Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix crash bugs with bogus table attributes (Issue #416)
  • Loading branch information
michaelrsweet committed Apr 1, 2021
1 parent 0ddab26 commit ba61a3e
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 4 deletions.
2 changes: 1 addition & 1 deletion CHANGES.md
@@ -1,7 +1,7 @@
# Changes in HTMLDOC v1.9.12

- Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
- Fixed a crach bug with bogus table attributes (Issue #417)
- Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
- Fixed a crash bug with malformed URIs (Issue #418)
- Fixed a crash bug with malformed GIF files (Issue #423)
- Fixed some issues reported by Coverity.
Expand Down
16 changes: 13 additions & 3 deletions htmldoc/ps-pdf.cxx
Expand Up @@ -5735,7 +5735,7 @@ render_table_row(hdtable_t &table,
if ((var = htmlGetVariable(cells[row][col], (uchar *)"ROWSPAN")) != NULL)
table.row_spans[col] = atoi((char *)var);

if (table.row_spans[col] == 1)
if (table.row_spans[col] <= 1)
table.row_spans[col] = 0;

if (table.row_spans[col] > (table.num_rows - row))
Expand Down Expand Up @@ -6570,15 +6570,20 @@ parse_table(tree_t *t, // I - Tree to parse
{
// Handle colspan and rowspan stuff...
if ((var = htmlGetVariable(tempcol, (uchar *)"COLSPAN")) != NULL)
colspan = atoi((char *)var);
{
if ((colspan = atoi((char *)var)) < 1)
colspan = 1;
else if (colspan > (MAX_COLUMNS - col))
colspan = MAX_COLUMNS - col;
}
else
colspan = 1;

if ((var = htmlGetVariable(tempcol, (uchar *)"ROWSPAN")) != NULL)
{
table.row_spans[col] = atoi((char *)var);

if (table.row_spans[col] == 1)
if (table.row_spans[col] <= 1)
table.row_spans[col] = 0;

for (tcol = 1; tcol < colspan; tcol ++)
Expand All @@ -6600,6 +6605,11 @@ parse_table(tree_t *t, // I - Tree to parse
{
col_width -= 2.0 * table.cellpadding;
}

if (col_width <= 0.0f)
col_width = 0.0f;
else if (col_width > PageWidth)
col_width = PageWidth;
}
else
col_width = 0.0f;
Expand Down

0 comments on commit ba61a3e

Please sign in to comment.