1
0
mirror of https://github.com/rkd77/elinks.git synced 2024-06-17 23:55:32 +00:00
Commit Graph

2 Commits

Author SHA1 Message Date
Kalle Olavi Niemitalo
29c34df62e Fix assertion failure if IMG/@usemap refers to a different file.
Change test/imgmap2.html so it can be used for testing this too.

Debian Iceweasel 3.0.4 does not appear to support such external
client-side image maps.  Well, that's one place where ELinks is
superior, I guess.  There might be a security problem though if ELinks
were to let scripts of the referring page examine the links in the
image map.
2009-01-01 19:12:41 +00:00
Kalle Olavi Niemitalo
25da8085b3 Fix double-free crash if EOF immediately follows </MAP>.
look_for_link() used to return 0 both when it found the closing </MAP>
tag, and when it hit the end of the file.  In the first case, it also
added *menu to the memory_list; in the second case, it did not.  The
caller get_image_map() supposedly distinguished between these cases by
checking whether pos >= eof, and freed *menu separately if so.

However, if the </MAP> was at the very end of the HTML file, so that
not even a newline followed it, then look_for_link() left pos == eof
even though it had found the </MAP> and added *menu to the memory_list.
This made get_image_map() misinterpret the result and mem_free(*menu)
even though *menu had already been freed as part of the memory_list;
thus the crash.

To fix this, make look_for_link() return -1 instead of 0 if it hits
EOF without finding the </MAP>.  Then make get_image_map() check the
return value instead of comparing pos to eof.  And add a test case,
although not an automated one.

Alternatively, look_for_link() could have been changed to decrement
pos between finding the </MAP> and returning 0.  Then, the pos >= eof
comparison in get_image_map() would have been false.  That scheme
would however have been a bit more difficult to understand and
maintain, I think.

Reported by Paul B. Mahol.
(cherry picked from commit a2404407ce)
2008-12-31 20:15:44 +00:00