summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-04-05 15:49:39 +0000
committerKarl Berry <karl@freefriends.org>2019-04-05 15:49:39 +0000
commit40da851e961d4e85bd3daeb4b93ab50f5ae6da83 (patch)
treef9e481888e04f802a28e043f3355dc397382640a
parentcf926d445fa0c2b7a3e61b6206c1229f00cfe857 (diff)
one more packet_length check
git-svn-id: svn://tug.org/texlive/trunk@50777 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipng/dvipng-src/pk.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/Build/source/texk/dvipng/dvipng-src/pk.c b/Build/source/texk/dvipng/dvipng-src/pk.c
index 37be10fe32b..ed87f45e58b 100644
--- a/Build/source/texk/dvipng/dvipng-src/pk.c
+++ b/Build/source/texk/dvipng/dvipng-src/pk.c
@@ -383,6 +383,11 @@ void InitPK(struct font_entry * tfontp)
tcharptr->length = packet_length;
tcharptr->pkdata = position;
tfontp->chr[c]=tcharptr;
+ if (tfontp->fmmap.size
+ < (char *)position-tfontp->fmmap.data + packet_length) {
+ Fatal("file too short (%u) to read past packet_length %u",
+ tfontp->fmmap.size, packet_length);
+ }
position += packet_length;
position = skip_specials(position);
}