transfig/CVE-2025-46397.patch
starlet-dx 817bc7b6e3 Fix CVE-2025-46397,CVE-2025-46398,CVE-2025-46399 and CVE-2025-46400
(cherry picked from commit 4b566e23152cd652f6ff32a9c55d5adc2cf366b9)
2025-04-29 14:07:48 +08:00

50 lines
1.5 KiB
Diff

Origin:
https://sourceforge.net/p/mcj/tickets/192/
https://sourceforge.net/p/mcj/fig2dev/ci/dfa8b661b506a463a669754ed635b0a8eb67580e/
--- a/fig2dev/read.c 2025-04-29 13:52:18.589400762 +0800
+++ b/fig2dev/read.c 2025-04-29 13:55:48.807400762 +0800
@@ -1539,9 +1539,11 @@
free_splinestorage(s);
return NULL;
}
- if (lx < INT_MIN || lx > INT_MAX || ly < INT_MIN ||
- ly > INT_MAX || rx < INT_MIN || rx > INT_MAX ||
- ry < INT_MIN || ry > INT_MAX) {
+ if ( !isfinite(lx) || lx < INT_MIN || lx > INT_MAX ||
+ !isfinite(ly) || ly < INT_MIN || ly > INT_MAX ||
+ !isfinite(rx) || rx < INT_MIN || rx > INT_MAX ||
+ !isfinite(ry) || ry < INT_MIN || ry > INT_MAX)
+ {
/* do not care to clean up, we exit anyway
cp->next = NULL;
free_splinestorage(s); */
--- a/fig2dev/tests/read.at 2025-04-29 14:02:20.618400762 +0800
+++ b/fig2dev/tests/read.at 2025-04-29 14:03:13.226400762 +0800
@@ -595,6 +595,25 @@
])
AT_CLEANUP
+AT_SETUP([reject nan in spline controls values, #192])
+AT_KEYWORDS([read.c])
+# Use an output language that does not natively support Bezier splines.
+# Otherwise, the huge values are simply copied to the output.
+AT_CHECK([fig2dev -L epic <<EOF
+#FIG 3.1
+Landscape
+Center
+Metric
+1200 2
+3 2 0 1 0 7 50 -1 -1 0.0 0 0 0 2
+ 0 0 1200 0
+ 600 600 600 nan
+ 600 600 600 600
+EOF
+], 1, ignore, [Spline control points out of range at line 8.
+])
+AT_CLEANUP
+
AT_BANNER([Dynamically allocate picture file name.])
AT_SETUP([prepend fig file path to picture file name])