Null pointer dereference in formUpdateBuffer

[kcwu]

Input file

00000000: 3c62 7574 746f 6e20 7661 6c75 653d 2722  <button value='"
00000010: 3e3c 696e 7075 745f 616c 7420 6669 643d  ><input_alt fid=
00000020: 3020 7479 7065 3d27 3e3c 2f68 323e       0 type='></h2>

gdb log

Program received signal SIGSEGV, Segmentation fault.
0x000000000044f6dd in formUpdateBuffer (a=0x7de000, buf=0x7d3e00, form=0x7dde00) at form.c:462
462                 p = form->value->ptr;
(gdb) p form
$1 = (FormItemList *) 0x7dde00
(gdb) p form->value
$2 = (Str) 0x0
(gdb) bt
#0  0x000000000044f6dd in formUpdateBuffer (a=0x7de000, buf=0x7d3e00, form=0x7dde00) at form.c:462
#1  0x000000000044ef56 in formResetBuffer (buf=0x7d3e00, formitem=0x7d8940) at form.c:272
#2  0x000000000042c952 in loadHTMLBuffer (f=0x7fffffffd110, newBuf=0x7d3e00) at file.c:6784
#3  0x0000000000416ae0 in loadSomething (f=0x7fffffffd110, loadproc=0x42c7fc <loadHTMLBuffer>, defaultbuf=0x7d3e00) at file.c:224
#4  0x000000000041c8fe in loadGeneralFile (path=0x7c3b00 "min/1", current=0x0, referer=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, flag=0, request=0x0) at file.c:2245
#5  0x0000000000407171 in main (argc=5, argv=0x7fffffffd438, envp=0x7fffffffd468) at main.c:1020

found by afl-fuzz

[kcwu]

This input looks different but crash at the same location

00000000: 3c69 6e70 7574 3e3c 6d65 7461 2063 6861  <input><meta cha
00000010: 7273 6574 3d67 6231 3830 3330 3e3c 3030  rset=gb18030><00
00000020: 3030 3030 3030 3030 3030 3030 8081 fff3  000000000000....
00000030: fff3 a080 a080 8130 8081 30a0 8130 f3a0  .......0..0..0..
00000040: 8081 fff3 a080 a130 3030 3030 3030 3030  .......000000000
00000050: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000060: 3030 3030 3030 0a30 3030 3030 3030 3030  000000.000000000
00000070: 3030 3030 ff30 a030 c4c4 c430 c4c4 3030  0000.0.0...0..00
00000080: c430 c4c4 3030 3030 30c4 30c4 c430 30c4  .0..00000.0..00.
00000090: c4c4 3030 3030 30c4 30a0 6d30 a030 3030  ..00000.0.m0.000
000000a0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000b0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000c0: 3030 ff30 a030 a080 3030 3030 8130 3030  00.0.0..0000.000
000000d0: 3030 3030 3030 30c4 3081 8030 3030 30a0  0000000.0..0000.
000000e0: 3081 a080 81                             0....

[tats]

Fixed, thank you.