mirror of
https://github.com/rkd77/elinks.git
synced 2024-06-15 23:35:34 +00:00
a2404407ce
look_for_link() used to return 0 both when it found the closing </MAP> tag, and when it hit the end of the file. In the first case, it also added *menu to the memory_list; in the second case, it did not. The caller get_image_map() supposedly distinguished between these cases by checking whether pos >= eof, and freed *menu separately if so. However, if the </MAP> was at the very end of the HTML file, so that not even a newline followed it, then look_for_link() left pos == eof even though it had found the </MAP> and added *menu to the memory_list. This made get_image_map() misinterpret the result and mem_free(*menu) even though *menu had already been freed as part of the memory_list; thus the crash. To fix this, make look_for_link() return -1 instead of 0 if it hits EOF without finding the </MAP>. Then make get_image_map() check the return value instead of comparing pos to eof. And add a test case, although not an automated one. Alternatively, look_for_link() could have been changed to decrement pos between finding the </MAP> and returning 0. Then, the pos >= eof comparison in get_image_map() would have been false. That scheme would however have been a bit more difficult to understand and maintain, I think. Reported by Paul B. Mahol. |
||
|---|---|---|
| .. | ||
| cgi | ||
| css | ||
| ecmascript | ||
| rss | ||
| xbel | ||
| backspaces.txt | ||
| bigtextarea.html | ||
| color.html | ||
| comments.html | ||
| garbage.html | ||
| GFDL-1.2 | ||
| href_tests.html | ||
| imgmap.html | ||
| imgmap2.html | ||
| libtest.sh | ||
| longtitle.html | ||
| malicious_uris.html | ||
| optgroup.html | ||
| portlink.html | ||
| README | ||
| refresh.html | ||
| subsup.html | ||
| tabindex.html | ||
| tablebg.html | ||
| tables.html | ||
| target_blank.html | ||
| td-width.html | ||
| underline.html | ||
| xmp.html | ||
This directory contains various weird documents for testing whether we're parsing and rendering them properly. Frequently, documents are getting added here when we implement feature needed for their correct presentation or fix bug occuring inside of these documents. No automated testsuite yet, though. Possible meaningful content of the documents is completely irrelevant and you should ignore it. Noone takes any responsibility for it :). optgroup.html originates from <http://iccl.fi/>. Ari Sovijärvi kindly granted us the "GNU free documentation licence" (included in the file GFDL-1.2).