Prevent crash after allocate string of negative size

Bug-Debian: https://github.com/tats/w3m/issues/33
2016-11-07 19:02:42 +09:00
parent 216722ed72
commit af592aa5f1
1 changed files with 6 additions and 0 deletions
@@ -5021,6 +5021,12 @@ HTMLtagproc1(struct parsed_tag *tag, struct html_feed_environ *h_env)
 	parsedtag_get_value(tag, ATTR_CELLSPACING, &x);
 	parsedtag_get_value(tag, ATTR_CELLPADDING, &y);
 	parsedtag_get_value(tag, ATTR_VSPACE, &z);
+	if (x < 0)
+	    x = 0;
+	if (y < 0)
+	    y = 0;
+	if (z < 0)
+	    z = 0;
 	if (x > MAX_CELLSPACING)
 	    x = MAX_CELLSPACING;
 	if (y > MAX_CELLPADDING)