31ca292e2d
Multiple integer overflow issues affecting xpdf. These can result in writing an arbitrary byte to an attacker controlled location which probably could lead to arbitrary code execution. CAN-2004-0888 Multiple integer overflow issues. These can result in DoS or possibly arbitrary code execution. CAN-2004-0889 Chris also discovered issues with infinite loop logic error.
32 lines
1.2 KiB
Plaintext
32 lines
1.2 KiB
Plaintext
$OpenBSD: patch-xpdf_Catalog_cc,v 1.1 2004/10/23 02:24:37 brad Exp $
|
|
--- xpdf/Catalog.cc.orig Wed Jan 21 20:26:45 2004
|
|
+++ xpdf/Catalog.cc Fri Oct 22 21:54:48 2004
|
|
@@ -64,6 +64,15 @@ Catalog::Catalog(XRef *xrefA) {
|
|
}
|
|
pagesSize = numPages0 = (int)obj.getNum();
|
|
obj.free();
|
|
+ // The gcc doesnt optimize this away, so this check is ok,
|
|
+ // even if it looks like a pagesSize != pagesSize check
|
|
+ if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
|
|
+ pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
|
|
+ error(-1, "Invalid 'pagesSize'");
|
|
+ ok = gFalse;
|
|
+ return;
|
|
+ }
|
|
+
|
|
pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
|
|
pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
|
|
for (i = 0; i < pagesSize; ++i) {
|
|
@@ -191,6 +200,11 @@ int Catalog::readPageTree(Dict *pagesDic
|
|
}
|
|
if (start >= pagesSize) {
|
|
pagesSize += 32;
|
|
+ if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
|
|
+ pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
|
|
+ error(-1, "Invalid 'pagesSize' parameter.");
|
|
+ goto err3;
|
|
+ }
|
|
pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
|
|
pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
|
|
for (j = pagesSize - 32; j < pagesSize; ++j) {
|