diff options
Diffstat (limited to 'dviware/dvipng/dvi.c')
-rw-r--r-- | dviware/dvipng/dvi.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/dviware/dvipng/dvi.c b/dviware/dvipng/dvi.c index 7221c315c0..139d0ea13c 100644 --- a/dviware/dvipng/dvi.c +++ b/dviware/dvipng/dvi.c @@ -18,7 +18,7 @@ License along with this program. If not, see <http://www.gnu.org/licenses/>. - Copyright (C) 2002-2015 Jan-Åke Larsson + Copyright (C) 2002-2015, 2019 Jan-Åke Larsson ************************************************************************/ @@ -208,6 +208,8 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi) break; } if (strlength > 0) { /* Read string */ + if (strlength > UINT32_MAX - (uint32_t)length - 1) + Fatal("integer overflow in DVI command length"); if (strlength+1 + (uint32_t)length > commlen) { /* string + command length exceeds that of buffer */ commlen=strlength+1 + (uint32_t)length; |