Commit Graph

6 Commits

Author SHA1 Message Date
Ray Lai
94b38bdb72 libdraw: replace hand-rolled realloc, preventing buffer overflow.
The original buffer is f->nsubf*sizeof *subf bytes (oldsize) large.
Once it's full, a new buffer of (f->nsubf+DSUBF)*sizeof *subf
(newsize) is mallocated.  Unfortunately memmove() reads (newsize)
bytes from the original (oldsize) buffer, causing a buffer overflow.

By switching to realloc(), we don't need to do buffer size calculation,
memmoving, and freeing of the original buffer.

Change-Id: Ibf85bc06abe1c8275b11acb1d7d346a14291d2cd
Reviewed-on: https://plan9port-review.googlesource.com/1520
Reviewed-by: Gleydson Soares <gsoares@gmail.com>
2017-04-08 00:06:42 +00:00
rsc
ca63c078d9 more places where display can be nil 2005-07-13 03:56:21 +00:00
rsc
d4aef6a074 handle arbitrary length names in subfontname.
handle overflow in offset computation in font.c
2005-05-12 16:55:14 +00:00
rsc
4e20688042 make it possible to access fonts without a display. 2004-04-25 20:26:27 +00:00
rsc
15680d56a6 Amazingly picky bug fixes from Valgrind. 2004-03-05 05:53:11 +00:00
rsc
76193d7cb0 Initial revision 2003-09-30 17:47:42 +00:00