73a9fe0066
Cox. While these programs are not installed suid root, they are often used to prepare data for processing. These errors may permit remote attackers to cause a denial of service or execute arbitrary code in any programs or scripts that use these graphics conversion tools. http://marc.theaimsgroup.com/?l=bugtraq&m=104644687816522&w=2
24 lines
803 B
Plaintext
24 lines
803 B
Plaintext
$OpenBSD: patch-pbm_pbmtolj_c,v 1.1 2003/03/29 04:13:54 brad Exp $
|
|
--- pbm/pbmtolj.c.orig Sun Oct 7 14:14:15 2001
|
|
+++ pbm/pbmtolj.c Fri Mar 28 20:22:06 2003
|
|
@@ -29,6 +29,7 @@
|
|
|
|
#include "pbm.h"
|
|
#include <assert.h>
|
|
+#include <string.h>
|
|
|
|
static int dpi = 75;
|
|
static int floating = 0; /* suppress the ``ESC & l 0 E'' ? */
|
|
@@ -122,7 +123,11 @@ main( argc, argv )
|
|
pbm_readpbminit( ifp, &cols, &rows, &format );
|
|
bitrow = pbm_allocrow( cols );
|
|
|
|
+ overflow_add(cols, 8);
|
|
rowBufferSize = (cols + 7) / 8;
|
|
+ overflow_add(rowBufferSize, 128);
|
|
+ overflow_add(rowBufferSize, rowBufferSize+128);
|
|
+ overflow_add(rowBufferSize+10, rowBufferSize/8);
|
|
packBufferSize = rowBufferSize + (rowBufferSize + 127) / 128 + 1;
|
|
deltaBufferSize = rowBufferSize + rowBufferSize / 8 + 10;
|
|
|