infinite loop in feed_textarea()

[kcwu]

input (xxd cases/tats-w3m-85)

00000000: 3c6d 6574 6120 3d22 2263 6861 7273 6574  <meta =""charset
00000010: 3d75 7466 373e 3c74 6578 7461 7265 613e  =utf7><textarea>
00000020: 0d2b 4141 300d                           .+AA0.

how to reproduce:

./w3m-tats -T text/html -dump cases/tats-w3m-85

More detail to reproduce please see http://github.com/kcwu/fuzzing-w3m

For your convenience,
gdbline:
gdb --args ./w3m-tats -T text/html -dump cases/tats-w3m-85

found by afl-fuzz

[kcwu]

file.c

4089        while (*str) {
4090            if (*str == '&')
...
4092            else if (*str == '\n') {
...
4095            }
4096            else if (*str != '\r')
...
4098        }

if *str=='\r', the loop never breaks.

[kcwu]

The same case. This variant hangs for original 0.5.3 as well.

00000000: 3c6d 6574 6120 6874 7470 2d65 7175 6976  <meta http-equiv
00000010: 3d22 636f 6e74 656e 742d 7479 7065 2263  ="content-type"c
00000020: 6f6e 7465 6e74 3d63 6861 7273 6574 3d75  ontent=charset=u
00000030: 7466 373e 3c74 6578 7461 7265 613e 0d2b  tf7><textarea>.+
00000040: 4141 300d                                AA0.

[tats]

Fixed, thank you.