From aa2077e06fc11f65ba1773e8f5da83d98057e829 Mon Sep 17 00:00:00 2001
From: Tatsuya Kinoshita <tats@debian.org>
Date: Sun, 18 Dec 2016 01:20:14 +0900
Subject: Prevent heap-use-after-free read in HTMLlineproc0()

Bug-Debian: https://github.com/tats/w3m/issues/81
---
 file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'file.c')

diff --git a/file.c b/file.c
index 97287ab..4d15ff1 100644
--- a/file.c
+++ b/file.c
@@ -6356,7 +6356,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal)
 	    }
 	    if (h_env->tagbuf->length == 0)
 		continue;
-	    str = h_env->tagbuf->ptr;
+	    str = Strdup(h_env->tagbuf)->ptr;
 	    if (*str == '<') {
 		if (str[1] && REALLY_THE_BEGINNING_OF_A_TAG(str))
 		    is_tag = TRUE;
-- 
cgit v1.2.3