storm/w3m
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix possible buffer overrun

Browse Source
This commit is contained in:
Fumitoshi UKAI
2001-11-20 13:17:13 +00:00
parent 506129bead
commit 05809b3647
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@@ -1,3 +1,7 @@
2001-11-20 Kiyokazu SUTO <suto@ks-and-ks.ne.jp>
* frame.c (newFrameSet): fix possible buffer overrun
2001-11-20 Fumitoshi UKAI <ukai@debian.or.jp> 2001-11-20 Fumitoshi UKAI <ukai@debian.or.jp>
* XXMakefile config.h: removed from CVS * XXMakefile config.h: removed from CVS

10
frame.c
View File

@@ -1,4 +1,4 @@
/* $Id: frame.c,v 1.4 2001/11/16 22:02:00 ukai Exp $ */ /* $Id: frame.c,v 1.5 2001/11/20 13:17:13 ukai Exp $ */
#include "fm.h" #include "fm.h"
#include "parsetagx.h" #include "parsetagx.h"
#include "myctype.h" #include "myctype.h"
@@ -38,8 +38,10 @@ newFrameSet(struct parsed_tag *tag)
if (cols) { if (cols) {
length[i] = p = cols; length[i] = p = cols;
while (*p != '\0') while (*p != '\0')
if (*p++ == ',') if (*p++ == ',') {
length[++i] = p; length[++i] = p;
if (i >= sizeof(length) / sizeof(length[0]) - 2) break;
}
length[++i] = p + 1; length[++i] = p + 1;
} }
if (i > 1) { if (i > 1) {
@@ -74,8 +76,10 @@ newFrameSet(struct parsed_tag *tag)
if (rows) { if (rows) {
length[i] = p = rows; length[i] = p = rows;
while (*p != '\0') while (*p != '\0')
if (*p++ == ',') if (*p++ == ',') {
length[++i] = p; length[++i] = p;
if (i >= sizeof(length) / sizeof(length[0]) - 2) break;
}
length[++i] = p + 1; length[++i] = p + 1;
} }
if (i > 1) { if (i > 1) {