summaryrefslogtreecommitdiff
path: root/Build/source/texk/dvipng/dvipng-src/dvi.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/texk/dvipng/dvipng-src/dvi.c')
-rw-r--r--Build/source/texk/dvipng/dvipng-src/dvi.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/Build/source/texk/dvipng/dvipng-src/dvi.c b/Build/source/texk/dvipng/dvipng-src/dvi.c
index 7221c315c00..283088d8188 100644
--- a/Build/source/texk/dvipng/dvipng-src/dvi.c
+++ b/Build/source/texk/dvipng/dvipng-src/dvi.c
@@ -208,6 +208,12 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi)
break;
}
if (strlength > 0) { /* Read string */
+ if (strlength == UINT32_MAX
+ || strlength+1 > UINT32_MAX - (uint32_t)length) {
+ /* Have to check else we might not realloc buffer. */
+ Fatal("strlength %u + 1 + length %u would overflow",
+ strlength, (uint32_t)length);
+ }
if (strlength+1 + (uint32_t)length > commlen) {
/* string + command length exceeds that of buffer */
commlen=strlength+1 + (uint32_t)length;