file.c | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 prevent crash after allocate string of negative size

form.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 prevent dereference near-null pointer in formupdatebuffer

file.c | 16 8 + 8 - 0 !
1 file changed, 8 insertions(+), 8 deletions(-)

 prevent infinite recursion in htmllineproc0

table.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 check indent_level to prevent infinite recursion

display.c | 8 4 + 4 - 0 !
file.c | 2 1 + 1 - 0 !
fm.h | 1 1 + 0 - 0 !
symbol.c | 4 2 + 2 - 0 !
4 files changed, 8 insertions(+), 7 deletions(-)

 prevent array index out of bounds for symbol

file.c | 5 4 + 1 - 0 !
1 file changed, 4 insertions(+), 1 deletion(-)

 prevent null pointer deref due to bad form id

anchor.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 prevent deref null pointer in shiftanchorposition()

file.c | 10 5 + 5 - 0 !
1 file changed, 5 insertions(+), 5 deletions(-)

 prevent deref null pointer in htmllineproc0()

url.c | 5 4 + 1 - 0 !
1 file changed, 4 insertions(+), 1 deletion(-)

 prevent global-buffer-overflow in parseurl()

libwc/ucs.c | 1 1 + 0 - 0 !
libwc/ucs.map | 43 43 + 0 - 0 !
2 files changed, 44 insertions(+)

 prevent global-buffer-overflow in wc_any_to_ucs()

file.c | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 prevent memory exhausted due to repeat appending "</table>"

menu.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix menu buffer-overflow

anchor.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 prevent negative array index for marks in shiftanchorposition()

file.c | 5 3 + 2 - 0 !
1 file changed, 3 insertions(+), 2 deletions(-)

 prevent negative array index in getmetarefreshparam()

file.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 prevent negative value of row for pushtable() in htmllineproc0()

file.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 prevent negative array index for marks in htmllineproc2body()

file.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 prevent negative array index in process_textarea()

table.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 prevent array index out of bounds for tabattr in feed_table_tag()

table.c | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 prevent negative array index in set_integered_width()

table.c | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 prevent array index out of bounds for tridvalue in feed_table_tag()

file.c | 8 6 + 2 - 0 !
1 file changed, 6 insertions(+), 2 deletions(-)

 prevent negative values for offset and pos in push_link()

file.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 prevent heap-use-after-free in htmllineproc0()

libwc/wtf.c | 6 4 + 2 - 0 !
1 file changed, 4 insertions(+), 2 deletions(-)

 prevent overflow beyond the end of string in wtf_strwidth() and wtf_len()

Str.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 prevent heap-buffer-overflow in strnew_size()

etc.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 prevent negative array index for realcolumn in calcposition()

file.c | 2 1 + 1 - 0 !
libwc/wtf.c | 11 8 + 3 - 0 !
libwc/wtf.h | 3 1 + 2 - 0 !
3 files changed, 10 insertions(+), 6 deletions(-)

 prevent overflow beyond the end of string in caller of get_mclen()

libwc/wtf.c | 6 4 + 2 - 0 !
1 file changed, 4 insertions(+), 2 deletions(-)

 prevent overflow beyond the end of string for wtf to wcs macros

file.c | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 prevent infinite loop in feed_textarea()

file.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 prevent heap-use-after-free read in htmllineproc0()

form.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 prevent invalid form_update_line() call in formupdatebuffer()

form.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 preserve one byte for end of string character in form_update_line()

libwc/wtf.c | 44 32 + 12 - 0 !
1 file changed, 32 insertions(+), 12 deletions(-)

 prevent overflow beyond the end of string in wtf_parse1()