1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
# HG changeset patch
# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
# Date 1502890099 18000
# Node ID 54f48ab2d52a2a4af99781057075d8ea9744a649
# Parent 4970ea920a9388d6f08be1b35d58ef5efded4908
SVG: Fix buffer-overflow and inconsistent behavior in GetStyleTokens().
diff -r 4970ea920a93 -r 54f48ab2d52a coders/svg.c
--- a/coders/svg.c Tue Aug 15 08:05:00 2017 -0500
+++ b/coders/svg.c Wed Aug 16 08:28:19 2017 -0500
@@ -267,11 +267,12 @@
char
**tokens;
- register const char
+ const char
*p,
*q;
- register size_t
+ size_t
+ alloc_tokens,
i;
SVGInfo
@@ -279,21 +280,27 @@
svg_info=(SVGInfo *) context;
*number_tokens=0;
+ alloc_tokens=0;
if (text == (const char *) NULL)
return((char **) NULL);
/*
Determine the number of arguments.
+
+ style="fill: red; stroke: blue; stroke-width: 3"
*/
for (p=text; *p != '\0'; p++)
if (*p == ':')
- (*number_tokens)+=2;
- tokens=MagickAllocateMemory(char **,(*number_tokens+2)*sizeof(*tokens));
+ alloc_tokens+=2;
+ if (alloc_tokens == 0)
+ return((char **) NULL);
+ tokens=MagickAllocateMemory(char **,(alloc_tokens+2)*sizeof(*tokens));
if (tokens == (char **) NULL)
{
ThrowException3(svg_info->exception,ResourceLimitError,
MemoryAllocationFailed,UnableToConvertStringToTokens);
return((char **) NULL);
}
+ (void) memset(tokens,0,(alloc_tokens+2)*sizeof(*tokens));
/*
Convert string to an ASCII list.
*/
@@ -304,14 +311,36 @@
if ((*q != ':') && (*q != ';') && (*q != '\0'))
continue;
tokens[i]=AllocateString(p);
+ if (tokens[i] == NULL)
+ {
+ ThrowException3(svg_info->exception,ResourceLimitError,
+ MemoryAllocationFailed,UnableToConvertStringToTokens);
+ break;
+ }
(void) strlcpy(tokens[i],p,q-p+1);
- Strip(tokens[i++]);
+ Strip(tokens[i]);
+ i++;
+ if (i >= alloc_tokens)
+ break;
p=q+1;
}
- tokens[i]=AllocateString(p);
- (void) strlcpy(tokens[i],p,q-p+1);
- Strip(tokens[i++]);
+ if (i < alloc_tokens)
+ {
+ tokens[i]=AllocateString(p);
+ if (tokens[i] == NULL)
+ {
+ ThrowException3(svg_info->exception,ResourceLimitError,
+ MemoryAllocationFailed,UnableToConvertStringToTokens);
+ }
+ else
+ {
+ (void) strlcpy(tokens[i],p,q-p+1);
+ Strip(tokens[i]);
+ i++;
+ }
+ }
tokens[i]=(char *) NULL;
+ *number_tokens=i;
return(tokens);
}
|
