From 40da851e961d4e85bd3daeb4b93ab50f5ae6da83 Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Fri, 5 Apr 2019 15:49:39 +0000 Subject: one more packet_length check git-svn-id: svn://tug.org/texlive/trunk@50777 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipng/dvipng-src/pk.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Build/source/texk/dvipng/dvipng-src/pk.c b/Build/source/texk/dvipng/dvipng-src/pk.c index 37be10fe32b..ed87f45e58b 100644 --- a/Build/source/texk/dvipng/dvipng-src/pk.c +++ b/Build/source/texk/dvipng/dvipng-src/pk.c @@ -383,6 +383,11 @@ void InitPK(struct font_entry * tfontp) tcharptr->length = packet_length; tcharptr->pkdata = position; tfontp->chr[c]=tcharptr; + if (tfontp->fmmap.size + < (char *)position-tfontp->fmmap.data + packet_length) { + Fatal("file too short (%u) to read past packet_length %u", + tfontp->fmmap.size, packet_length); + } position += packet_length; position = skip_specials(position); } -- cgit v1.2.3