transfig/CVE-2025-31162.patch
starlet-dx 7f15fc12fe Fix CVE-2025-31162,CVE-2025-31163 and CVE-2025-31164
(cherry picked from commit 44bed95ae11315f3519cd360b026187325d4cd37)
2025-04-01 14:26:45 +08:00

22 lines
688 B
Diff

Origin:
https://sourceforge.net/p/mcj/tickets/185/
https://sourceforge.net/p/mcj/fig2dev/ci/da8992f44b84a337b4edaa67fc8b36b55eaef696/
--- a/fig2dev/object.h
+++ b/fig2dev/object.h
@@ -57,12 +57,13 @@
struct f_comment *next;
} F_comment;
+#define STYLE_VAL_MAX 6400.0 /* dash length 80 inches, that is enough */
#define COMMON_PROPERTIES(o) \
o->style < SOLID_LINE || o->style > DASH_3_DOTS_LINE || \
o->thickness < 0 || o->depth < 0 || o->depth > 999 || \
o->fill_style < UNFILLED || \
o->fill_style >= NUMSHADES + NUMTINTS + NUMPATTERNS || \
- o->style_val < 0.0
+ o->style_val < 0.0 || o->style_val > STYLE_VAL_MAX
typedef struct f_ellipse {
int type;