summaryrefslogtreecommitdiff
path: root/Build/source/texk/dvipng/dvipng-src/dvi.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/texk/dvipng/dvipng-src/dvi.c')
-rw-r--r--Build/source/texk/dvipng/dvipng-src/dvi.c10
1 files changed, 3 insertions, 7 deletions
diff --git a/Build/source/texk/dvipng/dvipng-src/dvi.c b/Build/source/texk/dvipng/dvipng-src/dvi.c
index 283088d8188..139d0ea13c4 100644
--- a/Build/source/texk/dvipng/dvipng-src/dvi.c
+++ b/Build/source/texk/dvipng/dvipng-src/dvi.c
@@ -18,7 +18,7 @@
License along with this program. If not, see
<http://www.gnu.org/licenses/>.
- Copyright (C) 2002-2015 Jan-Åke Larsson
+ Copyright (C) 2002-2015, 2019 Jan-Åke Larsson
************************************************************************/
@@ -208,12 +208,8 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi)
break;
}
if (strlength > 0) { /* Read string */
- if (strlength == UINT32_MAX
- || strlength+1 > UINT32_MAX - (uint32_t)length) {
- /* Have to check else we might not realloc buffer. */
- Fatal("strlength %u + 1 + length %u would overflow",
- strlength, (uint32_t)length);
- }
+ if (strlength > UINT32_MAX - (uint32_t)length - 1)
+ Fatal("integer overflow in DVI command length");
if (strlength+1 + (uint32_t)length > commlen) {
/* string + command length exceeds that of buffer */
commlen=strlength+1 + (uint32_t)length;