mirrors/emacs
1
Fork 0
mirror of git://git.sv.gnu.org/emacs.git synced 2025-12-17 11:20:39 -08:00
Code Issues Projects Releases Wiki Activity

Fix potential buffer overflow (bug#50767)

Browse source 
* src/image.c (svg_load_image): Check how many bytes were actually
written to the buffer.  Don't check xmalloc return value as xmalloc
doesn't return if it fails.
This commit is contained in:
Alan Third 2021-10-04 22:35:41 +01:00
parent ed9f5546aa
commit 7b6fb486c2
1 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/image.c
View file

@ -9996,10 +9996,16 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
if (!STRINGP (lcss))
{
/* Generate the CSS for the SVG image. */
const char *css_spec = "svg{font-family:\"%s\";font-size:%4dpx}";
int css_len = strlen (css_spec) + strlen (img->face_font_family);
/* FIXME: The below calculations leave enough space for a font
size up to 9999, if it overflows we just throw an error but
should probably increase the buffer size. */
const char *css_spec = "svg{font-family:\"%s\";font-size:%dpx}";
int css_len = strlen (css_spec) + strlen (img->face_font_family) + 1;
css = xmalloc (css_len);
snprintf (css, css_len, css_spec, img->face_font_family, img->face_font_size);
if (css_len <= snprintf (css, css_len, css_spec,
img->face_font_family, img->face_font_size))
goto rsvg_error;
rsvg_handle_set_stylesheet (rsvg_handle, (guint8 *)css, strlen (css), NULL);
}
else
@ -10157,12 +10163,11 @@ svg_load_image (struct frame *f, struct image *img, char *contents,
wrapped_contents = xmalloc (buffer_size);
if (!wrapped_contents
|| buffer_size <= snprintf (wrapped_contents, buffer_size, wrapper,
foreground & 0xFFFFFF, width, height,
viewbox_width, viewbox_height,
background & 0xFFFFFF,
SSDATA (encoded_contents)))
if (buffer_size <= snprintf (wrapped_contents, buffer_size, wrapper,
foreground & 0xFFFFFF, width, height,
viewbox_width, viewbox_height,
background & 0xFFFFFF,
SSDATA (encoded_contents)))
goto rsvg_error;
wrapped_size = strlen (wrapped_contents);