From 3d4eeda9ec0cb91e23bab7dc260d4c515119eb4b Mon Sep 17 00:00:00 2001 From: Tatsuya Kinoshita Date: Wed, 17 Aug 2016 22:34:40 +0900 Subject: Prevent segfault with incorrect form_int fid Bug-Debian: https://github.com/tats/w3m/issues/15 --- file.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/file.c b/file.c index 1e902a8..265315f 100644 --- a/file.c +++ b/file.c @@ -4189,7 +4189,7 @@ process_form_int(struct parsed_tag *tag, int fid) forms = New_N(FormList *, forms_size); form_stack = NewAtom_N(int, forms_size); } - else if (forms_size <= form_max) { + if (forms_size <= form_max) { forms_size += form_max; forms = New_Reuse(FormList *, forms, forms_size); form_stack = New_Reuse(int, form_stack, forms_size); @@ -6114,7 +6114,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit) fclose(debug); #endif for (form_id = 1; form_id <= form_max; form_id++) - forms[form_id]->next = forms[form_id - 1]; + if (forms[form_id]) + forms[form_id]->next = forms[form_id - 1]; buf->formlist = (form_max >= 0) ? forms[form_max] : NULL; if (n_textarea) addMultirowsForm(buf, buf->formitem); -- cgit v1.2.3