transfig/CVE-2025-31162.patch

22 lines
688 B
Diff
Raw Normal View History

Origin:
https://sourceforge.net/p/mcj/tickets/185/
https://sourceforge.net/p/mcj/fig2dev/ci/da8992f44b84a337b4edaa67fc8b36b55eaef696/
--- a/fig2dev/object.h
+++ b/fig2dev/object.h
@@ -57,12 +57,13 @@
struct f_comment *next;
} F_comment;
+#define STYLE_VAL_MAX 6400.0 /* dash length 80 inches, that is enough */
#define COMMON_PROPERTIES(o) \
o->style < SOLID_LINE || o->style > DASH_3_DOTS_LINE || \
o->thickness < 0 || o->depth < 0 || o->depth > 999 || \
o->fill_style < UNFILLED || \
o->fill_style >= NUMSHADES + NUMTINTS + NUMPATTERNS || \
- o->style_val < 0.0
+ o->style_val < 0.0 || o->style_val > STYLE_VAL_MAX
typedef struct f_ellipse {
int type;