[w3m-dev 04348] Re: "important" bugs from bugs.debian.org

> #491400
> w3m: Allocates all available memory on displaying http://lcamtuf.coredump.cx/mangleme/gallery/lynx_die1.html
> http://bugs.debian.org/491400
> 
>  HTML 


 rows, cols 


Index: file.c
===================================================================
RCS file: /cvsroot/w3m/w3m/file.c,v
retrieving revision 1.260
diff -u -r1.260 file.c
--- file.c	24 Jul 2010 04:30:40 -0000	1.260
+++ file.c	30 Jul 2010 03:20:21 -0000
@@ -3914,6 +3914,8 @@
 {
     Str tmp = NULL;
     char *p;
+#define TEXTAREA_ATTR_COL_MAX 4096
+#define TEXTAREA_ATTR_ROWS_MAX 4096
 
     if (cur_form_id < 0) {
 	char *s = "<form_int method=internal action=none>";
@@ -3928,14 +3930,20 @@
 	cur_textarea_size = atoi(p);
 	if (p[strlen(p) - 1] == '%')
 	    cur_textarea_size = width * cur_textarea_size / 100 - 2;
-	if (cur_textarea_size <= 0)
+	if (cur_textarea_size <= 0) {
 	    cur_textarea_size = 20;
+	} else if (cur_textarea_size > TEXTAREA_ATTR_COL_MAX) {
+	    cur_textarea_size = TEXTAREA_ATTR_COL_MAX;
+	}
     }
     cur_textarea_rows = 1;
     if (parsedtag_get_value(tag, ATTR_ROWS, &p)) {
 	cur_textarea_rows = atoi(p);
-	if (cur_textarea_rows <= 0)
+	if (cur_textarea_rows <= 0) {
 	    cur_textarea_rows = 1;
+	} else if (cur_textarea_rows > TEXTAREA_ATTR_ROWS_MAX) {
+	    cur_textarea_rows = TEXTAREA_ATTR_ROWS_MAX;
+	}
     }
     cur_textarea_readonly = parsedtag_exists(tag, ATTR_READONLY);
     if (n_textarea >= max_textarea) {