diff options
Diffstat (limited to 'print/xpdf/patches/patch-aq')
| -rw-r--r-- | print/xpdf/patches/patch-aq | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/print/xpdf/patches/patch-aq b/print/xpdf/patches/patch-aq new file mode 100644 index 00000000000..26fca77eb60 --- /dev/null +++ b/print/xpdf/patches/patch-aq @@ -0,0 +1,32 @@ +$NetBSD: patch-aq,v 1.1 2006/01/22 23:13:33 tron Exp $ + +--- xpdf/JPXStream.cc.orig 2006-01-22 22:52:51.000000000 +0000 ++++ xpdf/JPXStream.cc 2006-01-22 22:48:31.000000000 +0000 +@@ -7,6 +7,7 @@ + //======================================================================== + + #include <aconf.h> ++#include <limits.h> + + #ifdef USE_GCC_PRAGMAS + #pragma implementation +@@ -818,13 +819,15 @@ + / img.xTileSize; + img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) + / img.yTileSize; +- nTiles = img.nXTiles * img.nYTiles; + // check for overflow before allocating memory +- if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) { +- error(getPos(), "Bad tile count in JPX SIZ marker segment"); +- return gFalse; ++ if (img.nXTiles <= 0 || img.nYTiles <= 0 || ++ img.nXTiles >= INT_MAX/img.nYTiles) { ++ error(getPos(), "Bad tile count in JPX SIZ marker segment"); ++ return gFalse; + } ++ nTiles = img.nXTiles * img.nYTiles; + img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile)); ++ + for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { + img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps, + sizeof(JPXTileComp)); |