From 63e5fe1fc4a875e89942c0ebe068e717381cc78f Mon Sep 17 00:00:00 2001
From: Tatsuya Kinoshita <tats@debian.org>
Date: Wed, 24 Aug 2016 19:05:39 +0900
Subject: Prevent segfault with malformed table_alt

Bug-Debian: https://github.com/tats/w3m/issues/24 [CVE-2016-9441]
Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=a6257663824c63abb3c62c4dd62455fe6f63d958
---
 table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/table.c b/table.c
index a54ea01..022effe 100644
--- a/table.c
+++ b/table.c
@@ -761,7 +761,7 @@ do_refill(struct table *tbl, int row, int col, int maxlimit)
 	    struct parsed_tag *tag;
 	    if ((tag = parse_tag(&p, TRUE)) != NULL)
 		parsedtag_get_value(tag, ATTR_TID, &id);
-	    if (id >= 0 && id < tbl->ntable) {
+	    if (id >= 0 && id < tbl->ntable && tbl->tables[id].ptr) {
 		int alignment;
 		TextLineListItem *ti;
 		struct table *t = tbl->tables[id].ptr;
-- 
cgit v1.2.3