html.c: avoid out-of-bounds access for url_escape_table

This fixes a segfault for me with with -O2 optimization on x86
with gcc (Debian 4.4.5-8) 4.4.5

I can reliably reproduce it with the following parameters
when pointed to the git.git repository:

PATH_INFO='/git-core.git/diff/'
QUERY_STRING='id=2b93bfac0f5bcabbf60f174f4e7bfa9e318e64d5&id2=d6da71a9d16b8cf27f9d8f90692d3625c849cbc8'

Signed-off-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/html.c b/html.c
index 24a03a5..5b07aa0 100644
--- a/html.c
+++ b/html.c
@@ -101,146 +101,146 @@ void html_txt(const char *txt)
                         else if (c=='<')
                                 html("&lt;");
                         else if (c=='&')
                                 html("&amp;");
                         txt = t+1;
                 }
                 t++;
         }
         if (t!=txt)
                 html(txt);
 }
 
 void html_ntxt(int len, const char *txt)
 {
         const char *t = txt;
         while(t && *t && len--){
                 int c = *t;
                 if (c=='<' || c=='>' || c=='&') {
                         html_raw(txt, t - txt);
                         if (c=='>')
                                 html("&gt;");
                         else if (c=='<')
                                 html("&lt;");
                         else if (c=='&')
                                 html("&amp;");
                         txt = t+1;
                 }
                 t++;
         }
         if (t!=txt)
                 html_raw(txt, t - txt);
         if (len<0)
                 html("...");
 }
 
 void html_attr(const char *txt)
 {
         const char *t = txt;
         while(t && *t){
                 int c = *t;
                 if (c=='<' || c=='>' || c=='\'' || c=='\"' || c=='&') {
                         html_raw(txt, t - txt);
                         if (c=='>')
                                 html("&gt;");
                         else if (c=='<')
                                 html("&lt;");
                         else if (c=='\'')
                                 html("&#x27;");
                         else if (c=='"')
                                 html("&quot;");
                         else if (c=='&')
                                 html("&amp;");
                         txt = t+1;
                 }
                 t++;
         }
         if (t!=txt)
                 html(txt);
 }
 
 void html_url_path(const char *txt)
 {
         const char *t = txt;
         while(t && *t){
-                int c = *t;
+                unsigned char c = *t;
                 const char *e = url_escape_table[c];
                 if (e && c!='+' && c!='&') {
                         html_raw(txt, t - txt);
                         html(e);
                         txt = t+1;
                 }
                 t++;
         }
         if (t!=txt)
                 html(txt);
 }
 
 void html_url_arg(const char *txt)
 {
         const char *t = txt;
         while(t && *t){
-                int c = *t;
+                unsigned char c = *t;
                 const char *e = url_escape_table[c];
                 if (c == ' ')
                         e = "+";
                 if (e) {
                         html_raw(txt, t - txt);
                         html(e);
                         txt = t+1;
                 }
                 t++;
         }
         if (t!=txt)
                 html(txt);
 }
 
 void html_hidden(const char *name, const char *value)
 {
         html("<input type='hidden' name='");
         html_attr(name);
         html("' value='");
         html_attr(value);
         html("'/>");
 }
 
 void html_option(const char *value, const char *text, const char *selected_value)
 {
         html("<option value='");
         html_attr(value);
         html("'");
         if (selected_value && !strcmp(selected_value, value))
                 html(" selected='selected'");
         html(">");
         html_txt(text);
         html("</option>\n");
 }
 
 void html_link_open(const char *url, const char *title, const char *class)
 {
         html("<a href='");
         html_attr(url);
         if (title) {
                 html("' title='");
                 html_attr(title);
         }
         if (class) {
                 html("' class='");
                 html_attr(class);
         }
         html("'>");
 }
 
 void html_link_close(void)
 {
         html("</a>");
 }
 
 void html_fileperm(unsigned short mode)
 {
         htmlf("%c%c%c", (mode & 4 ? 'r' : '-'),
               (mode & 2 ? 'w' : '-'), (mode & 1 ? 'x' : '-'));
 }
 
 int html_include(const char *filename)
 {
         FILE *f;