Description: fix heap-based buffer over-read. Origin: upstream, commit: d2b032452241708bee68d02aa02092cfbfba951a Author: Christian Grothoff --- a/src/plugins/dvi_extractor.c +++ b/src/plugins/dvi_extractor.c @@ -182,6 +182,8 @@ size = ec->get_size (ec->cls); if (size > 16 * 1024 * 1024) return; /* too large */ + if (klen + 15 > size) + return; /* malformed klen */ if (NULL == (data = malloc ((size_t) size))) return; /* out of memory */ memcpy (data, buf, iret);