Program received signal SIGSEGV, Segmentation fault.
0x0000000000429ca0 in HTMLlineproc2body (buf=0x7d4e00, feed=0x428395 <textlist_feed>, llimit=-1) at file.c:5862
5862 if (!form->target)
(gdb) p form
$1 = (FormList *) 0x0
(gdb) bt
#0 0x0000000000429ca0 in HTMLlineproc2body (buf=0x7d4e00, feed=0x428395 <textlist_feed>, llimit=-1) at file.c:5862
#1 0x000000000042afd6 in HTMLlineproc2 (buf=0x7d4e00, tl=0x7cd280) at file.c:6197
#2 0x000000000042e1f4 in loadHTMLstream (f=0x7fffffffcac0, newBuf=0x7d4e00, src=0x0, internal=0) at file.c:7285
#3 0x000000000042ca01 in loadHTMLBuffer (f=0x7fffffffcac0, newBuf=0x7d4e00) at file.c:6779
#4 0x0000000000416b3f in loadSomething (f=0x7fffffffcac0, loadproc=0x42c8e7 <loadHTMLBuffer>, defaultbuf=0x7d4e00) at file.c:224
#5 0x000000000041c9b1 in loadGeneralFile (path=0x7c4b00 "min/10", current=0x0, referer=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, flag=0, request=0x0) at file.c:2241
#6 0x00000000004071c1 in main (argc=5, argv=0x7fffffffcde8, envp=0x7fffffffce18) at main.c:1020
I found form is obtained by form[form_id] earlier
5836 if (form_id < 0 || form_id > form_max || forms == NULL)
5837 break; /* outside of <form>..</form> */
5838 form = forms[form_id];
(gdb) p form_id
$3 = 6
(gdb) p form_max
$4 = 60
Although the value of form_id is validated but form_max is incorrectly obtained from user input.
This is found by afl-fuzz.
The text was updated successfully, but these errors were encountered:
input
gdb --args w3m -T text/html -dump fileI found
formis obtained byform[form_id]earlierAlthough the value of
form_idis validated butform_maxis incorrectly obtained from user input.This is found by afl-fuzz.
The text was updated successfully, but these errors were encountered: