Contents of /trunk/libwmf/patches/libwmf-0.2.8.4-intoverflow.patch
Parent Directory | Revision Log
Revision 1411 -
(show annotations)
(download)
Wed Jul 13 15:50:22 2011 UTC (13 years, 2 months ago) by niro
File size: 971 byte(s)
Wed Jul 13 15:50:22 2011 UTC (13 years, 2 months ago) by niro
File size: 971 byte(s)
-added libwmf patches
1 | --- libwmf-0.2.8.4.orig/src/player.c 2002-12-10 19:30:26.000000000 +0000 |
2 | +++ libwmf-0.2.8.4/src/player.c 2006-07-12 15:12:52.000000000 +0100 |
3 | @@ -42,6 +42,7 @@ |
4 | #include "player/defaults.h" /* Provides: default settings */ |
5 | #include "player/record.h" /* Provides: parameter mechanism */ |
6 | #include "player/meta.h" /* Provides: record interpreters */ |
7 | +#include <stdint.h> |
8 | |
9 | /** |
10 | * @internal |
11 | @@ -132,8 +134,14 @@ |
12 | } |
13 | } |
14 | |
15 | -/* P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char)); |
16 | - */ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char)); |
17 | + if (MAX_REC_SIZE(API) > UINT32_MAX / 2) |
18 | + { |
19 | + API->err = wmf_E_InsMem; |
20 | + WMF_DEBUG (API,"bailing..."); |
21 | + return (API->err); |
22 | + } |
23 | + |
24 | + P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char)); |
25 | |
26 | if (ERR (API)) |
27 | { WMF_DEBUG (API,"bailing..."); |