aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2024-12-04 14:46:47 -05:00
Code

Bug 1001: fix uninitialized-pointer crash in URI rewriting

Browse Source 
(cherry picked from commit 6d2e034007)
This commit is contained in:
Kalle Olavi Niemitalo 2008-03-01 15:33:41 +02:00 committed by Kalle Olavi Niemitalo
parent ac48b3e4e6
commit 8b5de30f72
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -304,6 +304,8 @@ To be released as 0.11.4.
* critical bugs 613, 714, 961: ``assertion list_empty(form_controls) * critical bugs 613, 714, 961: ``assertion list_empty(form_controls)
failed'' failed''
* critical bug 945: don't crash if a Lua script calls e.g. error(nil) * critical bug 945: don't crash if a Lua script calls e.g. error(nil)
* critical bug 1001: don't crash if a smart URI rewrite template gets
too few parameters
* major bug 956: don't reuse pointers to SpiderMonkey objects that may * major bug 956: don't reuse pointers to SpiderMonkey objects that may
have been collected as garbage. This fix causes bug 954. have been collected as garbage. This fix causes bug 954.
* CVE-2007-2027: check if the program path contains "src/" before * CVE-2007-2027: check if the program path contains "src/" before

2
src/protocol/rewrite/rewrite.c
View File

@ -289,7 +289,7 @@ rewrite_uri(unsigned char *url, struct uri *current_uri, unsigned char *arg)
case '8': case '8':
case '9': case '9':
value = *url - '0'; value = *url - '0';
if (value > argc) break; if (value >= argc) break;
encode_uri_string(&n, args[value], encode_uri_string(&n, args[value],
argslen[value], 1); argslen[value], 1);
break; break;