transfig/CVE-2025-31164.patch
starlet-dx 7f15fc12fe Fix CVE-2025-31162,CVE-2025-31163 and CVE-2025-31164
(cherry picked from commit 44bed95ae11315f3519cd360b026187325d4cd37)
2025-04-01 14:26:45 +08:00

42 lines
1.0 KiB
Diff

Origin:
https://sourceforge.net/p/mcj/tickets/184/
https://sourceforge.net/p/mcj/fig2dev/ci/ff9aba206a30288f456dfc91584a52ba9927b438/
--- a/fig2dev/read.c
+++ b/fig2dev/read.c
@@ -1058,6 +1058,14 @@
line_no);
return -1;
}
+ if (l->type == T_ARC_BOX && l->radius == 0) {
+ put_msg("A %s, but zero corner radius "
+ "at line %d - convert "
+ "to a rectangle.",
+ obj_name[l->type - 2],
+ line_no);
+ l->type = T_BOX;
+ }
}
} else { /* T_BOX || T_POLYGON */
--- a/fig2dev/tests/read.at
+++ b/fig2dev/tests/read.at
@@ -123,6 +123,17 @@
])
AT_CLEANUP
+AT_SETUP([convert an arc-box with zero radius to a box])
+AT_KEYWORDS(read.c arc-box)
+AT_CHECK([fig2dev -L pict2e <<EOF
+FIG_FILE_TOP
+2 4 1 1 0 0 50 -1 -1 4.0 0 0 0 0 0 5
+ 0 0 300 0 300 300 0 300 0 0
+EOF
+],0,ignore,[A rectangle with rounded corners, but zero corner radius at line 11 - convert to a rectangle.
+])
+AT_CLEANUP
+
AT_SETUP([fail on a malformed arc-box])
AT_KEYWORDS(read.c malformed arc-box)
AT_CHECK([fig2dev -L pict2e <<EOF