lynx-dev lynx aborts with http://www.asuscom.com.tw/linux.html

[Philippe De Muyter]

lynx aborts on the following url :

        http://www.asuscom.com.tw/linux.html

because of the following in LYCharUtils.c/LYHandleMETA

        /*
         *  Hope it's a match, for now. - FM
         */
        cp1 = &cp4[10];                         <<<<<<< How can we be sure there
                                                        are 10 chars there ?
                                                        in the testcase,
                                                        cp4 is `big5'
        while (*cp1 &&
               isdigit((unsigned char)(*cp1)))
            cp1++;
        *cp1 = '\0';                            <<<<<<< Corrupts the heap.

Philippe De Muyter - address@hidden