLFile uf, char *tmpf)
else
#endif /* USE_NNTP */
{
@@ -15472,7 +15817,7 @@ index 567d41e..86af3a9 100644
{
Str tmpf, command;
struct mailcap *mcap;
-@@ -7834,7 +8039,7 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp,
+@@ -7834,7 +8049,7 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp,
char *header, *src = NULL, *ext = uf.ext;
if (!(mcap = searchExtViewer(type)))
@@ -15481,7 +15826,7 @@ index 567d41e..86af3a9 100644
if (mcap->nametemplate) {
tmpf = unquote_mailcap(mcap->nametemplate, NULL, "", NULL, NULL);
-@@ -7867,15 +8072,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp,
+@@ -7867,15 +8082,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp,
UFclose(&uf);
myExec(command->ptr);
}
@@ -15499,7 +15844,7 @@ index 567d41e..86af3a9 100644
}
}
if (mcap->flags & (MAILCAP_HTMLOUTPUT | MAILCAP_COPIOUSOUTPUT)) {
-@@ -7918,14 +8121,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp,
+@@ -7918,14 +8131,13 @@ doExternal(URLFile uf, char *path, char *type, Buffer **bufp,
buf = NO_BUFFER;
}
if (buf && buf != NO_BUFFER) {
@@ -15518,7 +15863,7 @@ index 567d41e..86af3a9 100644
}
static int
-@@ -7935,7 +8137,8 @@ _MoveFile(char *path1, char *path2)
+@@ -7935,7 +8147,8 @@ _MoveFile(char *path1, char *path2)
FILE *f2;
int is_pipe;
clen_t linelen = 0, trbyte = 0;
@@ -15528,7 +15873,7 @@ index 567d41e..86af3a9 100644
f1 = openIS(path1);
if (f1 == NULL)
-@@ -7953,12 +8156,13 @@ _MoveFile(char *path1, char *path2)
+@@ -7953,12 +8166,13 @@ _MoveFile(char *path1, char *path2)
return -1;
}
current_content_length = 0;
@@ -15546,7 +15891,7 @@ index 567d41e..86af3a9 100644
ISclose(f1);
if (is_pipe)
pclose(f2);
-@@ -7998,7 +8202,7 @@ _doFileCopy(char *tmpf, char *defstr, int download)
+@@ -7998,7 +8212,7 @@ _doFileCopy(char *tmpf, char *defstr, int download)
else {
if (q) {
p = unescape_spaces(Strnew_charp(q))->ptr;
@@ -15555,7 +15900,7 @@ index 567d41e..86af3a9 100644
}
p = expandPath(p);
if (checkOverWrite(p) < 0)
-@@ -8317,21 +8521,23 @@ uncompress_stream(URLFile *uf, char **src)
+@@ -8317,21 +8531,23 @@ uncompress_stream(URLFile *uf, char **src)
}
if (pid2 == 0) {
/* child2 */
@@ -15584,7 +15929,7 @@ index 567d41e..86af3a9 100644
exit(0);
}
/* child1 */
-@@ -8378,7 +8584,7 @@ lessopen_stream(char *path)
+@@ -8378,7 +8594,7 @@ lessopen_stream(char *path)
}
c = getc(fp);
if (c == EOF) {
@@ -15797,7 +16142,7 @@ index 8378939..96d3ab3 100644
global double image_scale init(100);
#endif
diff --git a/form.c b/form.c
-index b7556ca..1aaaf19 100644
+index b7556ca..0605513 100644
--- a/form.c
+++ b/form.c
@@ -10,8 +10,10 @@
@@ -15835,7 +16180,17 @@ index b7556ca..1aaaf19 100644
}
void
-@@ -438,6 +442,9 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
+@@ -316,7 +320,8 @@ form_update_line(Line *line, char **str, int spos, int epos, int width,
+ pos += width - w;
+
+ len = line->len + pos + spos - epos;
+- buf = New_N(char, len);
++ buf = New_N(char, len + 1);
++ buf[len] = '\0';
+ prop = New_N(Lineprop, len);
+ bcopy((void *)line->lineBuf, (void *)buf, spos * sizeof(char));
+ bcopy((void *)line->propBuf, (void *)prop, spos * sizeof(Lineprop));
+@@ -438,6 +443,9 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
switch (form->type) {
case FORM_INPUT_CHECKBOX:
case FORM_INPUT_RADIO:
@@ -15845,7 +16200,7 @@ index b7556ca..1aaaf19 100644
if (form->checked)
buf->currentLine->lineBuf[spos] = '*';
else
-@@ -455,8 +462,14 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
+@@ -455,8 +463,14 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
}
else
#endif /* MENU_SELECT */
@@ -15860,16 +16215,17 @@ index b7556ca..1aaaf19 100644
if (form->type == FORM_TEXTAREA) {
int n = a->y - buf->currentLine->linenumber;
if (n > 0)
-@@ -477,6 +490,8 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
+@@ -477,6 +491,9 @@ formUpdateBuffer(Anchor *a, Buffer *buf, FormItemList *form)
spos = a->start.pos;
epos = a->end.pos;
}
-+ if (a->start.line != a->end.line || spos > epos || epos >= l->len || spos < 0 || epos < 0)
++ if (a->start.line != a->end.line || spos > epos || epos >= l->len ||
++ spos < 0 || epos < 0 || COLPOS(l, epos) < col)
+ break;
pos = form_update_line(l, &p, spos, epos, COLPOS(l, epos) - col,
rows > 1,
form->type == FORM_INPUT_PASSWORD);
-@@ -787,7 +802,7 @@ struct pre_form {
+@@ -787,7 +804,7 @@ struct pre_form {
static struct pre_form *PreForm = NULL;
static struct pre_form *
@@ -15878,7 +16234,7 @@ index b7556ca..1aaaf19 100644
{
ParsedURL pu;
struct pre_form *new;
-@@ -796,21 +811,13 @@ add_pre_form(struct pre_form *prev, char *url, char *name, char *action)
+@@ -796,21 +813,13 @@ add_pre_form(struct pre_form *prev, char *url, char *name, char *action)
new = prev->next = New(struct pre_form);
else
new = PreForm = New(struct pre_form);
@@ -15904,7 +16260,7 @@ index b7556ca..1aaaf19 100644
new->name = (name && *name) ? name : NULL;
new->action = (action && *action) ? action : NULL;
new->item = NULL;
-@@ -834,7 +841,7 @@ add_pre_form_item(struct pre_form *pf, struct pre_form_item *prev, int type,
+@@ -834,7 +843,7 @@ add_pre_form_item(struct pre_form *pf, struct pre_form_item *prev, int type,
new->name = name;
new->value = value;
if (checked && *checked && (!strcmp(checked, "0") ||
@@ -15913,7 +16269,7 @@ index b7556ca..1aaaf19 100644
|| !strcasecmp(checked, "no")))
new->checked = 0;
else
-@@ -875,6 +882,7 @@ loadPreForm(void)
+@@ -875,6 +884,7 @@ loadPreForm(void)
return;
while (1) {
char *p, *s, *arg;
@@ -15921,7 +16277,7 @@ index b7556ca..1aaaf19 100644
line = Strfgets(fp);
if (line->length == 0)
-@@ -890,18 +898,20 @@ loadPreForm(void)
+@@ -890,18 +900,20 @@ loadPreForm(void)
if (*p == '#' || *p == '\0')
continue; /* comment or empty line */
s = getWord(&p);
@@ -15944,7 +16300,7 @@ index b7556ca..1aaaf19 100644
if (!strcmp(s, "form")) {
if (!arg || !*arg)
continue;
-@@ -913,7 +923,7 @@ loadPreForm(void)
+@@ -913,7 +925,7 @@ loadPreForm(void)
}
if (pf->item) {
struct pre_form *prev = pf;
@@ -16236,10 +16592,10 @@ index bca227e..d9f08e9 100644
{NULL, NULL, 0, 0}, /* 142 Undefined */
{NULL, NULL, 0, 0}, /* 143 Undefined */
diff --git a/html.h b/html.h
-index 7abbd3b..c490655 100644
+index 7abbd3b..2a9a431 100644
--- a/html.h
+++ b/html.h
-@@ -1,20 +1,18 @@
+@@ -1,20 +1,20 @@
/* $Id: html.h,v 1.31 2010/08/14 01:29:40 htrb Exp $ */
#ifndef _HTML_H
#define _HTML_H
@@ -16251,7 +16607,8 @@ index 7abbd3b..c490655 100644
#endif /* USE_SSL */
-#include "istream.h"
--
++#include <time.h>
+
#define StrUFgets(f) StrISgets((f)->stream)
#define StrmyUFgets(f) StrmyISgets((f)->stream)
#define UFgetc(f) ISgetc((f)->stream)
@@ -16262,7 +16619,7 @@ index 7abbd3b..c490655 100644
#define UFfileno(f) ISfileno((f)->stream)
struct cmdtable {
-@@ -62,11 +60,12 @@ typedef struct _ParsedURL {
+@@ -62,11 +62,12 @@ typedef struct _ParsedURL {
int is_nocache;
} ParsedURL;
@@ -16276,7 +16633,7 @@ index 7abbd3b..c490655 100644
char *ext;
int compression;
int content_encoding;
-@@ -214,21 +213,22 @@ typedef struct {
+@@ -214,21 +215,22 @@ typedef struct {
#define HTML_BIG 122
#define HTML_N_BIG 123
#define HTML_BUTTON 124
@@ -18131,6 +18488,154 @@ index dfac6d9..bed5dff 100644
static wc_wchar_t
ucs_cs94_conv(wc_ccs ccs, wc_uint16 c)
{
+diff --git a/libwc/wtf.c b/libwc/wtf.c
+index b8cfdc7..94d95c1 100644
+--- a/libwc/wtf.c
++++ b/libwc/wtf.c
+@@ -120,29 +120,36 @@ int
+ wtf_strwidth(wc_uchar *p)
+ {
+ int w = 0;
++ wc_uchar *q = p + strlen(p);
+
+- while (*p) {
++ while (p < q) {
+ w += wtf_width(p);
+ p += WTF_LEN_MAP[*p];
+ }
+ return w;
+ }
+
+-/*
+ size_t
+ wtf_len1(wc_uchar *p)
+ {
+- return (size_t)WTF_LEN_MAP[*p];
++ size_t len, len_max = WTF_LEN_MAP[*p];
++
++ for (len = 0; *(p + len); len++)
++ if (len == len_max)
++ break;
++ if (len == 0)
++ len = 1;
++ return len;
+ }
+-*/
+
+ size_t
+ wtf_len(wc_uchar *p)
+ {
+ wc_uchar *q = p;
++ wc_uchar *strz = p + strlen(p);
+
+ q += WTF_LEN_MAP[*q];
+- while (*q && ! WTF_WIDTH_MAP[*q])
++ while (q < strz && ! WTF_WIDTH_MAP[*q])
+ q += WTF_LEN_MAP[*q];
+ return q - p;
+ }
+@@ -166,15 +173,17 @@ wtf_type(wc_uchar *p)
+ ((p)[3] = (((c) >> 7) & 0x7f) | 0x80), \
+ ((p)[4] = ( (c) & 0x7f) | 0x80)
+ #define wtf_to_wcs16(p) \
++ ((p)[0] == 0 || (p)[1] == 0 || (p)[2] == 0 ? 0 : \
+ ((wc_uint32)((p)[0] & 0x03) << 14) \
+ | ((wc_uint32)((p)[1] & 0x7f) << 7) \
+- | ((wc_uint32)((p)[2] & 0x7f) )
++ | ((wc_uint32)((p)[2] & 0x7f) ))
+ #define wtf_to_wcs32(p) \
++ ((p)[0] == 0 || (p)[1] == 0 || (p)[2] == 0 || (p)[3] == 0 || (p)[4] == 0 ? 0 : \
+ ((wc_uint32)((p)[0] & 0x0f) << 28) \
+ | ((wc_uint32)((p)[1] & 0x7f) << 21) \
+ | ((wc_uint32)((p)[2] & 0x7f) << 14) \
+ | ((wc_uint32)((p)[3] & 0x7f) << 7) \
+- | ((wc_uint32)((p)[4] & 0x7f) )
++ | ((wc_uint32)((p)[4] & 0x7f) ))
+
+ void
+ wtf_push(Str os, wc_ccs ccs, wc_uint32 code)
+@@ -388,7 +397,7 @@ wtf_parse1(wc_uchar **p)
+ cc.code = *(q++);
+ } else if (*q > 0xa0) {
+ cc.ccs = wtf_gr_ccs;
+- if (WC_CCS_IS_WIDE(cc.ccs)) {
++ if (WC_CCS_IS_WIDE(cc.ccs) && *(q+1)) {
+ cc.code = ((wc_uint32)*q << 8) | *(q+1);
+ q += 2;
+ } else
+@@ -401,27 +410,47 @@ wtf_parse1(wc_uchar **p)
+ case WC_CCS_A_CS942:
+ case WC_CCS_A_PCS:
+ case WC_CCS_A_UNKNOWN:
+- cc.ccs |= *(q++) & 0x7f;
+- cc.code = *(q++);
++ if (*q && *(q+1)) {
++ cc.ccs |= *(q++) & 0x7f;
++ cc.code = *(q++);
++ } else {
++ cc.ccs = WC_CCS_US_ASCII;
++ cc.code = (wc_uint32)' ';
++ }
+ break;
+ case WC_CCS_A_CS94W:
+ case WC_CCS_A_CS96W:
+ case WC_CCS_A_PCSW:
+- cc.ccs |= *(q++) & 0x7f;
+- cc.code = ((wc_uint32)*q << 8) | *(q+1);
+- q += 2;
++ if (*q && *(q+1) && *(q+2)) {
++ cc.ccs |= *(q++) & 0x7f;
++ cc.code = ((wc_uint32)*q << 8) | *(q+1);
++ q += 2;
++ } else {
++ cc.ccs = WC_CCS_US_ASCII;
++ cc.code = (wc_uint32)' ';
++ }
+ break;
+ case WC_CCS_A_WCS16:
+ case WC_CCS_A_WCS16W:
+- cc.ccs |= (*q & 0x7c) >> 2;
+- cc.code = wtf_to_wcs16(q);
+- q += 3;
++ if (*q && *(q+1) && *(q+2)) {
++ cc.ccs |= (*q & 0x7c) >> 2;
++ cc.code = wtf_to_wcs16(q);
++ q += 3;
++ } else {
++ cc.ccs = WC_CCS_US_ASCII;
++ cc.code = (wc_uint32)' ';
++ }
+ break;
+ case WC_CCS_A_WCS32:
+ case WC_CCS_A_WCS32W:
+- cc.ccs |= (*q & 0x70) >> 4;
+- cc.code = wtf_to_wcs32(q);
+- q += 5;
++ if (*q && *(q+1) && *(q+2) && *(q+3) && *(q+4)) {
++ cc.ccs |= (*q & 0x70) >> 4;
++ cc.code = wtf_to_wcs32(q);
++ q += 5;
++ } else {
++ cc.ccs = WC_CCS_US_ASCII;
++ cc.code = (wc_uint32)' ';
++ }
+ break;
+ default:
+ /* case 0: */
+diff --git a/libwc/wtf.h b/libwc/wtf.h
+index ad47973..435526f 100644
+--- a/libwc/wtf.h
++++ b/libwc/wtf.h
+@@ -59,8 +59,7 @@ extern void wtf_init(wc_ces ces1, wc_ces ces2);
+ #define wtf_width(p) (WcOption.use_wide ? (int)WTF_WIDTH_MAP[(wc_uchar)*(p)] \
+ : ((int)WTF_WIDTH_MAP[(wc_uchar)*(p)] ? 1 : 0))
+ extern int wtf_strwidth(wc_uchar *p);
+-/* extern size_t wtf_len1(wc_uchar *p); */
+-#define wtf_len1(p) ((int)WTF_LEN_MAP[(wc_uchar)*(p)])
++extern size_t wtf_len1(wc_uchar *p);
+ extern size_t wtf_len(wc_uchar *p);
+ /* extern int wtf_type(wc_uchar *p); */
+ #define wtf_type(p) WTF_TYPE_MAP[(wc_uchar)*(p)]
diff --git a/linein.c b/linein.c
index b7e81b6..d8f9023 100644
--- a/linein.c
@@ -20008,7 +20513,7 @@ index 64fd0ad..bc7a5be 100644
#define SWAPI(a,b) { int tmp = a; a = b; b = tmp; }
diff --git a/menu.c b/menu.c
-index 774b1bd..01acc31 100644
+index 774b1bd..b0c890d 100644
--- a/menu.c
+++ b/menu.c
@@ -57,6 +57,7 @@ static int mCancel(char c);
@@ -20172,6 +20677,15 @@ index 774b1bd..01acc31 100644
Strcat_charp(str, p);
break;
}
+@@ -1696,7 +1741,7 @@ initMenu(void)
+ FILE *mf;
+ MenuList *list;
+
+- w3mMenuList = New_N(MenuList, 3);
++ w3mMenuList = New_N(MenuList, 4);
+ w3mMenuList[0].id = "Main";
+ w3mMenuList[0].menu = &MainMenu;
+ w3mMenuList[0].item = MainMenuItem;
@@ -1845,10 +1890,8 @@ link_menu(Buffer *buf)
Strcat_charp(str, " ");
if (!l->url)
@@ -26690,7 +27204,7 @@ index 50475ae..c047c56 100644
buf[i] = (*p == ' ') ? NBSP_CODE : *p;
diff --git a/table.c b/table.c
-index e1243ff..572ebd6 100644
+index e1243ff..221db92 100644
--- a/table.c
+++ b/table.c
@@ -188,7 +188,7 @@ dv2sv(double *dv, short *iv, int size)
@@ -26728,6 +27242,24 @@ index e1243ff..572ebd6 100644
int alignment;
TextLineListItem *ti;
struct table *t = tbl->tables[id].ptr;
+@@ -961,7 +960,7 @@ set_integered_width(struct table *t, double *dwidth, short *iwidth)
+ for (step = 0; step < 2; step++) {
+ for (i = 0; i <= t->maxcol; i += n) {
+ int nn;
+- char *idx;
++ short *idx;
+ double nsum;
+ if (sum < 0.5)
+ return;
+@@ -982,7 +981,7 @@ set_integered_width(struct table *t, double *dwidth, short *iwidth)
+ (double)rulewidth - mod[ii] > 0.5)
+ fixed[ii] = 1;
+ }
+- idx = NewAtom_N(char, n);
++ idx = NewAtom_N(short, n);
+ for (k = 0; k < cell->maxcell; k++) {
+ int kk, w, width, m;
+ j = cell->index[k];
@@ -1624,6 +1623,15 @@ get_table_width(struct table *t, short *orgwidth, short *cellwidth, int flag)
#define fixed_table_width(t)\
(get_table_width(t,t->fixed_width,t->cell.fixed_width,CHECK_MINIMUM))
@@ -26788,7 +27320,28 @@ index e1243ff..572ebd6 100644
setwidth(tbl, mode);
feed_table_inline_tag(tbl, line, mode, -1);
clearcontentssize(tbl, mode);
-@@ -2600,12 +2620,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
+@@ -2546,8 +2566,10 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
+ }
+ }
+ #ifdef ID_EXT
+- if (parsedtag_get_value(tag, ATTR_ID, &p))
++ if (parsedtag_get_value(tag, ATTR_ID, &p)) {
++ check_row(tbl, tbl->row);
+ tbl->tridvalue[tbl->row] = Strnew_charp(p);
++ }
+ #endif /* ID_EXT */
+ tbl->trattr = align | valign;
+ break;
+@@ -2572,7 +2594,7 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
+ }
+ tbl->col++;
+ check_row(tbl, tbl->row);
+- while (tbl->tabattr[tbl->row][tbl->col]) {
++ while (tbl->col < MAXCOL && tbl->tabattr[tbl->row][tbl->col]) {
+ tbl->col++;
+ }
+ if (tbl->col > MAXCOL - 1) {
+@@ -2600,12 +2622,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
if ((tbl->row + rowspan) >= tbl->max_rowsize)
check_row(tbl, tbl->row + rowspan);
}
@@ -26805,7 +27358,7 @@ index e1243ff..572ebd6 100644
if (parsedtag_get_value(tag, ATTR_ALIGN, &i)) {
switch (i) {
case ALIGN_LEFT:
-@@ -2878,6 +2902,14 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
+@@ -2878,6 +2904,14 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
tmp = process_input(tag);
feed_table1(tbl, tmp, mode, width);
break;
@@ -26820,7 +27373,7 @@ index e1243ff..572ebd6 100644
case HTML_SELECT:
tmp = process_select(tag);
if (tmp)
-@@ -3010,7 +3042,6 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
+@@ -3010,7 +3044,6 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode,
break;
case HTML_TABLE_ALT:
id = -1;
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-15 00:23:49 +0000