transfig/CVE-2025-46398.patch
starlet-dx 817bc7b6e3 Fix CVE-2025-46397,CVE-2025-46398,CVE-2025-46399 and CVE-2025-46400
(cherry picked from commit 4b566e23152cd652f6ff32a9c55d5adc2cf366b9)
2025-04-29 14:07:48 +08:00

26 lines
926 B
Diff

Origin:
https://sourceforge.net/p/mcj/tickets/191/
https://sourceforge.net/p/mcj/fig2dev/ci/5f22009dba73922e98d49c0096cece8b215cd45b/
--- a/fig2dev/read.c
+++ b/fig2dev/read.c
@@ -190,7 +190,8 @@
}
/* check for embedded '\0' */
- if (strlen(buf) < sizeof buf - 1 && buf[strlen(buf) - 1] != '\n') {
+ if (*buf == '\0' || (strlen(buf) < sizeof buf - 1 &&
+ buf[strlen(buf) - 1] != '\n')) {
put_msg("ASCII NUL ('\\0') character within the first line.");
exit(EXIT_FAILURE);
/* seek to the end of the first line
@@ -239,7 +240,7 @@
the encoding given in the file */
if (!input_encoding && !strcmp(buf, "encoding: UTF-8\n")) {
input_encoding = "UTF-8";
- } else if (buf[strlen(buf) - 1] != '\n') {
+ } else if (*buf == '\0' || buf[strlen(buf) - 1] != '\n') {
/* seek forward to the end of the line;
comments here are not mentioned by the
specification, thus ignore this comment */