Re: lynx-dev lynx2.8.5dev.15

[Leonid Pauzner]

> 2003-04-27 (2.8.5dev.15)

I just starting to review the patch and apparently HTBEquivalent() will
access memory out of bound, under the certain condition (two equivalent
anchors with not empty post_data). Also, the first condition was preventing
0-sized bstrings being equivalent to each other, if there is the case.


--- htanchor.c0 2003-04-28 11:15:22.000000000 +0000
+++ htanchor.c  2003-04-28 20:32:22.000000000 +0000
@@ -141,19 +141,17 @@ PRIVATE BOOL HTSEquivalent ARGS2(
 PRIVATE BOOL HTBEquivalent ARGS2(
        CONST bstring *,        s,
        CONST bstring *,        t)
 {
-    if (!isBEmpty(s)
-     && !isBEmpty(t)
-     && BStrLen(s) == BStrLen(t)) {
+    if (s && t && BStrLen(s) == BStrLen(t)) {
        int j;
        int len = BStrLen(s);
        for (j = 0; j < len; ++j) {
            if (!HT_EQUIV(BStrData(s)[j], BStrData(t)[j])) {
                return(NO);
            }
        }
-       return (HT_EQUIV(BStrData(s)[j], BStrData(t)[j]));
+       return(YES);
     } else {
        return(s == t);         /* Two NULLs are equivalent, aren't they ? */
     }
 }


; To UNSUBSCRIBE: Send "unsubscribe lynx-dev" to address@hidden