diff options
author | Rob Kendrick <rjek@netsurf-browser.org> | 2012-03-25 16:42:45 +0000 |
---|---|---|
committer | Rob Kendrick <rjek@netsurf-browser.org> | 2012-03-25 16:42:45 +0000 |
commit | e6155dd37f046e984e1e0d6528a175f649e47161 (patch) | |
tree | 14b3360b2346c69b1328fe11b098b05fbc3e40c8 /content/fetchers | |
parent | 903f4565473da7d46390dc53d9562b771c750f2b (diff) | |
download | netsurf-e6155dd37f046e984e1e0d6528a175f649e47161.tar.gz netsurf-e6155dd37f046e984e1e0d6528a175f649e47161.tar.bz2 |
about:imagecache gives URL links, and table is styled. This has revealed a buffer overflow or similar here; reducing the buffer size to 1024 makes it very fragile with long URLs.
svn path=/trunk/netsurf/; revision=13700
Diffstat (limited to 'content/fetchers')
-rw-r--r-- | content/fetchers/about.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/content/fetchers/about.c b/content/fetchers/about.c index a52aa120e..0c93a1dd6 100644 --- a/content/fetchers/about.c +++ b/content/fetchers/about.c @@ -181,7 +181,7 @@ static bool fetch_about_licence_handler(struct fetch_about_context *ctx) static bool fetch_about_imagecache_handler(struct fetch_about_context *ctx) { fetch_msg msg; - char buffer[1024]; /* output buffer */ + char buffer[2048]; /* output buffer */ int code = 200; int slen; unsigned int cent_loop = 0; @@ -240,18 +240,19 @@ static bool fetch_about_imagecache_handler(struct fetch_about_context *ctx) /* image cache entry table */ slen = snprintf(buffer, sizeof buffer, - "<table class=\"config\">\n" + "<table class=\"imagecachelist\">\n" "<tr><th>Entry</th>" "<th>Content Key</th>" "<th>Redraw Count</th>" "<th>Conversion Count</th>" "<th>Last Redraw</th>" "<th>Bitmap Age</th>" - "<th>Bitmap Size</th></tr>\n"); + "<th>Bitmap Size</th>" + "<th>Source URL</th></tr>\n"); do { res = image_cache_snentryf(buffer + slen, sizeof buffer - slen, cent_loop, - "<tr><td>%e</td><td>%k</td><td>%r</td><td>%c</td><td>%a</td><td>%g</td><td>%s</td></tr>\n"); + "<tr><td>%e</td><td>%k</td><td>%r</td><td>%c</td><td>%a</td><td>%g</td><td>%s</td><td><a href='%U'>%U</a></td></tr>\n"); if (res <= 0) break; /* last option */ |