From 9db438094e5f0d84842bcbd248f282594ccb3c89 Mon Sep 17 00:00:00 2001
From: Tatsuya Kinoshita <tats@debian.org>
Date: Mon, 14 Nov 2016 21:16:45 +0900
Subject: Prevent null pointer deref due to bad form id

Bug-Debian: https://github.com/tats/w3m/issues/39
---
 file.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'file.c')

diff --git a/file.c b/file.c
index bcb5916..d484451 100644
--- a/file.c
+++ b/file.c
@@ -5833,7 +5833,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
 			parsedtag_get_value(tag, ATTR_FID, &form_id);
 			parsedtag_get_value(tag, ATTR_TOP_MARGIN, &top);
 			parsedtag_get_value(tag, ATTR_BOTTOM_MARGIN, &bottom);
-			if (form_id < 0 || form_id > form_max || forms == NULL)
+			if (form_id < 0 || form_id > form_max ||
+			    forms == NULL || forms[form_id] == NULL)
 			    break;	/* outside of <form>..</form> */
 			form = forms[form_id];
 			if (hseq > 0) {
@@ -7041,6 +7042,8 @@ print_internal_information(struct html_feed_environ *henv)
     if (form_max >= 0) {
 	FormList *fp;
 	for (i = 0; i <= form_max; i++) {
+	    if (forms[i] == NULL)
+		continue;
 	    fp = forms[i];
 	    s = Sprintf("<form_int fid=\"%d\" action=\"%s\" method=\"%s\"",
 			i, html_quote(fp->action->ptr),
-- 
cgit v1.2.3