summaryrefslogtreecommitdiff
path: root/dviware/dvipng/dvi.c
diff options
context:
space:
mode:
authorNorbert Preining <norbert@preining.info>2020-01-06 03:01:05 +0000
committerNorbert Preining <norbert@preining.info>2020-01-06 03:01:05 +0000
commit9d0c8699c4a9f01ec5cc8aeb7e3b14956b3d51c1 (patch)
tree570162c5a6220ea63dffe4e5471f477e99e77c99 /dviware/dvipng/dvi.c
parentd703bc2777b69363e791c0ec50045947b1a399da (diff)
CTAN sync 202001060301
Diffstat (limited to 'dviware/dvipng/dvi.c')
-rw-r--r--dviware/dvipng/dvi.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/dviware/dvipng/dvi.c b/dviware/dvipng/dvi.c
index 7221c315c0..139d0ea13c 100644
--- a/dviware/dvipng/dvi.c
+++ b/dviware/dvipng/dvi.c
@@ -18,7 +18,7 @@
License along with this program. If not, see
<http://www.gnu.org/licenses/>.
- Copyright (C) 2002-2015 Jan-Åke Larsson
+ Copyright (C) 2002-2015, 2019 Jan-Åke Larsson
************************************************************************/
@@ -208,6 +208,8 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi)
break;
}
if (strlength > 0) { /* Read string */
+ if (strlength > UINT32_MAX - (uint32_t)length - 1)
+ Fatal("integer overflow in DVI command length");
if (strlength+1 + (uint32_t)length > commlen) {
/* string + command length exceeds that of buffer */
commlen=strlength+1 + (uint32_t)length;