one more packet_length check

git-svn-id: svn://tug.org/texlive/trunk@50777 c570f23f-e606-0410-a88d-b1316a301751

1 files changed, 5 insertions, 0 deletions

diff --git a/Build/source/texk/dvipng/dvipng-src/pk.c b/Build/source/texk/dvipng/dvipng-src/pk.c
index 37be10fe32b..ed87f45e58b 100644
--- a/Build/source/texk/dvipng/dvipng-src/pk.c
+++ b/Build/source/texk/dvipng/dvipng-src/pk.c
@@ -383,6 +383,11 @@ void InitPK(struct font_entry * tfontp)
   tcharptr->length = packet_length;
   tcharptr->pkdata = position;
   tfontp->chr[c]=tcharptr;
+  if (tfontp->fmmap.size
+      < (char *)position-tfontp->fmmap.data + packet_length) {
+    Fatal("file too short (%u) to read past packet_length %u",
+          tfontp->fmmap.size, packet_length);
+  }
   position += packet_length;
   position = skip_specials(position);
   }