cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix buffer overflow in the get_next_text() function (CVE-2006-5864)

Browse Source 
from evince CVS
This commit is contained in:
steven 2006-12-30 12:41:39 +00:00
parent 83ba29a04d
commit f67ceb2007
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
graphics/evince/Makefile
View File

@ -1,8 +1,9 @@
# $OpenBSD: Makefile,v 1.4 2006/12/16 12:22:33 espie Exp $
# $OpenBSD: Makefile,v 1.5 2006/12/30 12:41:39 steven Exp $
COMMENT= "document viewer for multiple document formats"
DISTNAME= evince-0.5.2
PKGNAME= ${DISTNAME}p0
CATEGORIES= graphics print
HOMEPAGE= http://www.gnome.org/projects/evince/

23
graphics/evince/patches/patch-ps_ps_c Normal file
View File

@ -0,0 +1,23 @@
$OpenBSD: patch-ps_ps_c,v 1.1 2006/12/30 12:41:39 steven Exp $
--- ps/ps.c.orig Sat Dec 30 13:48:55 2006
+++ ps/ps.c Sat Dec 30 13:54:21 2006
@@ -1231,7 +1231,8 @@ get_next_text(line, next_char)
int level = 0;
quoted = 1;
line++;
- while(*line && !(*line == ')' && level == 0)) {
+ while(*line && !(*line == ')' && level == 0)
+ && (cp - text) < PSLINELENGTH - 1) {
if(*line == '\\') {
if(*(line + 1) == 'n') {
*cp++ = '\n';
@@ -1302,7 +1303,8 @@ get_next_text(line, next_char)
}
}
else {
- while(*line && !(*line == ' ' || *line == '\t' || *line == '\n'))
+ while(*line && !(*line == ' ' || *line == '\t' || *line == '\n')
+ && (cp - text) < PSLINELENGTH - 1)
*cp++ = *line++;
}
*cp = '\0';