19 lines
705 B
Diff
19 lines
705 B
Diff
Description: Add check for buffer overflow with malformed input files
|
|
Author: <eriks@debian.org>
|
|
Bug-Debian: http://bugs.debian.org/407015
|
|
Last-Update: 2009-06-03
|
|
|
|
--- wordole.c 2005-08-26 21:49:57.000000000 +0200
|
|
+++ wordole.c 2009-06-03 22:31:15.948014682 +0200
|
|
@@ -259,6 +259,10 @@
|
|
}
|
|
tNameSize = (size_t)usGetWord(0x40, aucBytes);
|
|
tNameSize = (tNameSize + 1) / 2;
|
|
+ if ( tNameSize > sizeof(atPPSlist[iIndex].szName)) {
|
|
+ werr(0, "Name Size of PPS %d is too large", iIndex);
|
|
+ tNameSize = sizeof(atPPSlist[iIndex].szName);
|
|
+ }
|
|
vName2String(atPPSlist[iIndex].szName, aucBytes, tNameSize);
|
|
atPPSlist[iIndex].ucType = ucGetByte(0x42, aucBytes);
|
|
if (atPPSlist[iIndex].ucType == 5) {
|