summaryrefslogtreecommitdiff
path: root/dviware/dvipng/dvi.c
diff options
context:
space:
mode:
Diffstat (limited to 'dviware/dvipng/dvi.c')
-rw-r--r--dviware/dvipng/dvi.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/dviware/dvipng/dvi.c b/dviware/dvipng/dvi.c
index 7221c315c0..139d0ea13c 100644
--- a/dviware/dvipng/dvi.c
+++ b/dviware/dvipng/dvi.c
@@ -18,7 +18,7 @@
License along with this program. If not, see
<http://www.gnu.org/licenses/>.
- Copyright (C) 2002-2015 Jan-Åke Larsson
+ Copyright (C) 2002-2015, 2019 Jan-Åke Larsson
************************************************************************/
@@ -208,6 +208,8 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi)
break;
}
if (strlength > 0) { /* Read string */
+ if (strlength > UINT32_MAX - (uint32_t)length - 1)
+ Fatal("integer overflow in DVI command length");
if (strlength+1 + (uint32_t)length > commlen) {
/* string + command length exceeds that of buffer */
commlen=strlength+1 + (uint32_t)length;