blob: 01289f0d861e60742add80ea9c70c0ae1b5da0c9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
diff -ur t1lib-5.1.2.orig/lib/t1lib/parseAFM.c t1lib-5.1.2/lib/t1lib/parseAFM.c
--- t1lib-5.1.2.orig/lib/t1lib/parseAFM.c 2007-12-23 16:49:42.000000000 +0100
+++ t1lib-5.1.2/lib/t1lib/parseAFM.c 2011-04-13 20:48:00.000000000 +0200
@@ -179,6 +179,8 @@
/*************************** PARSING ROUTINES **************/
+#define MAX_NAME_1 MAX_NAME-1 /* check for buffer overflow */
+
/*************************** token *************************/
/* A "AFM File Conventions" tokenizer. That means that it will
@@ -198,7 +200,8 @@
idx = 0;
- while (ch != EOF && ch != ' ' && ch != CR && ch != LF &&
+ while (idx < MAX_NAME_1 &&
+ ch != EOF && ch != ' ' && ch != CR && ch != LF &&
ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
ident[idx++] = ch;
ch = fgetc(stream);
@@ -235,7 +238,7 @@
while ((ch = fgetc(stream)) == ' ' || ch == '\t' );
idx = 0;
- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
+ while (idx < MAX_NAME_1 && ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
{
ident[idx++] = ch;
ch = fgetc(stream);
|