Contents of /trunk/libXfont/patches/libXfont-1.2.7-bdf-fontdir.patch
Parent Directory | Revision Log
Revision 206 -
(show annotations)
(download)
Mon May 21 22:24:41 2007 UTC (17 years, 4 months ago) by niro
File size: 1445 byte(s)
Mon May 21 22:24:41 2007 UTC (17 years, 4 months ago) by niro
File size: 1445 byte(s)
-added new patches
1 | diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c |
2 | index acb77e9..a6f0c1e 100644 |
3 | --- a/src/bitmap/bdfread.c |
4 | +++ b/src/bitmap/bdfread.c |
5 | @@ -65,6 +65,12 @@ #include <X11/fonts/fontutil.h> |
6 | #include <X11/fonts/bitmap.h> |
7 | #include <X11/fonts/bdfint.h> |
8 | |
9 | +#if HAVE_STDINT_H |
10 | +#include <stdint.h> |
11 | +#elif !defined(INT32_MAX) |
12 | +#define INT32_MAX 0x7fffffff |
13 | +#endif |
14 | + |
15 | #define INDICES 256 |
16 | #define MAXENCODING 0xFFFF |
17 | #define BDFLINELEN 1024 |
18 | @@ -288,6 +294,11 @@ bdfReadCharacters(FontFilePtr file, Font |
19 | bdfError("invalid number of CHARS in BDF file\n"); |
20 | return (FALSE); |
21 | } |
22 | + if (nchars > INT32_MAX / sizeof(CharInfoRec)) { |
23 | + bdfError("Couldn't allocate pCI (%d*%d)\n", nchars, |
24 | + sizeof(CharInfoRec)); |
25 | + goto BAILOUT; |
26 | + } |
27 | ci = (CharInfoPtr) xalloc(nchars * sizeof(CharInfoRec)); |
28 | if (!ci) { |
29 | bdfError("Couldn't allocate pCI (%d*%d)\n", nchars, |
30 | diff --git a/src/fontfile/fontdir.c b/src/fontfile/fontdir.c |
31 | index aae1f2e..cf68a54 100644 |
32 | --- a/src/fontfile/fontdir.c |
33 | +++ b/src/fontfile/fontdir.c |
34 | @@ -38,9 +38,17 @@ #endif |
35 | #include <X11/fonts/fntfilst.h> |
36 | #include <X11/keysym.h> |
37 | |
38 | +#if HAVE_STDINT_H |
39 | +#include <stdint.h> |
40 | +#elif !defined(INT32_MAX) |
41 | +#define INT32_MAX 0x7fffffff |
42 | +#endif |
43 | + |
44 | Bool |
45 | FontFileInitTable (FontTablePtr table, int size) |
46 | { |
47 | + if (size < 0 || (size > INT32_MAX/sizeof(FontEntryRec))) |
48 | + return FALSE; |
49 | if (size) |
50 | { |
51 | table->entries = (FontEntryPtr) xalloc(sizeof(FontEntryRec) * size); |