Merge with main repo.

7 files changed, 50 insertions, 10 deletions

diff --git a/dillorc b/dillorc
index 393eb6b9..f743066d 100644
--- a/dillorc
+++ b/dillorc
@@ -146,7 +146,7 @@
 # Format: search_url="[<label> ]<url>"
 # You can enable multiple search_url strings at once and select from among
 # them at runtime, with the first being the default.
-search_url="http://duckduckgo.com/lite/?kp=-1&q=%s"
+search_url="DuckDuckGo http://duckduckgo.com/lite/?kp=-1&q=%s"
 search_url="Wikipedia http://www.wikipedia.org/w/index.php?search=%s&go=Go"
 search_url="Free Dictionary http://www.thefreedictionary.com/%s"
 search_url="Google http://www.google.com/search?ie=UTF-8&oe=UTF-8&q=%s"
diff --git a/lout/identity.cc b/lout/identity.cc
index aecd9d5f..c9cb7ece 100644
--- a/lout/identity.cc
+++ b/lout/identity.cc
@@ -111,7 +111,7 @@ bool IdentifiableObject::instanceOf (int otherClassId)
 
    if (otherClass == NULL) {
       fprintf (stderr,
-               "WARNING: Something got wrong here, it seems that a "
+               "WARNING: Something got wrong here, it seems that a "
                "CLASS_ID was not initialized properly.\n");
       return false;
    }
diff --git a/src/gif.c b/src/gif.c
index 69fcf5d3..7ce1e110 100644
--- a/src/gif.c
+++ b/src/gif.c
@@ -287,13 +287,15 @@ static inline size_t Gif_data_blocks(const uchar_t *Buf, size_t BSize)
  */
 static inline size_t Gif_do_generic_ext(const uchar_t *Buf, size_t BSize)
 {
-   size_t Size = Buf[0] + 1, DSize;
+
+   size_t Size = Buf[0] + 1,  /* (uchar_t + 1) can't overflow size_t */
+          DSize;
 
    /* The Block size (the first byte) is supposed to be a specific size
     * for each extension... we don't check.
     */
 
-   if (Buf[0] > BSize)
+   if (Size > BSize)
       return 0;
    DSize = Gif_data_blocks(Buf + Size, BSize - Size);
    if (!DSize)
diff --git a/src/html.cc b/src/html.cc
index 52c4bb1f..35f5bf02 100644
--- a/src/html.cc
+++ b/src/html.cc
@@ -544,6 +544,8 @@ int DilloHtml::getCurTagLineNumber()
    const char *p = Start_Buf;
 
    dReturn_val_if_fail(p != NULL, -1);
+   /* Disable line counting for META hack. Buffers differ. */
+   dReturn_val_if((InFlags & IN_META_HACK), -1);
 
    ofs = CurrTagOfs;
    line = OldTagLine;
@@ -1498,7 +1500,8 @@ static void Html_parse_doctype(DilloHtml *html, const char *tag, int tagsize)
    static const char XHTML11    [] = "-//W3C//DTD XHTML 1.1";
    static const char XHTML11_url[] = "http://www.w3.org/TR/xhtml11/DTD/";
 
-   int i, quote;
+   size_t i;
+   int quote;
    char *p, *ntag = dStrndup(tag, tagsize);
 
    /* Tag sanitization: Collapse whitespace between tokens
@@ -1523,7 +1526,8 @@ static void Html_parse_doctype(DilloHtml *html, const char *tag, int tagsize)
    _MSG("New: {%s}\n", ntag);
 
    /* The default DT_NONE type is TagSoup */
-   if (!dStrnAsciiCasecmp(ntag, HTML_SGML_sig, strlen(HTML_SGML_sig))) {
+   if (i > strlen(HTML_SGML_sig) && // avoid out of bounds reads!
+       !dStrnAsciiCasecmp(ntag, HTML_SGML_sig, strlen(HTML_SGML_sig))) {
       p = ntag + strlen(HTML_SGML_sig) + 1;
       if (!strncmp(p, HTML401, strlen(HTML401)) &&
           dStriAsciiStr(p + strlen(HTML401), HTML401_url)) {
@@ -2867,7 +2871,7 @@ static void Html_tag_open_meta(DilloHtml *html, const char *tag, int tagsize)
          } else {
             mr_url = dStrdup(content);
          }
-         new_url = a_Url_new(mr_url, URL_STR(html->base_url));
+         new_url = a_Html_url_new(html, mr_url, NULL, 0);
 
          if (a_Url_cmp(html->base_url, new_url) == 0) {
             /* redirection loop, or empty url string: ignore */
@@ -2883,11 +2887,11 @@ static void Html_tag_open_meta(DilloHtml *html, const char *tag, int tagsize)
              * TODO: This is a hairy hack,
              *       It'd be much better to build a widget. */
             Dstr *ds_msg = dStr_sized_new(256);
-            dStr_sprintf(ds_msg, meta_template, mr_url, delay_str);
+            dStr_sprintf(ds_msg, meta_template, URL_STR(new_url), delay_str);
             {
                int o_InFlags = html->InFlags;
                int o_TagSoup = html->TagSoup;
-               html->InFlags = IN_BODY;
+               html->InFlags = IN_BODY + IN_META_HACK;
                html->TagSoup = false;
                Html_write_raw(html, ds_msg->str, ds_msg->len, 0);
                html->TagSoup = o_TagSoup;
diff --git a/src/html_common.hh b/src/html_common.hh
index 44730a57..98553439 100644
--- a/src/html_common.hh
+++ b/src/html_common.hh
@@ -86,6 +86,7 @@ typedef enum {
    IN_MAP         = 1 << 9,
    IN_PRE         = 1 << 10,
    IN_LI          = 1 << 11,
+   IN_META_HACK   = 1 << 12,
 } DilloHtmlProcessingState;
 
 /*
diff --git a/src/uicmd.cc b/src/uicmd.cc
index e286ee9c..84e7e4cd 100644
--- a/src/uicmd.cc
+++ b/src/uicmd.cc
@@ -70,6 +70,7 @@ static const char *save_dir = "";
  */
 static BrowserWindow *UIcmd_tab_new(CustTabs *tabs, UI *old_ui, int focus);
 static void close_tab_btn_cb (Fl_Widget *w, void *cb_data);
+static char *UIcmd_make_search_str(const char *str);
 
 //----------------------------------------------------------------------------
 
@@ -649,6 +650,33 @@ void a_UIcmd_close_all_bw(void *)
 }
 
 /*
+ * Return a search string of the suffix if str starts with a
+ * prefix of a search engine name and a blank
+ */
+static char *UIcmd_find_search_str(const char *str)
+{
+   int p;
+   char *url = NULL;
+   int len = strcspn(str, " ");
+
+   if (len > 0 && str[len] != '\0') {
+      /* we found a ' ' in str, check whether the first part of str
+       * is a prefix of a search_url label
+       */
+      for (p = 0; p < dList_length(prefs.search_urls); p++) {
+         const char *search =
+            (const char *)dList_nth_data(prefs.search_urls, p);
+         if (strncasecmp(str, search, len) == 0) {
+            prefs.search_url_idx = p;
+            url = UIcmd_make_search_str(str + len + 1);
+            break;
+         }
+      }
+   }
+   return url;
+}
+
+/*
  * Open a new URL in the given browser window.
  *
  * our custom "file:" URIs are normalized here too.
@@ -656,10 +684,14 @@ void a_UIcmd_close_all_bw(void *)
 void a_UIcmd_open_urlstr(void *vbw, const char *urlstr)
 {
    char *new_urlstr;
+   char *search_urlstr = NULL;
    DilloUrl *url;
    int ch;
    BrowserWindow *bw = (BrowserWindow*)vbw;
 
+   if ((search_urlstr = UIcmd_find_search_str(urlstr))) {
+      urlstr = search_urlstr;
+   }
    if (urlstr && *urlstr) {
       /* Filter URL string */
       new_urlstr = a_Url_string_strip_delimiters(urlstr);
@@ -686,6 +718,7 @@ void a_UIcmd_open_urlstr(void *vbw, const char *urlstr)
          a_Url_free(url);
       }
    }
+   dFree(search_urlstr);
 }
 
 /*
diff --git a/src/url.c b/src/url.c
index e0349c30..c33bca00 100644
--- a/src/url.c
+++ b/src/url.c
@@ -263,7 +263,7 @@ static Dstr *Url_resolve_relative(const char *RelStr,
       } else if (BaseUrl->path) {                     /* relative path */
          dStr_append(Path, BaseUrl->path);
          for (i = Path->len; --i >= 0 && Path->str[i] != '/'; ) ;
-         if (Path->str[i] == '/')
+         if (i >= 0 && Path->str[i] == '/')
             dStr_truncate(Path, ++i);
       }
       if (RelUrl->path)