summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/t1lib-CVE-2010-2642.patch
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches/t1lib-CVE-2010-2642.patch')
-rw-r--r--gnu/packages/patches/t1lib-CVE-2010-2642.patch24
1 files changed, 24 insertions, 0 deletions
diff --git a/gnu/packages/patches/t1lib-CVE-2010-2642.patch b/gnu/packages/patches/t1lib-CVE-2010-2642.patch
new file mode 100644
index 0000000000..cd54889585
--- /dev/null
+++ b/gnu/packages/patches/t1lib-CVE-2010-2642.patch
@@ -0,0 +1,24 @@
+diff --git a/lib/t1lib/parseAFM.c b/lib/t1lib/parseAFM.c
+index 6a31d7f..ba64541 100644
+--- a/lib/t1lib/parseAFM.c
++++ b/lib/t1lib/parseAFM.c
+@@ -199,7 +199,9 @@ static char *token(stream)
+ idx = 0;
+
+ while (ch != EOF && ch != ' ' && ch != CR && ch != LF &&
+- ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
++ ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'
++ && idx < (MAX_NAME -1))
++ {
+ ident[idx++] = ch;
+ ch = fgetc(stream);
+ } /* while */
+@@ -235,7 +237,7 @@ static char *linetoken(stream)
+ while ((ch = fgetc(stream)) == ' ' || ch == '\t' );
+
+ idx = 0;
+- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
++ while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z && idx < (MAX_NAME - 1))
+ {
+ ident[idx++] = ch;
+ ch = fgetc(stream);