Subject: Prevent infinite recursion with nested table and textarea Author: Tatsuya Kinoshita <tats@debian.org> Bug-Debian: https://github.com/tats/w3m/issues/20 [CVE-2016-9439] Origin: https://anonscm.debian.org/cgit/collab-maint/w3m.git/commit/?id=2a4a2fb9f116b50e7c80d573db06c0fdc6c69272 diff --git a/file.c b/file.c index ac5247f..5be29e7 100644 --- a/file.c +++ b/file.c @@ -6413,6 +6413,7 @@ HTMLlineproc0(char *line, struct html_feed_environ *h_env, int internal) do_blankline(h_env, obuf, indent, 0, h_env->limit); } save_fonteffect(h_env, obuf); + initRenderTable(); renderTable(tbl, tbl_width, h_env); restore_fonteffect(h_env, obuf); obuf->flag &= ~RB_IGNORE_P; diff --git a/proto.h b/proto.h index 0d8beb5..d629e0d 100644 --- a/proto.h +++ b/proto.h @@ -393,6 +393,7 @@ extern void align(TextLine *lbuf, int width, int mode); extern void print_item(struct table *t, int row, int col, int width, Str buf); extern void print_sep(struct table *t, int row, int type, int maxcol, Str buf); extern void do_refill(struct table *tbl, int row, int col, int maxlimit); +extern void initRenderTable(void); extern void renderTable(struct table *t, int max_width, struct html_feed_environ *h_env); extern struct table *begin_table(int border, int spacing, int padding, diff --git a/table.c b/table.c index 022effe..8cd79e3 100644 --- a/table.c +++ b/table.c @@ -1624,6 +1624,15 @@ get_table_width(struct table *t, short *orgwidth, short *cellwidth, int flag) #define fixed_table_width(t)\ (get_table_width(t,t->fixed_width,t->cell.fixed_width,CHECK_MINIMUM)) +#define MAX_COTABLE_LEVEL 100 +static int cotable_level; + +void +initRenderTable(void) +{ + cotable_level = 0; +} + void renderCoTable(struct table *tbl, int maxlimit) { @@ -1634,6 +1643,10 @@ renderCoTable(struct table *tbl, int maxlimit) int i, col, row; int indent, maxwidth; + if (cotable_level >= MAX_COTABLE_LEVEL) + return; /* workaround to prevent infinite recursion */ + cotable_level++; + for (i = 0; i < tbl->ntable; i++) { t = tbl->tables[i].ptr; col = tbl->tables[i].col;