8c77117e05
This package contains the executables for the teTeX installation as well as other files that were created when generating the binaries: info files, format files and manual pages.
67 lines
2.2 KiB
Text
67 lines
2.2 KiB
Text
$NetBSD: patch-ak,v 1.1.1.1 2005/03/31 22:09:18 hubertf Exp $
|
|
|
|
--- libs/xpdf/xpdf/XRef.cc.orig 2005-01-19 12:09:57.000000000 +0000
|
|
+++ libs/xpdf/xpdf/XRef.cc
|
|
@@ -28,6 +28,7 @@
|
|
#include "Error.h"
|
|
#include "ErrorCodes.h"
|
|
#include "XRef.h"
|
|
+#include <limits.h>
|
|
|
|
//------------------------------------------------------------------------
|
|
|
|
@@ -388,6 +389,10 @@ GBool XRef::readXRefTable(Parser *parser
|
|
if (newSize < 0) {
|
|
goto err1;
|
|
}
|
|
+ if (newSize >= INT_MAX/sizeof(XRefEntry)) {
|
|
+ error(-1, "Invalid 'newSize'");
|
|
+ goto err1;
|
|
+ }
|
|
entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
|
|
for (i = size; i < newSize; ++i) {
|
|
entries[i].offset = 0xffffffff;
|
|
@@ -493,6 +498,10 @@ GBool XRef::readXRefStream(Stream *xrefS
|
|
goto err1;
|
|
}
|
|
if (newSize > size) {
|
|
+ if (newSize >= INT_MAX/sizeof(XRefEntry)) {
|
|
+ error(-1, "Invalid 'newSize'");
|
|
+ goto err1;
|
|
+ }
|
|
entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
|
|
for (i = size; i < newSize; ++i) {
|
|
entries[i].offset = 0xffffffff;
|
|
@@ -583,6 +592,10 @@ GBool XRef::readXRefStreamSection(Stream
|
|
if (newSize < 0) {
|
|
return gFalse;
|
|
}
|
|
+ if (newSize >= INT_MAX / sizeof(XRefEntry)) {
|
|
+ error(-1, "Invalid 'obj' parameters.");
|
|
+ return gFalse;
|
|
+ }
|
|
entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
|
|
for (i = size; i < newSize; ++i) {
|
|
entries[i].offset = 0xffffffff;
|
|
@@ -718,6 +731,10 @@ GBool XRef::constructXRef() {
|
|
error(-1, "Bad object number");
|
|
return gFalse;
|
|
}
|
|
+ if (newSize >= INT_MAX / sizeof(XRefEntry)) {
|
|
+ error(-1, "Invalid 'newSize' parameters.");
|
|
+ return gFalse;
|
|
+ }
|
|
entries = (XRefEntry *)
|
|
grealloc(entries, newSize * sizeof(XRefEntry));
|
|
for (i = size; i < newSize; ++i) {
|
|
@@ -741,6 +758,10 @@ GBool XRef::constructXRef() {
|
|
} else if (!strncmp(p, "endstream", 9)) {
|
|
if (streamEndsLen == streamEndsSize) {
|
|
streamEndsSize += 64;
|
|
+ if (streamEndsSize >= INT_MAX/sizeof(int)) {
|
|
+ error(-1, "Invalid 'streamEndSize' parameter.");
|
|
+ return gFalse;
|
|
+ }
|
|
streamEnds = (Guint *)grealloc(streamEnds,
|
|
streamEndsSize * sizeof(int));
|
|
}
|