commit b8fc9896338bd5d5b8c0f7fc492755bdec395cad
parent b294e4d2737d27f51b9b12acf9b72da1c38fcbff
Author: ukai <ukai>
Date: Tue, 20 Nov 2001 13:17:13 +0000
fix possible buffer overrun
Diffstat:
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,7 @@
+2001-11-20 Kiyokazu SUTO <suto@ks-and-ks.ne.jp>
+
+ * frame.c (newFrameSet): fix possible buffer overrun
+
2001-11-20 Fumitoshi UKAI <ukai@debian.or.jp>
* XXMakefile config.h: removed from CVS
diff --git a/frame.c b/frame.c
@@ -38,8 +38,10 @@ newFrameSet(struct parsed_tag *tag)
if (cols) {
length[i] = p = cols;
while (*p != '\0')
- if (*p++ == ',')
+ if (*p++ == ',') {
length[++i] = p;
+ if (i >= sizeof(length) / sizeof(length[0]) - 2) break;
+ }
length[++i] = p + 1;
}
if (i > 1) {
@@ -74,8 +76,10 @@ newFrameSet(struct parsed_tag *tag)
if (rows) {
length[i] = p = rows;
while (*p != '\0')
- if (*p++ == ',')
+ if (*p++ == ',') {
length[++i] = p;
+ if (i >= sizeof(length) / sizeof(length[0]) - 2) break;
+ }
length[++i] = p + 1;
}
if (i > 1) {