Fix a segfault on an incomplete STYLE tag.

diff --git a/NEWS b/NEWS
index 311a2f1a13fe0c6227bcb025740679c9b311b04d..e0f81a9950f61cb811f10d2ef824fc69329226a7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,7 @@ Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 ** Return a network failure when FTP downloads fail and --timestamping
    is specified.
 
+** Fix a segfault on an incomplete STYLE tag.
 \f
 * Changes in Wget 1.13.3
 

diff --git a/src/ChangeLog b/src/ChangeLog
index 2152cce3b629e70f1e47108e82eecf9cb40852f7..6e6d354feae2b46932b68150d667184bd4662091 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,7 @@
+2012-04-01  Gijs van Tulder  <gvtulder@gmail.com>
+
+       * html-url.c: Prevent crash on incomplete STYLE tag.
+
 2012-04-01  Giuseppe Scrivano  <gscrivano@gnu.org>
 
        * gnutls.c (wgnutls_read_timeout): Ensure timer is freed.

diff --git a/src/html-url.c b/src/html-url.c
index f5ab2932902d9ece8a6ac6451c61d888ec8031f9..855393a726a03dedc6fcd71d74d51304ec1549d9 100644 (file)
--- a/src/html-url.c
+++ b/src/html-url.c
@@ -1,6 +1,6 @@
 /* Collect URLs from HTML source.
    Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006,
-   2007, 2008, 2009, 2010, 2011 Free Software Foundation, Inc.
+   2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation, Inc.
 
 This file is part of GNU Wget.
 
@@ -675,8 +675,9 @@ collect_tags_mapper (struct taginfo *tag, void *arg)
 
   check_style_attr (tag, ctx);
 
-  if (tag->end_tag_p && (0 == strcasecmp (tag->name, "style")) &&
-      tag->contents_begin && tag->contents_end)
+  if (tag->end_tag_p && (0 == strcasecmp (tag->name, "style"))
+      && tag->contents_begin && tag->contents_end
+      && tag->contents_begin <= tag->contents_end)
   {
     /* parse contents */
     get_urls_css (ctx, tag->contents_begin - ctx->text,