From 77d8d8d6576d8afc0f6b2e09bb88c7ca9dba58bb Mon Sep 17 00:00:00 2001
From: Tatsuya Kinoshita <tats@debian.org>
Date: Tue, 13 Dec 2016 22:24:54 +0900
Subject: Prevent overflow beyond the end of string in textfieldrep()

Bug-Debian: https://github.com/tats/w3m/issues/79
---
 form.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'form.c')

diff --git a/form.c b/form.c
index fdad786..9c40b44 100644
--- a/form.c
+++ b/form.c
@@ -526,6 +526,8 @@ textfieldrep(Str s, int width)
     for (i = 0; i < s->length; i += c_len) {
 	c_type = get_mctype((unsigned char *)&s->ptr[i]);
 	c_len = get_mclen(&s->ptr[i]);
+	if (i + c_len > s->length)
+	    break;
 	if (s->ptr[i] == '\r')
 	    continue;
 	k = j + get_mcwidth(&s->ptr[i]);
-- 
cgit v1.2.3