From 6f6b8ddb7f6ffddc1a361cde429dca546fefc50b Mon Sep 17 00:00:00 2001 From: Kuang-che Wu Date: Thu, 18 Aug 2016 19:35:41 +0900 Subject: Fix table rowspan and colspan Origin: https://github.com/tats/w3m/pull/19 Bug-Debian: https://github.com/tats/w3m/issues/8 [CVE-2016-9422] --- table.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/table.c b/table.c index d376284..deeab0a 100644 --- a/table.c +++ b/table.c @@ -2600,12 +2600,16 @@ feed_table_tag(struct table *tbl, char *line, struct table_mode *mode, if ((tbl->row + rowspan) >= tbl->max_rowsize) check_row(tbl, tbl->row + rowspan); } + if (rowspan < 1) + rowspan = 1; if (parsedtag_get_value(tag, ATTR_COLSPAN, &colspan)) { if ((tbl->col + colspan) >= MAXCOL) { /* Can't expand column */ colspan = MAXCOL - tbl->col; } } + if (colspan < 1) + colspan = 1; if (parsedtag_get_value(tag, ATTR_ALIGN, &i)) { switch (i) { case ALIGN_LEFT: -- cgit v1.2.3