transfig/fig2dev-3.2.6a-style-overflow.patch

48 lines
1.6 KiB
Diff

Description: Sanitize input of fill patterns.
Bug-Debian: https://bugs.debian.org/881396
Author: Thomas Loimer <thomas.loimer@tuwien.ac.at>
--- a/fig2dev/read.c
+++ b/fig2dev/read.c
@@ -71,6 +71,8 @@ static int save_comment(void);
#define FILL_CONVERT(f) ((v2_flag || (f) < WHITE_FILL) \
? (v30_flag? f: (f-1)) : 20 - ((f)-1)*5)
+#define FILL_SANITIZE(f) ((f) < UNFILLED || (f) >= \
+ NUMSHADES + NUMTINTS + NUMPATTERNS) ? UNFILLED : f
/* input buffer size */
#define BUF_SIZE 1024
@@ -547,6 +549,7 @@ read_arcobject(FILE *fp)
}
a->thickness *= round(THICK_SCALE);
a->fill_style = FILL_CONVERT(a->fill_style);
+ a->fill_style = FILL_SANITIZE(a->fill_style);
NOTE_FILL(a);
fix_and_note_color(&a->pen_color);
if (fa) {
@@ -730,6 +733,7 @@ read_ellipseobject(void)
fix_and_note_color(&e->pen_color);
e->thickness *= round(THICK_SCALE);
e->fill_style = FILL_CONVERT(e->fill_style);
+ e->fill_style = FILL_SANITIZE(e->fill_style);
NOTE_FILL(e);
e->comments = attach_comments(); /* attach any comments */
return e;
@@ -895,6 +899,7 @@ read_lineobject(FILE *fp)
l->radius *= round(THICK_SCALE);
l->thickness *= round(THICK_SCALE);
l->fill_style = FILL_CONVERT(l->fill_style);
+ l->fill_style = FILL_SANITIZE(l->fill_style);
NOTE_FILL(l);
fix_and_note_color(&l->pen_color);
if (fa) {
@@ -1051,6 +1056,7 @@ read_splineobject(FILE *fp)
}
s->thickness *= round(THICK_SCALE);
s->fill_style = FILL_CONVERT(s->fill_style);
+ s->fill_style = FILL_SANITIZE(s->fill_style);
NOTE_FILL(s);
fix_and_note_color(&s->pen_color);
if (fa) {