From 923d9f13659db97d1942e7daffdf9df3877ece96 Mon Sep 17 00:00:00 2001
From: Richard Wilson <rjw@netsurf-browser.org>
Date: Sat, 2 Sep 2006 19:03:49 +0000
Subject: [PATCH] Fix 1546941.

svn path=/trunk/netsurf/; revision=2909
---
 render/box_construct.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/render/box_construct.c b/render/box_construct.c
index b61cb5d24..d37d357c3 100644
--- a/render/box_construct.c
+++ b/render/box_construct.c
@@ -457,15 +457,19 @@ bool box_construct_element(xmlNode *n, struct content *content,
 
 	/* misc. attributes that can't be handled in box_get_style() */
 	if ((s = (char *) xmlGetProp(n, (const xmlChar *) "colspan"))) {
-		box->columns = strtol(s, NULL, 10);
-		if (MAX_SPAN < box->columns)
-			box->columns = 1;
+	  	if (isdigit(s[0])) {
+			box->columns = strtol(s, NULL, 10);
+			if ((MAX_SPAN < box->columns) || (box->columns < 1))
+				box->columns = 1;
+		}
 		xmlFree(s);
 	}
 	if ((s = (char *) xmlGetProp(n, (const xmlChar *) "rowspan"))) {
-		box->rows = strtol(s, NULL, 10);
-		if (MAX_SPAN < box->rows)
-			box->rows = 1;
+	  	if (isdigit(s[0])) {
+			box->rows = strtol(s, NULL, 10);
+			if ((MAX_SPAN < box->rows) || (box->rows < 1))
+				box->rows = 1;
+		}
 		xmlFree(s);
 	}
 	if (strcmp((const char *) n->name, "table") == 0) {