X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=webcit%2Fhtml2html.c;h=4ac9a8fec9ecc9afc0ae9639dabd836c734e6b03;hb=2add3d7e0100be263626bf60a9aa16cf77a0782d;hp=e754587b2b96148f8b79f61b84443f79400c0bdd;hpb=87e79b9b7e6367cecde3abacd041aaae8ec7709a;p=citadel.git

diff --git a/webcit/html2html.c b/webcit/html2html.c
index e754587b2..4ac9a8fec 100644
--- a/webcit/html2html.c
+++ b/webcit/html2html.c
@@ -47,21 +47,23 @@ void output_html(void) {
 	while (serv_gets(buf), strcmp(buf, "000")) {
 		line_length = strlen(buf);
 		total_length = total_length + line_length + 1;
-		msg = realloc(msg, total_length);
+		msg = realloc(msg, total_length + 1);
 		strcpy(msgend, buf);
-		strcat(msgend, "\n");
-		msgend = &msgend[line_length + 1];
+		msgend[line_length++] = '\n' ;
+		msgend[line_length] = 0;
+		msgend = &msgend[line_length];
 	}
 
 	ptr = msg;
 	msgstart = msg;
-	msgend = &msg[total_length];
+	/* msgend is already set correctly */
 
 	while (ptr < msgend) {
 
 		/* Advance to next tag */
 		ptr = strchr(ptr, '<');
 		++ptr;
+		if ((ptr == NULL) || (ptr >= msgend)) break;
 
 		/* Any of these tags cause everything up to and including
 		 * the tag to be removed.
@@ -71,7 +73,9 @@ void output_html(void) {
 		   ||(!strncasecmp(ptr, "/HEAD", 5))
 		   ||(!strncasecmp(ptr, "BODY", 4)) ) {
 			ptr = strchr(ptr, '>');
+			if ((ptr == NULL) || (ptr >= msgend)) break;
 			++ptr;
+			if ((ptr == NULL) || (ptr >= msgend)) break;
 			msgstart = ptr;
 		}