summaryrefslogtreecommitdiff
path: root/Build/source/texk/dvipng/dvipng-src/dvi.c
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-04-05 01:43:07 +0000
committerKarl Berry <karl@freefriends.org>2019-04-05 01:43:07 +0000
commit234347a70dec6e5cafbabe3cd2341361c79f5b68 (patch)
treed800401ef769c7610b2e8d7e8cecc81b49e6d824 /Build/source/texk/dvipng/dvipng-src/dvi.c
parent72e906bbd57066848e40adbba6d154a5f7c190a7 (diff)
dvi and tfm parsing checks, reports from Andy Nguyen of ETH Zurich (with help from afl-fuzz in one case)
git-svn-id: svn://tug.org/texlive/trunk@50773 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipng/dvipng-src/dvi.c')
-rw-r--r--Build/source/texk/dvipng/dvipng-src/dvi.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/Build/source/texk/dvipng/dvipng-src/dvi.c b/Build/source/texk/dvipng/dvipng-src/dvi.c
index 7221c315c00..283088d8188 100644
--- a/Build/source/texk/dvipng/dvipng-src/dvi.c
+++ b/Build/source/texk/dvipng/dvipng-src/dvi.c
@@ -208,6 +208,12 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi)
break;
}
if (strlength > 0) { /* Read string */
+ if (strlength == UINT32_MAX
+ || strlength+1 > UINT32_MAX - (uint32_t)length) {
+ /* Have to check else we might not realloc buffer. */
+ Fatal("strlength %u + 1 + length %u would overflow",
+ strlength, (uint32_t)length);
+ }
if (strlength+1 + (uint32_t)length > commlen) {
/* string + command length exceeds that of buffer */
commlen=strlength+1 + (uint32_t)length;