Skip to content

Commit

Permalink
Prevent null pointer deref due to bad form id
Browse files Browse the repository at this point in the history
  • Loading branch information
tats committed Nov 19, 2016
1 parent 500e08a commit 874998a
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion file.c
Original file line number Diff line number Diff line change
Expand Up @@ -5805,7 +5805,8 @@ HTMLlineproc2body(Buffer *buf, Str (*feed) (), int llimit)
parsedtag_get_value(tag, ATTR_FID, &form_id);
parsedtag_get_value(tag, ATTR_TOP_MARGIN, &top);
parsedtag_get_value(tag, ATTR_BOTTOM_MARGIN, &bottom);
if (form_id < 0 || form_id > form_max || forms == NULL)
if (form_id < 0 || form_id > form_max ||
forms == NULL || forms[form_id] == NULL)
break; /* outside of <form>..</form> */
form = forms[form_id];
if (hseq > 0) {
Expand Down Expand Up @@ -7011,6 +7012,8 @@ print_internal_information(struct html_feed_environ *henv)
if (form_max >= 0) {
FormList *fp;
for (i = 0; i <= form_max; i++) {
if (forms[i] == NULL)
continue;
fp = forms[i];
s = Sprintf("<form_int fid=\"%d\" action=\"%s\" method=\"%s\"",
i, html_quote(fp->action->ptr),
Expand Down

0 comments on commit 874998a

Please sign in to comment.