summaryrefslogtreecommitdiff
path: root/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit
blob: 01289f0d861e60742add80ea9c70c0ae1b5da0c9 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
diff -ur t1lib-5.1.2.orig/lib/t1lib/parseAFM.c t1lib-5.1.2/lib/t1lib/parseAFM.c
--- t1lib-5.1.2.orig/lib/t1lib/parseAFM.c	2007-12-23 16:49:42.000000000 +0100
+++ t1lib-5.1.2/lib/t1lib/parseAFM.c	2011-04-13 20:48:00.000000000 +0200
@@ -179,6 +179,8 @@
 
 /*************************** PARSING ROUTINES **************/ 
   
+#define MAX_NAME_1 MAX_NAME-1   /* check for buffer overflow */
+
 /*************************** token *************************/
 
 /*  A "AFM File Conventions" tokenizer. That means that it will
@@ -198,7 +200,8 @@
     
     idx = 0;
     
-    while (ch != EOF && ch != ' ' && ch != CR  && ch != LF &&
+    while (idx < MAX_NAME_1 &&
+	   ch != EOF && ch != ' ' && ch != CR  && ch != LF &&
 	   ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
       ident[idx++] = ch;
       ch = fgetc(stream);
@@ -235,7 +238,7 @@
     while ((ch = fgetc(stream)) == ' ' || ch == '\t' ); 
     
     idx = 0;
-    while (ch != EOF && ch != CR  && ch != LF && ch != CTRL_Z) 
+    while (idx < MAX_NAME_1 && ch != EOF && ch != CR  && ch != LF && ch != CTRL_Z) 
     {
         ident[idx++] = ch;
         ch = fgetc(stream);