Commit message: Prevent negative array index for selectnumber and textareanumber

Bug-Debian: https://github.com/tats/w3m/issues/12
CVE: CVE-2016-9424
CWE: CWE-119
Vulnerability description: An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service (heap buffer overflow crash) and possibly execute arbitrary code via a crafted HTML page.

Project: w3m
File: form.c

newFormList(char *action, char *method, char *charset, char *enctype,
	    char *target, char *name, struct form_list *_next)
{
    struct form_list *l;
    Str a = Strnew_charp(action);
    int m = FORM_METHOD_GET;
    int e = FORM_ENCTYPE_URLENCODED;
#ifdef USE_M17N
    wc_ces c = 0;
#endif

    if (method == NULL || !strcasecmp(method, "get"))
	m = FORM_METHOD_GET;
    else if (!strcasecmp(method, "post"))
	m = FORM_METHOD_POST;
    else if (!strcasecmp(method, "internal"))
	m = FORM_METHOD_INTERNAL;
    /* unknown method is regarded as 'get' */

    if (enctype != NULL && !strcasecmp(enctype, "multipart/form-data")) {
	e = FORM_ENCTYPE_MULTIPART;
	if (m == FORM_METHOD_GET)
	    m = FORM_METHOD_POST;
    }

#ifdef USE_M17N
    if (charset != NULL)
	c = wc_guess_charset(charset, 0);
#endif

    l = New(struct form_list);
    l->item = l->lastitem = NULL;
    l->action = a;
    l->method = m;
#ifdef USE_M17N
    l->charset = c;
#endif
    l->enctype = e;
    l->target = target;
    l->name = name;
    l->next = _next;
    l->nitems = 0;
    l->body = NULL;
    l->length = 0;
    return l;
}

Project: w3m
File: form.c

chooseSelectOption(FormItemList *fi, FormSelectOptionItem *item)
{
    FormSelectOptionItem *opt;
    int i;

    fi->selected = 0;
    if (item == NULL) {
	fi->value = Strnew_size(0);
	fi->label = Strnew_size(0);
	return;
    }
    fi->value = item->value;
    fi->label = item->label;
    for (i = 0, opt = item; opt != NULL; i++, opt = opt->next) {
	if (opt->checked) {
	    fi->value = opt->value;
	    fi->label = opt->label;
	    fi->selected = i;
	    break;
	}
    }
    updateSelectOption(fi, item);
}

Project: w3m
File: form.c

form_update_line(Line *line, char **str, int spos, int epos, int width,
		 int newline, int password)
{
    int c_len = 1, c_width = 1, w, i, len, pos;
    char *p, *buf;
    Lineprop c_type, effect, *prop;

    for (p = *str, w = 0, pos = 0; *p && w < width;) {
	c_type = get_mctype((unsigned char *)p);
#ifdef USE_M17N
	c_len = get_mclen(p);
	c_width = get_mcwidth(p);
#endif
	if (c_type == PC_CTRL) {
	    if (newline && *p == '\n')
		break;
	    if (*p != '\r') {
		w++;
		pos++;
	    }
	}
	else if (password) {
#ifdef USE_M17N
	    if (w + c_width > width)
		break;
#endif
	    w += c_width;
	    pos += c_width;
#ifdef USE_M17N
	}
	else if (c_type & PC_UNKNOWN) {
	    w++;
	    pos++;
	}
	else {
	    if (w + c_width > width)
		break;
#endif
	    w += c_width;
	    pos += c_len;
	}
	p += c_len;
    }
    pos += width - w;

    len = line->len + pos + spos - epos;
    buf = New_N(char, len);
    prop = New_N(Lineprop, len);
    bcopy((void *)line->lineBuf, (void *)buf, spos * sizeof(char));
    bcopy((void *)line->propBuf, (void *)prop, spos * sizeof(Lineprop));

    effect = CharEffect(line->propBuf[spos]);
    for (p = *str, w = 0, pos = spos; *p && w < width;) {
	c_type = get_mctype((unsigned char *)p);
#ifdef USE_M17N
	c_len = get_mclen(p);
	c_width = get_mcwidth(p);
#endif
	if (c_type == PC_CTRL) {
	    if (newline && *p == '\n')
		break;
	    if (*p != '\r') {
		buf[pos] = password ? '*' : ' ';
		prop[pos] = effect | PC_ASCII;
		pos++;
		w++;
	    }
	}
	else if (password) {
#ifdef USE_M17N
	    if (w + c_width > width)
		break;
#endif
	    for (i = 0; i < c_width; i++) {
		buf[pos] = '*';
		prop[pos] = effect | PC_ASCII;
		pos++;
		w++;
	    }
#ifdef USE_M17N
	}
	else if (c_type & PC_UNKNOWN) {
	    buf[pos] = ' ';
	    prop[pos] = effect | PC_ASCII;
	    pos++;
	    w++;
	}
	else {
	    if (w + c_width > width)
		break;
#else
	}
	else {
#endif
	    buf[pos] = *p;
	    prop[pos] = effect | c_type;
	    pos++;
#ifdef USE_M17N
	    c_type = (c_type & ~PC_WCHAR1) | PC_WCHAR2;
	    for (i = 1; i < c_len; i++) {
		buf[pos] = p[i];
		prop[pos] = effect | c_type;
		pos++;
	    }
#endif
	    w += c_width;
	}
	p += c_len;
    }
    for (; w < width; w++) {
	buf[pos] = ' ';
	prop[pos] = effect | PC_ASCII;
	pos++;
    }
    if (newline) {
	if (!FoldTextarea) {
	    while (*p && *p != '\r' && *p != '\n')
		p++;
	}
	if (*p == '\r')
	    p++;
	if (*p == '\n')
	    p++;
    }
    *str = p;

    bcopy((void *)&line->lineBuf[epos], (void *)&buf[pos],
	  (line->len - epos) * sizeof(char));
    bcopy((void *)&line->propBuf[epos], (void *)&prop[pos],
	  (line->len - epos) * sizeof(Lineprop));
    line->lineBuf = buf;
    line->propBuf = prop;
    line->len = len;
    line->size = len;

    return pos;
}