From 59b91cd8e30c86f23476fa81ae005cabff49ebb6 Mon Sep 17 00:00:00 2001
From: Tatsuya Kinoshita <tats@debian.org>
Date: Tue, 9 Aug 2016 00:02:24 +0900
Subject: Prevent segfault with malformed input type

Bug-Debian: https://github.com/tats/w3m/issues/7
---
 file.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'file.c')

diff --git a/file.c b/file.c
index e26f383..7d76b6a 100644
--- a/file.c
+++ b/file.c
@@ -3639,9 +3639,10 @@ process_input(struct parsed_tag *tag)
 	    Strcat(tmp, getLinkNumberStr(0));
 	Strcat_char(tmp, '(');
     }
-    Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=%s "
+    Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=\"%s\" "
 			"name=\"%s\" width=%d maxlength=%d value=\"%s\"",
-			cur_hseq++, cur_form_id, p, html_quote(r), size, i, qq));
+			cur_hseq++, cur_form_id, html_quote(p),
+			html_quote(r), size, i, qq));
     if (x)
 	Strcat_charp(tmp, " checked");
     if (y)
@@ -3789,9 +3790,10 @@ process_button(struct parsed_tag *tag)
     }
 
     /*    Strcat_charp(tmp, "<pre_int>"); */
-    Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=%s "
+    Strcat(tmp, Sprintf("<input_alt hseq=\"%d\" fid=\"%d\" type=\"%s\" "
                        "name=\"%s\" value=\"%s\">",
-                       cur_hseq++, cur_form_id, p, html_quote(r), qq));
+                       cur_hseq++, cur_form_id, html_quote(p),
+                       html_quote(r), qq));
     return tmp;
 }
 
-- 
cgit v1.2.3