73a9fe0066
Cox. While these programs are not installed suid root, they are often used to prepare data for processing. These errors may permit remote attackers to cause a denial of service or execute arbitrary code in any programs or scripts that use these graphics conversion tools. http://marc.theaimsgroup.com/?l=bugtraq&m=104644687816522&w=2
34 lines
1.2 KiB
Plaintext
34 lines
1.2 KiB
Plaintext
$OpenBSD: patch-pbm_libpbm5_c,v 1.1 2003/03/29 04:13:54 brad Exp $
|
|
--- pbm/libpbm5.c.orig Sat May 6 02:30:12 2000
|
|
+++ pbm/libpbm5.c Fri Mar 28 20:22:06 2003
|
|
@@ -767,15 +767,18 @@ gotblankcol:
|
|
fn->frows = frows;
|
|
fn->fcols = fcols;
|
|
|
|
- glyph = (struct glyph*) malloc( sizeof(struct glyph) * 95 );
|
|
+ glyph = (struct glyph*) malloc2( sizeof(struct glyph), 95 );
|
|
if ( glyph == (struct glyph*) 0 )
|
|
pm_error( "out of memory allocating glyphs" );
|
|
|
|
- bmap = (char*) malloc( fn->maxwidth * fn->maxheight * 95 );
|
|
+ bmap = (char*) malloc3( fn->maxwidth, fn->maxheight, 95 );
|
|
if ( bmap == (char*) 0)
|
|
pm_error( "out of memory allocating glyph data" );
|
|
|
|
/* Now fill in the 0,0 coords. */
|
|
+ overflow2(char_height, 2);
|
|
+ overflow2(char_width, 2);
|
|
+
|
|
row = char_height * 2;
|
|
col = char_width * 2;
|
|
for ( ch = 0; ch < 95; ++ch )
|
|
@@ -1022,7 +1025,7 @@ char* name;
|
|
glyph->x = atoi(arg[3]);
|
|
glyph->y = atoi(arg[4]);
|
|
|
|
- if (!(glyph->bmap = (char*)malloc(glyph->width * glyph->height)))
|
|
+ if (!(glyph->bmap = (char*)malloc2(glyph->width, glyph->height)))
|
|
pm_error("no memory for font glyph byte map");
|
|
|
|
if (readline(fp, line, arg) < 0) { fclose(fp); return 0; }
|