mirror of
https://github.com/rkd77/elinks.git
synced 2024-06-29 01:45:34 +00:00
25da8085b3
look_for_link() used to return 0 both when it found the closing </MAP>
tag, and when it hit the end of the file. In the first case, it also
added *menu to the memory_list; in the second case, it did not. The
caller get_image_map() supposedly distinguished between these cases by
checking whether pos >= eof, and freed *menu separately if so.
However, if the </MAP> was at the very end of the HTML file, so that
not even a newline followed it, then look_for_link() left pos == eof
even though it had found the </MAP> and added *menu to the memory_list.
This made get_image_map() misinterpret the result and mem_free(*menu)
even though *menu had already been freed as part of the memory_list;
thus the crash.
To fix this, make look_for_link() return -1 instead of 0 if it hits
EOF without finding the </MAP>. Then make get_image_map() check the
return value instead of comparing pos to eof. And add a test case,
although not an automated one.
Alternatively, look_for_link() could have been changed to decrement
pos between finding the </MAP> and returning 0. Then, the pos >= eof
comparison in get_image_map() would have been false. That scheme
would however have been a bit more difficult to understand and
maintain, I think.
Reported by Paul B. Mahol.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| cgi | ||
| css | ||
| docbook | ||
| ecmascript | ||
| rss | ||
| server | ||
| xbel | ||
| backspaces.txt | ||
| bigtextarea.html | ||
| color.html | ||
| comments.html | ||
| garbage.html | ||
| GFDL-1.2 | ||
| href_tests.html | ||
| imgmap.html | ||
| imgmap2.html | ||
| libtest.sh | ||
| longtitle.html | ||
| malicious_uris.html | ||
| nbsp.html | ||
| nocache.html | ||
| optgroup.html | ||
| portlink.html | ||
| README | ||
| refresh.html | ||
| refresh+nocache.html | ||
| refresh2.html | ||
| remote.sh | ||
| subsup.html | ||
| tabindex.html | ||
| tablebg.html | ||
| tables.html | ||
| target_blank.html | ||
| td-width.html | ||
| underline.html | ||
| xmp.html | ||
This directory contains various weird documents for testing whether we're parsing and rendering them properly. Frequently, documents are getting added here when we implement feature needed for their correct presentation or fix bug occuring inside of these documents. No automated testsuite yet, though. Possible meaningful content of the documents is completely irrelevant and you should ignore it. Noone takes any responsibility for it :). optgroup.html originates from <http://iccl.fi/>. Ari Sovijärvi kindly granted us the "GNU free documentation licence" (included in the file GFDL-1.2).