diff options
| author | John Mark Bell <jmb@netsurf-browser.org> | 2005-04-24 21:49:28 +0000 |
|---|---|---|
| committer | John Mark Bell <jmb@netsurf-browser.org> | 2005-04-24 21:49:28 +0000 |
| commit | 8c21386b004b3e12f9ff3488ad2c3bfe269aeace (patch) | |
| tree | 898e977bc3842b8a415c498944f965821ec265eb | |
| parent | a051b36ae73266e8d2a91bb8e86fcdad6ad01677 (diff) | |
| download | netsurf-8c21386b004b3e12f9ff3488ad2c3bfe269aeace.tar.gz netsurf-8c21386b004b3e12f9ff3488ad2c3bfe269aeace.tar.bz2 | |
[project @ 2005-04-24 21:49:28 by jmb]
Fix invalid reads from freed data.
svn path=/import/netsurf/; revision=1683
| -rw-r--r-- | render/box_construct.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/render/box_construct.c b/render/box_construct.c index fae22d6f4..df6fa6fec 100644 --- a/render/box_construct.c +++ b/render/box_construct.c @@ -478,7 +478,7 @@ bool box_construct_text(xmlNode *n, struct content *content, if (!*inline_container) { /* this is the first inline node: make a container */ *inline_container = box_create(0, 0, 0, 0, content); - if (!*inline_container) { + if (!*inline_container) { free(text); return false; } @@ -497,7 +497,7 @@ bool box_construct_text(xmlNode *n, struct content *content, return false; box->length = strlen(box->text); /* strip ending space char off */ - if (box->length > 1 && text[box->length - 1] == ' ') { + if (box->length > 1 && box->text[box->length - 1] == ' ') { box->space = 1; box->length--; } @@ -506,7 +506,8 @@ bool box_construct_text(xmlNode *n, struct content *content, parent_style->text_transform); if (parent_style->white_space == CSS_WHITE_SPACE_NOWRAP) { unsigned int i; - for (i = 0; i != box->length && text[i] != ' '; ++i) + for (i = 0; i != box->length && + box->text[i] != ' '; ++i) ; /* no body */ if (i != box->length) { /* there is a space in text block and we |