procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix buffer overflow in xbm_scan (bug#47094)

Browse source 
* src/image.c (xbm_scan): Ensure reading a string doesn't overflow the
buffer.

(cherry picked from commit ebc3b25409)
This commit is contained in:
Alan Third 2021-03-13 21:59:59 +00:00 • committed by Eli Zaretskii
parent f60eb988f6
commit b9ec6111e2
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/image.c
View file

@ -3256,6 +3256,7 @@ static int
xbm_scan (char **s, char *end, char *sval, int *ival)
{
unsigned char c UNINIT;
char *sval_end = sval + BUFSIZ;
loop:
@ -3315,7 +3316,7 @@ xbm_scan (char **s, char *end, char *sval, int *ival)
else if (c_isalpha (c) || c == '_')
{
*sval++ = c;
while (*s < end
while (*s < end && sval < sval_end
&& (c = *(*s)++, (c_isalnum (c) || c == '_')))
*sval++ = c;
*sval = 0;