summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMamoru Komachi <usata@gentoo.org>2004-09-28 05:32:26 +0000
committerMamoru Komachi <usata@gentoo.org>2004-09-28 05:32:26 +0000
commit0709339d39ad0b917b4a59fbb45aabf199557b6d (patch)
treee6cc1d5a531ab6231eae3d44403b0b3533b962d2 /dev-tex/latex2rtf/files
parentfix installation of sound packages, bug #65578 (Manifest recommit) (diff)
downloadgentoo-2-0709339d39ad0b917b4a59fbb45aabf199557b6d.tar.gz
gentoo-2-0709339d39ad0b917b4a59fbb45aabf199557b6d.tar.bz2
gentoo-2-0709339d39ad0b917b4a59fbb45aabf199557b6d.zip
Added a security fix extracted from Debian's patch. See bug #64947.
Diffstat (limited to 'dev-tex/latex2rtf/files')
-rw-r--r--dev-tex/latex2rtf/files/digest-latex2rtf-1.9.15-r21
-rw-r--r--dev-tex/latex2rtf/files/latex2rtf-1.9.15-definitions.c.diff51
2 files changed, 52 insertions, 0 deletions
diff --git a/dev-tex/latex2rtf/files/digest-latex2rtf-1.9.15-r2 b/dev-tex/latex2rtf/files/digest-latex2rtf-1.9.15-r2
new file mode 100644
index 000000000000..64ea060bdc7b
--- /dev/null
+++ b/dev-tex/latex2rtf/files/digest-latex2rtf-1.9.15-r2
@@ -0,0 +1 @@
+MD5 5aa723f290aa745ee3a37c3814901956 latex2rtf-1.9.15.tar.gz 605467
diff --git a/dev-tex/latex2rtf/files/latex2rtf-1.9.15-definitions.c.diff b/dev-tex/latex2rtf/files/latex2rtf-1.9.15-definitions.c.diff
new file mode 100644
index 000000000000..68f706aaa2f6
--- /dev/null
+++ b/dev-tex/latex2rtf/files/latex2rtf-1.9.15-definitions.c.diff
@@ -0,0 +1,51 @@
+--- latex2rtf-1.9.15.orig/definitions.c
++++ latex2rtf-1.9.15/definitions.c
+@@ -110,7 +110,8 @@
+ **************************************************************************/
+ {
+ int i=0,param;
+- char * args[9], *dmacro, *macro_piece, *next_piece, *expanded, buffer[1024], *cs;
++ char * args[9], *dmacro, *macro_piece, *next_piece, *expanded, *buffer = NULL, *cs;
++ int max_len = 0;
+
+ if (params<=0)
+ return strdup(macro);
+@@ -118,18 +119,28 @@
+ if (opt_param) {
+ args[i++] = getBracketParam();
+ if (!args[0]) args[0] = strdup(opt_param);
++ max_len += strlen(args[i-1]);
+ }
+
+ for (; i<params; i++) {
+ args[i] = getBraceParam();
++ max_len += strlen(args[i]);
+ diagnostics(3, "argument #%d <%s>", i+1, args[i]);
+ }
++
+
+- *buffer='\0';
+- expanded = buffer;
+ dmacro = strdup(macro);
+ macro_piece = dmacro;
++ max_len += strlen(macro_piece);
++
++ diagnostics(3, "max_len in expandmacro = %d\n", max_len);
++ if(max_len > 0) {
++ buffer = (char*)malloc(sizeof(char) * max_len);
++ memset(buffer,'\0',max_len);
++ }
+
++ expanded = buffer;
++
+ /* convert "\csname" to "\" */
+ while ((cs=strstr(dmacro, "\\csname")) != NULL) strcpy(cs+1,cs+7);
+
+@@ -176,6 +187,7 @@
+ if (args[i]) free(args[i]);
+
+ if (dmacro) free(dmacro);
++ if (buffer) free(buffer);
+
+ diagnostics(3, "expandmacro expanded=<%s>", buffer);
+ return strdup(buffer);