Gitweb links:
...log
http://git.netsurf-browser.org/netsurf.git/shortlog/3cabd331ee1b638b02334...
...commit
http://git.netsurf-browser.org/netsurf.git/commit/3cabd331ee1b638b0233415...
...tree
http://git.netsurf-browser.org/netsurf.git/tree/3cabd331ee1b638b02334155f...
The branch, master has been updated
via 3cabd331ee1b638b02334155f831a8715fea399a (commit)
from e64d48980e38448eeb83daa8659788d48f845692 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commitdiff
http://git.netsurf-browser.org/netsurf.git/commit/?id=3cabd331ee1b638b023...
commit 3cabd331ee1b638b02334155f831a8715fea399a
Author: Vincent Sanders <vince(a)kyllikki.org>
Commit: Vincent Sanders <vince(a)kyllikki.org>
Ensure result of ftell is checked for errors
The ftell call in the html renderer handling of drag and drop was not
checking its return value for errors which could have resulted in
attempting to read -1 bytes.
coverity 1251038
diff --git a/render/html.c b/render/html.c
index 5fb2fea..e8692a0 100644
--- a/render/html.c
+++ b/render/html.c
@@ -1934,6 +1934,12 @@ static bool html_drop_file_at_point(struct content *c, int x, int
y, char *file)
file_len = ftell(fp);
fseek(fp, 0, SEEK_SET);
+ if ((long)file_len == -1) {
+ /* unable to get file length, but drop was for us */
+ fclose(fp);
+ return true;
+ }
+
/* Allocate buffer for file data */
buffer = malloc(file_len + 1);
if (buffer == NULL) {
-----------------------------------------------------------------------
Summary of changes:
render/html.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/render/html.c b/render/html.c
index 5fb2fea..e8692a0 100644
--- a/render/html.c
+++ b/render/html.c
@@ -1934,6 +1934,12 @@ static bool html_drop_file_at_point(struct content *c, int x, int
y, char *file)
file_len = ftell(fp);
fseek(fp, 0, SEEK_SET);
+ if ((long)file_len == -1) {
+ /* unable to get file length, but drop was for us */
+ fclose(fp);
+ return true;
+ }
+
/* Allocate buffer for file data */
buffer = malloc(file_len + 1);
if (buffer == NULL) {
--
NetSurf Browser