File transfig-e0c4b024.patch of Package transfig.8598

Overview Repositories Revisions Requests Users Attributes Meta

File transfig-e0c4b024.patch of Package transfig.8598

Based on e0c4b02429116b15ad1568c2c425f06b95b95830 Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Sat, 25 Aug 2018 20:46:45 +0200
Subject: [PATCH] Harden input in read.c, fixes tickets #27 and #28

Also fixes issues similar to those described in
https://sourceforge.net/p/mcj/tickets/27 and
https://sourceforge.net/p/mcj/tickets/28.
---
 fig2dev/read.c        |   51 ++++++++++++++++++++++++++++++++++----------------
 fig2dev/dev/readpcx.c |    2 -
 2 files changed, 35 insertions(+), 18 deletions(-)

--- fig2dev/read.c
+++ fig2dev/read.c	2018-08-30 12:32:32.261812846 +0000
@@ -188,12 +188,23 @@ F_compound	*obj;
 	int		object, coord_sys, len;
 
 	bzero((char*)obj, COMOBJ_SIZE);
+
 	(void) fgets(buf, BUF_SIZE, fp);	/* get the version line */
+	if (strncmp(buf, "#FIG ", 5)) {
+	    put_msg("Incorrect format string in first line of input file.");
+	    return -1;
+	}
+
 	len = strlen(buf);
-	if (len > 0)
-	    buf[len-1] = '\0';			/* remove newline */
-	if (buf[len-2] == '\r')
-	    buf[len-2] = '\0';			/* and any CR (from a PC perhaps) */
+	if (buf[len-1] == '\n') {
+	    if (buf[len-2] == '\r')
+		buf[len-2] = '\0';
+	    else
+		buf[len-1] = '\0';
+	} else {	/* fgets() only stops at newline and end-of-file */
+	    put_msg("File is truncated at first line.");
+	    return -1;
+	}
 
 	/* v2_flag is for version 2 or higher */
 	v2_flag = (!strncmp(buf, "#FIG 2", 6) || !strncmp(buf, "#FIG 3", 6));
@@ -745,6 +756,8 @@ FILE	*fp;
 	l->next = NULL;
 	l->join_style = 0;
 	l->cap_style = 0;        /* butt line cap */
+	l->pic = NULL;
+	l->comments = NULL;
 
 	sscanf(buf,"%*d%d",&l->type);	/* get the line type */
 
@@ -808,13 +821,18 @@ FILE	*fp;
 	    }
 	    l->back_arrow = make_arrow(type, style, thickness, wid, ht);
 	}
-    	if (l->type == T_PIC_BOX) {
-	    Pic_malloc(l->pic);
-	    l->pic->transp = -1;
-	    if (l->pic  == NULL) {
+	if (l->type == T_PIC_BOX) {
+	    if ((Pic_malloc(l->pic)) == NULL) {
 		free((char *) l);
 		return (NULL);
 	    }
+	    l->pic->transp = -1;
+	    l->pic->bitmap = NULL;
+#ifdef HAVE_X11_XPM_H
+	    /* initialize l->pic->xpmimage by (ab)using a
+	       public libxpm-function */
+	    XpmCreateXpmImageFromBuffer("", &l->pic->xpmimage, NULL);
+#endif
 	    if (get_line(fp) < 0 || 
 	      sscanf(buf, "%d %[^\n]", &l->pic->flipped, file) != 2) {
 	        put_msg(Err_incomp,
@@ -837,9 +855,8 @@ FILE	*fp;
 	    } else {
 		strcpy(l->pic->file, file);
 	    }
-    	} else
-	   l->pic = NULL;
-	
+    	}
+
 	if (NULL == (l->points = Point_malloc(p))) {
 	  put_msg(Err_mem);
 	  return(NULL);
@@ -903,6 +920,7 @@ FILE	*fp;
 	s->fill_style = 0;
 	s->for_arrow = NULL;
 	s->back_arrow = NULL;
+	s->comments = NULL;
 	s->next = NULL;
 
 	if (v30_flag) {
@@ -1075,6 +1093,7 @@ FILE	*fp;
 	Text_malloc(t);
 	t->font = 0;
 	t->size = 0.0;
+	t->comments = NULL;
 	t->next = NULL;
 
 	if (v30_flag) {	/* order of parms is more like other objects now,
@@ -1316,11 +1335,11 @@ get_line(fp)
 	if (*buf == '#') {			/* save any comments */
 	    if (save_comment(fp) < 0)
 		return -1;
-	} else if (*buf != '\n') {		/* Skip empty lines */
-	    len = strlen(buf);
-	    buf[len-1] = '\0';			/* strip trailing newline */
-	    if (buf[len-2] == '\r')
-		buf[len-2] = '\0';		/* strip any trailing CRs */
+	    /* skip empty lines */
+	} else if (*buf != '\n' || !(*buf == '\r' && buf[1] == '\n')) {
+	    /* remove newline and possibly a carriage return */
+	    if (buf[len-1] == '\n')
+		buf[len - (buf[len-2] == '\r' ? 2 : 1)] = '\0';
 	    return 1;
 	}
     }
--- fig2dev/dev/readpcx.c
+++ fig2dev/dev/readpcx.c	2018-08-30 12:27:06.379705298 +0000
@@ -86,8 +86,6 @@ _read_pcx(pcxfile,pic)
 	fprintf(tfp, "%% Begin Imported PCX File: %s\n\n", pic->file);
 	pic->subtype = P_PCX;
 
-	pic->bitmap=NULL;
-
 	fread(&header,1,sizeof(struct pcxhed),pcxfile);
 	if (header.manuf!=10 || header.encod!=1)
 	    return 0;

Places

File transfig-e0c4b024.patch of Package transfig.8598

Places