Gitweb links: ...log http://git.netsurf-browser.org/netsurf.git/shortlog/3cabd331ee1b638b02334... ...commit http://git.netsurf-browser.org/netsurf.git/commit/3cabd331ee1b638b0233415... ...tree http://git.netsurf-browser.org/netsurf.git/tree/3cabd331ee1b638b02334155f... The branch, master has been updated via 3cabd331ee1b638b02334155f831a8715fea399a (commit) from e64d48980e38448eeb83daa8659788d48f845692 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commitdiff http://git.netsurf-browser.org/netsurf.git/commit/?id=3cabd331ee1b638b023... commit 3cabd331ee1b638b02334155f831a8715fea399a Author: Vincent Sanders <vince(a)kyllikki.org&gt; Commit: Vincent Sanders <vince(a)kyllikki.org&gt; Ensure result of ftell is checked for errors The ftell call in the html renderer handling of drag and drop was not checking its return value for errors which could have resulted in attempting to read -1 bytes. coverity 1251038 diff --git a/render/html.c b/render/html.c index 5fb2fea..e8692a0 100644 --- a/render/html.c +++ b/render/html.c @@ -1934,6 +1934,12 @@ static bool html_drop_file_at_point(struct content *c, int x, int y, char *file) file_len = ftell(fp); fseek(fp, 0, SEEK_SET); + if ((long)file_len == -1) { + /* unable to get file length, but drop was for us */ + fclose(fp); + return true; + } + /* Allocate buffer for file data */ buffer = malloc(file_len + 1); if (buffer == NULL) { ----------------------------------------------------------------------- Summary of changes: render/html.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/render/html.c b/render/html.c index 5fb2fea..e8692a0 100644 --- a/render/html.c +++ b/render/html.c @@ -1934,6 +1934,12 @@ static bool html_drop_file_at_point(struct content *c, int x, int y, char *file) file_len = ftell(fp); fseek(fp, 0, SEEK_SET); + if ((long)file_len == -1) { + /* unable to get file length, but drop was for us */ + fclose(fp); + return true; + } + /* Allocate buffer for file data */ buffer = malloc(file_len + 1); if (buffer == NULL) { -- NetSurf Browser