aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2024-12-04 14:46:47 -05:00
Code

Fix out-of-bound access to the quote_char buffer

Browse Source 
The quote_level was decremented unconditionally and could become negative
resulting in a negative index after applying "modulus 2". Reproducable
with an HTML file contianing "</q>".

Reported by paakku.
This commit is contained in:
Jonas Fonseca 2006-11-26 22:30:41 +01:00
parent 7e52d23d2f
commit 9d43babde2
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/document/html/parser/general.c
View File

@ -114,7 +114,12 @@ html_quote_close(struct html_context *html_context, unsigned char *a,
unsigned char *xxx3, unsigned char *xxx4, unsigned char *xxx3, unsigned char *xxx4,
unsigned char **xxx5) unsigned char **xxx5)
{ {
unsigned char *q = quote_char[--html_context->quote_level % 2]; unsigned char *q;
if (html_context->quote_level > 0)
html_context->quote_level--;
q = quote_char[html_context->quote_level % 2];
put_chrs(html_context, q, 1); put_chrs(html_context, q, 1);
} }