[PATCH 0/2] Fix crashes seen on subpages of https://www.pythontutorial.net/
There are input type="button" without value there, do not crash. The main repo seems not to have a pull request functionality, so I am using the good old git format-patch way, so it can be applied via git am. Andreas Kemnade (2): do not crash at input tags which do neither produce resources or embeds form input: try to find defaults for buttons without a value src/form.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.47.3
new Embed(resource) crashes if resource is NULL. Ignore the tag in such cases. This came to light during parsing of a button tag without a value. --- src/form.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/form.cc b/src/form.cc index e2f0c1c2..038b94f3 100644 --- a/src/form.cc +++ b/src/form.cc @@ -551,7 +551,7 @@ void Html_tag_open_input(DilloHtml *html, const char *tag, int tagsize) init_str = value; } - if (inp_type != DILLO_HTML_INPUT_UNKNOWN) { + if ((inp_type != DILLO_HTML_INPUT_UNKNOWN) && (resource || embed)) { if (!embed) embed = new Embed(resource); -- 2.47.3
This also prevents crashes due to resource == NULL Examples can be found at https://www.pythontutorial.net/python-oop/ --- src/form.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/form.cc b/src/form.cc index 038b94f3..e9b9c984 100644 --- a/src/form.cc +++ b/src/form.cc @@ -538,7 +538,8 @@ void Html_tag_open_input(DilloHtml *html, const char *tag, int tagsize) } else if (!dStrAsciiCasecmp(type, "button")) { inp_type = DILLO_HTML_INPUT_BUTTON; if (value) { - init_str = value; + label = value ? value : name ? name : "Submit"; + init_str = dStrdup(label); resource = factory->createLabelButtonResource(init_str); } } else { -- 2.47.3
Hi, Sorry for the delay. On Sat, Aug 22, 2026 at 09:24:22AM +0200, Andreas Kemnade wrote:
This also prevents crashes due to resource == NULL Examples can be found at https://www.pythontutorial.net/python-oop/ --- src/form.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/form.cc b/src/form.cc index 038b94f3..e9b9c984 100644 --- a/src/form.cc +++ b/src/form.cc @@ -538,7 +538,8 @@ void Html_tag_open_input(DilloHtml *html, const char *tag, int tagsize) } else if (!dStrAsciiCasecmp(type, "button")) { inp_type = DILLO_HTML_INPUT_BUTTON; if (value) {
We want to always create the button even with no value, so we need the resource.
- init_str = value; + label = value ? value : name ? name : "Submit";
From <https://html.spec.whatwg.org/multipage/input.html#button-state-(type=button)>:
If the element has a value attribute, the button's label must be the value of that attribute; otherwise, it must be the empty string.
I would also prefer to leave it empty to make it visible that the value is missing, otherwise you may not realize it has no value. I ended up merging the patch I wrote a while ago when the HTML fuzzer I'm testing triggered the same bug: https://git.dillo-browser.org/dillo/commit/?id=0a5e76decf21b042e6829a3616fe9... For the same reason, I want to avoid this:
- if (inp_type != DILLO_HTML_INPUT_UNKNOWN) { + if ((inp_type != DILLO_HTML_INPUT_UNKNOWN) && (resource || embed)) {
So it crashes when there is not resource and no embed. I added an assert: https://git.dillo-browser.org/dillo/commit/?id=784bedf88b37d70e283dd0490e3bd... There should be not more cases left in which we arrive with no resource or embed, but let me know otherwise. Thanks!, Rodrigo.
Hi Andreas, Thanks for the patch, I'll merge it with some other fixes for the HTML parser after I finish testing. Best, Rodrigo. On Sat, Aug 22, 2026 at 09:24:20AM +0200, Andreas Kemnade wrote:
There are input type="button" without value there, do not crash. The main repo seems not to have a pull request functionality, so I am using the good old git format-patch way, so it can be applied via git am.
Andreas Kemnade (2): do not crash at input tags which do neither produce resources or embeds form input: try to find defaults for buttons without a value
src/form.cc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
-- 2.47.3
_______________________________________________ Dillo-dev mailing list -- dillo-dev@mailman3.com To unsubscribe send an email to dillo-dev-leave@mailman3.com
participants (2)
-
Andreas Kemnade -
Rodrigo Arias