heap-buffer-overflow in Strnew_size()

[kcwu]

input (xxd cases/tats-w3m-72)

00000000: 3c69 6e70 7574 2076 616c 7565 3d30 2073  <input value=0 s
00000010: 697a 653d 2d33 3e                        ize=-3>

how to reproduce:

ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 LD_LIBRARY_PATH=./notgc ./w3m-tats.asan -T text/html -dump cases/tats-w3m-72

stderr:

ASAN:DEADLYSIGNAL
=================================================================
==3858606==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000006e37be bp 0x7fffc98f4e60 sp 0x7fffc98f4e00 T0)
    #0 0x6e37bd in Strnew_size /targets/w3m-tats/Str.c:52:15
    #1 0x63367e in textfieldrep /targets/w3m-tats/form.c:520:13
    #2 0x56f366 in process_input /targets/w3m-tats/file.c:3699:15
    #3 0x58c9ba in HTMLtagproc1 /targets/w3m-tats/file.c:5111:8
    #4 0x5928ff in HTMLlineproc0 /targets/w3m-tats/file.c:6480:10
    #5 0x5a5bbc in loadHTMLstream /targets/w3m-tats/file.c:7255:2
    #6 0x55bbf8 in loadHTMLBuffer /targets/w3m-tats/file.c:6784:5
    #7 0x55ee64 in loadSomething /targets/w3m-tats/file.c:224:16
    #8 0x5535ac in loadGeneralFile /targets/w3m-tats/file.c:2241:6
    #9 0x4f9202 in main /targets/w3m-tats/main.c:1017:12
    #10 0x7f7619dcef44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287
    #11 0x41bf25 in _start (/w3m-tats.asan+0x41bf25)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /targets/w3m-tats/Str.c:52:15 in Strnew_size
==3858606==ABORTING

This is detected with help of dummy libgc wrapper. See http://github.com/kcwu/fuzzing-w3m/notgc for detail.
More detail to reproduce please see http://github.com/kcwu/fuzzing-w3m

For your convenience,
gdbline:
LD_LIBRARY_PATH=./notgc ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 gdb --args ./w3m-tats.asan -T text/html -dump cases/tats-w3m-72

This is found by afl-fuzz

[kcwu]

0x00000000006e37be in Strnew_size (n=-1) at Str.c:52
51          x->ptr = GC_MALLOC_ATOMIC(n + 1);
52          x->ptr[0] = '\0';

w3m allocate a buffer of size 0 and write one byte to the said pointer.

Here my dummy libgc wrapper return NULL, so it SEGV. Real libgc will return a dummy pointer and won't crash. Anyway, w3m still shouldn't write to it.

[tats]

Fixed, thank you.