Segfault on bad input

• From: Scott Davis <scott.davis@dsto.defence.gov.au>
• Date: Thu, 20 Jul 2000 10:01:19 +0930 (CST)
• To: html-tidy@w3.org
• Message-ID: <Roam.SIMC.2.0.6.964053079.32557.sbd@itd3.dsto.defence.gov.au>

Hi,

I have tried Tidy on http://www.savicmotorsport.com.au/ and it produced a
segmentation fault on an element <A HREF=mailto:"user@host"> blah </a>

Note the odd quoting on the HREF element.

I am using tidy8jul00 on Solaris 2.7.

This seems to be caused by the value of the sattribute being null if an
unexpected quote is found. It may be related to the break at line 2541 of
lexer.c Removing that line seems to produce a reasonable result of
   <a href="mailto:&quot;user@company.com&quot;">blah</a>


            if (c == '"' || c == '\'')
            {
                ReportAttrError(lexer, lexer->token, null,
UNEXPECTED_QUOTEMARK); // *** REMOVE ***   break;
            }


Scott Davis

Scott Davis					Phone: +61 8 8259 6360
Information Technology Division,                Fax:   +61 8 8259 5619
Defence Science and Technology Organisation
Salisbury, South Australia 5108		scott.davis@dsto.defence.gov.au

Received on Wednesday, 19 July 2000 20:37:16 UTC