From 4e464819dd360ffd3d58fa2a89216fe413cfcc74 Mon Sep 17 00:00:00 2001
From: Tatsuya Kinoshita <tats@debian.org>
Date: Mon, 29 Aug 2016 19:28:41 +0900
Subject: Prevent segfault due to buffer overflows in addMultirowsForm

Bug-Debian: https://github.com/tats/w3m/issues/21
Bug-Debian: https://github.com/tats/w3m/issues/26
---
 anchor.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'anchor.c')

diff --git a/anchor.c b/anchor.c
index 2d21bfa..fa8d3eb 100644
--- a/anchor.c
+++ b/anchor.c
@@ -685,6 +685,8 @@ addMultirowsForm(Buffer *buf, AnchorList *al)
 	    a->hseq = a_form.hseq;
 	    a->y = a_form.y;
 	    a->end.pos = pos + ecol - col;
+	    if (pos < 1 || a->end.pos >= l->size)
+		continue;
 	    l->lineBuf[pos - 1] = '[';
 	    l->lineBuf[a->end.pos] = ']';
 	    for (k = pos; k < a->end.pos; k++)
-- 
cgit v1.2.3