From 9d0c8699c4a9f01ec5cc8aeb7e3b14956b3d51c1 Mon Sep 17 00:00:00 2001
From: Norbert Preining <norbert@preining.info>
Date: Mon, 6 Jan 2020 03:01:05 +0000
Subject: CTAN sync 202001060301

---
 dviware/dvipng/pk.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

(limited to 'dviware/dvipng/pk.c')

diff --git a/dviware/dvipng/pk.c b/dviware/dvipng/pk.c
index b1c316eee2..4e0b0c0e1b 100644
--- a/dviware/dvipng/pk.c
+++ b/dviware/dvipng/pk.c
@@ -18,7 +18,7 @@
   License along with this program. If not, see
   <http://www.gnu.org/licenses/>.
 
-  Copyright (C) 2002-2009 Jan-Åke Larsson
+  Copyright (C) 2002-2009, 2019 Jan-Åke Larsson
 
 ************************************************************************/
 
@@ -74,20 +74,23 @@ static uint32_t pk_packed_num(unsigned char** pos)
   }
 }
 
-static unsigned char* skip_specials(unsigned char* pos)
+static unsigned char* skip_specials(unsigned char* pos, unsigned char* end)
 {
   uint32_t    i;
 
-  while (*pos >= 240 && *pos != PK_POST) {
+  while (pos < end && *pos >= 240 && *pos != PK_POST) {
     i=0;
     switch (*pos++) {
     case 243:
       i = *pos++;
     case 242:
+      if (pos >= end) break;
       i = 256 * i + *pos++;
     case 241:
+      if (pos >= end) break;
       i = 256 * i + *pos++;
     case 240:
+      if (pos >= end) break;
       i = 256 * i + *pos++;
       DEBUG_PRINT(DEBUG_PK,("\n  PK SPECIAL\t'%.*s' ",(int)i,pos));
       pos += i;
@@ -308,7 +311,7 @@ void LoadPK(int32_t c, register struct char_entry * ptr)
 
 void InitPK(struct font_entry * tfontp)
 {
-  unsigned char* position;
+  unsigned char* position, *end;
   struct char_entry *tcharptr; /* temporary char_entry pointer  */
   uint32_t    hppp, vppp, packet_length;
   uint32_t    c;
@@ -318,7 +321,7 @@ void InitPK(struct font_entry * tfontp)
   if (MmapFile(tfontp->name,&(tfontp->fmmap)))
     Fatal("font file %s unusable", tfontp->name);
   position=(unsigned char*)tfontp->fmmap.data;
-  if (tfontp->fmmap.size < 2 || tfontp->fmmap.size < 3+*(position+2)+16)
+  if (tfontp->fmmap.size < 3 || tfontp->fmmap.size < 3+*(position+2)+16)
     Fatal("PK file %s ends prematurely",tfontp->name);
   if (*position++ != PK_PRE)
     Fatal("unknown font format in file %s",tfontp->name);
@@ -344,27 +347,29 @@ void InitPK(struct font_entry * tfontp)
   tfontp->magnification = (uint32_t)((uint64_t)hppp * 7227 * 5 / 65536l + 50)/100;
   position+=16;
   /* Read char definitions */
-  position = skip_specials(position);
-  while (*position != PK_POST) {
+  end=(unsigned char *) tfontp->fmmap.data+tfontp->fmmap.size;
+  position = skip_specials(position,end);
+  while (position < end && *position != PK_POST) {
     DEBUG_PRINT(DEBUG_PK,("\n  @%ld PK CHAR:\t%d",
-			  (long)position - (long)tfontp->fmmap.data, *position));
+			  (long)((char *)position - tfontp->fmmap.data), *position));
     if ((tcharptr = malloc(sizeof(struct char_entry))) == NULL)
       Fatal("cannot allocate space for char_entry");
     tcharptr->flag_byte = *position;
     tcharptr->data = NULL;
     tcharptr->tfmw = 0;
     if ((*position & 7) == 7) {
+      if (position >= end - 9) Fatal("PK file %s ends prematurely",tfontp->name);
       packet_length = UNumRead(position+1,4);
       c = UNumRead(position+5, 4);
       position += 9;
     } else if (*position & 4) {
-      packet_length = (*position & 3) * 65536l +
-	UNumRead(position+1, 2);
+      if (position >= end - 4) Fatal("PK file %s ends prematurely",tfontp->name);
+      packet_length = (*position & 3) * 65536l + UNumRead(position+1, 2);
       c = UNumRead(position+3, 1);
       position += 4;
     } else {
-      packet_length = (*position & 3) * 256 +
-	UNumRead(position+1, 1);
+      if (position >= end - 3) Fatal("PK file %s ends prematurely",tfontp->name);
+      packet_length = (*position & 3) * 256 +	UNumRead(position+1, 1);
       c = UNumRead(position+2, 1);
       position += 3;
     }
@@ -375,8 +380,9 @@ void InitPK(struct font_entry * tfontp)
   tcharptr->pkdata = position;
   tfontp->chr[c]=tcharptr;
   position += packet_length;
-  position = skip_specials(position);
+  position = skip_specials(position, end);
   }
+  if (position >= end) Fatal("PK file %s ends prematurely",tfontp->name);
 }
 
 static void UnLoadPK(struct char_entry *ptr)
-- 
cgit v1.2.3