From 4de51dc882fca3fc5c0fbd268f61fb1788f52d2f Mon Sep 17 00:00:00 2001 From: shitamo Date: Sun, 18 Oct 2026 16:42:36 +0900 Subject: [PATCH] mlconfig: fix crash in width buttons on the font tab specify_width() located the ':' suffix with cp = strrchr(fontname, ':') but then parsed it with atoi(p + 1), where p is still uninitialized at that point. Pressing the widen/narrow/default width buttons with a font name containing ':' crashed mlconfig (segfault at address 1 inside strtol when p happened to be NULL). Parse from cp instead. --- tool/mlconfig/mc_font.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tool/mlconfig/mc_font.c b/tool/mlconfig/mc_font.c index 9833a0e0..512e41e2 100644 --- a/tool/mlconfig/mc_font.c +++ b/tool/mlconfig/mc_font.c @@ -337,7 +337,7 @@ static void specify_width(GtkWidget *widget, int flag) { int percent; size_t len; - if (!(cp = strrchr(fontname, ':')) || (percent = atoi(p + 1)) == 0) { + if (!(cp = strrchr(fontname, ':')) || (percent = atoi(cp + 1)) == 0) { if (flag == 0) { return; }