أحمد المحمودي <aelmahmo...@users.sourceforge.net> writes:

> I confirm that I got the same problem with elinks 0.13 (20081129 
> snapshot).

ELinks 0.10.6, 0.11.0, 0.11.5, 0.12pre1, and 0.12pre2 all crash.
The trigger is that there is no newline after the final </MAP>.
Small test case:

<TITLE>Double-free crash in USEMAP</TITLE>
<P><IMG src="/dev/null" usemap="#crasher"></P>
<MAP name="crasher">
<AREA shape="rect" coords="42,42,69,69" href="http://elinks.cz/"; alt="see 
this?">
<!-- no newline at the end of this line --></MAP>

Attachment: pgpXNf0378jHA.pgp
Description: PGP signature

_______________________________________________
elinks-dev mailing list
elinks-dev@linuxfromscratch.org
http://linuxfromscratch.org/mailman/listinfo/elinks-dev

Reply via email to