blob: 75fcc0fd35f8862742ca404eef6b3b3b9389423b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
$NetBSD: patch-bb,v 1.1 2011/01/10 20:16:56 drochner Exp $
--- backend/dvi/mdvi-lib/dviread.c.orig 2010-07-14 07:54:39.000000000 +0000
+++ backend/dvi/mdvi-lib/dviread.c
@@ -1537,6 +1537,10 @@ int special(DviContext *dvi, int opcode)
Int32 arg;
arg = dugetn(dvi, opcode - DVI_XXX1 + 1);
+ if (arg <= 0) {
+ dvierr(dvi, _("malformed special length\n"));
+ return -1;
+ }
s = mdvi_malloc(arg + 1);
dread(dvi, s, arg);
s[arg] = 0;
|
