lynx-dev [PATCH 2.8.5-dev14] buffer overrun in paste-URL

[Ilya Zakharevich]

Some functions assume a certain buffer-length of the argument strings
without documenting the requirement...

I found this only due to segfaults...

Hope this helps,
Ilya

--- ./src/LYMainLoop.c-pre1     Tue Feb 18 18:47:08 2003
+++ ./src/LYMainLoop.c  Wed Feb 19 02:21:22 2003
@@ -6984,7 +6984,10 @@ new_cmd:  /*
                    HTInfoMsg("No URL in the clipboard.");
                    break;
                }
-               buf = (char*)malloc(e - s + 1);
+               len = e - s + 1;
+               if (len < MAX_LINE)
+                   len = MAX_LINE;     /* Required for do_check_goto_URL() */
+               buf = (char*)malloc(len);
                strncpy(buf, s, e - s);
                buf[e - s] = '\0';
                t = buf;

; To UNSUBSCRIBE: Send "unsubscribe lynx-dev" to address@hidden