mirrors/netsurf
1
0
Fork 0
mirror of https://github.com/netsurf-browser/netsurf synced 2024-12-22 20:16:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

about:imagecache gives URL links, and table is styled. This has revealed a buffer overflow or similar here; reducing the buffer size to 1024 makes it very fragile with long URLs.

Browse Source 
svn path=/trunk/netsurf/; revision=13700
This commit is contained in:
Rob Kendrick 2012-03-25 16:42:45 +00:00
parent 903f456547
commit e6155dd37f
3 changed files with 27 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
!NetSurf/Resources/internal.css,f79
View File

@ -174,3 +174,20 @@ body#configlist table.config td + td {
body#configlist .null-content { body#configlist .null-content {
font-style: italic; } font-style: italic; }
/* about:imagecache */
table.imagecachelist {
border: 1px solid #000;
border-spacing: 0px;
border-collapse: collapse;
}
table.imagecachelist th {
border: 1px solid #000;
}
table.imagecachelist td {
border: 1px solid #000;
}

9
content/fetchers/about.c
View File

@ -181,7 +181,7 @@ static bool fetch_about_licence_handler(struct fetch_about_context *ctx)
static bool fetch_about_imagecache_handler(struct fetch_about_context *ctx) static bool fetch_about_imagecache_handler(struct fetch_about_context *ctx)
{ {
fetch_msg msg; fetch_msg msg;
char buffer[1024]; /* output buffer */ char buffer[2048]; /* output buffer */
int code = 200; int code = 200;
int slen; int slen;
unsigned int cent_loop = 0; unsigned int cent_loop = 0;
@ -240,18 +240,19 @@ static bool fetch_about_imagecache_handler(struct fetch_about_context *ctx)
/* image cache entry table */ /* image cache entry table */
slen = snprintf(buffer, sizeof buffer, slen = snprintf(buffer, sizeof buffer,
"<table class=\"config\">\n" "<table class=\"imagecachelist\">\n"
"<tr><th>Entry</th>" "<tr><th>Entry</th>"
"<th>Content Key</th>" "<th>Content Key</th>"
"<th>Redraw Count</th>" "<th>Redraw Count</th>"
"<th>Conversion Count</th>" "<th>Conversion Count</th>"
"<th>Last Redraw</th>" "<th>Last Redraw</th>"
"<th>Bitmap Age</th>" "<th>Bitmap Age</th>"
"<th>Bitmap Size</th></tr>\n"); "<th>Bitmap Size</th>"
"<th>Source URL</th></tr>\n");
do { do {
res = image_cache_snentryf(buffer + slen, sizeof buffer - slen, res = image_cache_snentryf(buffer + slen, sizeof buffer - slen,
cent_loop, cent_loop,
"<tr><td>%e</td><td>%k</td><td>%r</td><td>%c</td><td>%a</td><td>%g</td><td>%s</td></tr>\n"); "<tr><td>%e</td><td>%k</td><td>%r</td><td>%c</td><td>%a</td><td>%g</td><td>%s</td><td><a href='%U'>%U</a></td></tr>\n");
if (res <= 0) if (res <= 0)
break; /* last option */ break; /* last option */

5
image/image_cache.c
View File

@ -677,6 +677,11 @@ int image_cache_snentryf(char *string, size_t size, unsigned int entryn,
"%p", centry->content); "%p", centry->content);
break; break;
case 'U':
slen += snprintf(string + slen, size - slen,
"%s", nsurl_access(llcache_handle_get_url(centry->content->llcache)));
break;
case 's': case 's':
if (centry->bitmap != NULL) { if (centry->bitmap != NULL) {
slen += snprintf(string + slen, slen += snprintf(string + slen,