| --- misc/hunspell-1.3.2/src/hunspell/affixmgr.cxx 2010-02-27 12:59:53.000000000 +0100 |
| +++ misc/build/hunspell-1.3.2/src/hunspell/affixmgr.cxx 2011-05-18 16:29:45.919141893 +0200 |
| @@ -6,6 +6,8 @@ |
| #include <stdio.h> |
| #include <ctype.h> |
| |
| +#include <limits> |
| + |
| #include "affixmgr.hxx" |
| #include "affentry.hxx" |
| #include "langnum.hxx" |
| @@ -4000,7 +4002,10 @@ |
| case 3: { |
| np++; |
| numents = atoi(piece); |
| - if (numents == 0) { |
| + if ((numents <= 0) || |
| + ((::std::numeric_limits<size_t>::max() |
| + / sizeof(struct affentry)) < numents)) |
| + { |
| char * err = pHMgr->encode_flag(aflag); |
| if (err) { |
| HUNSPELL_WARNING(stderr, "error: line %d: bad entry number\n", |
| --- misc/hunspell-1.3.2/src/tools/munch.c 2010-02-27 21:49:49.000000000 +0100 |
| +++ misc/build/hunspell-1.3.2/src/tools/munch.c 2011-05-18 15:53:53.427072106 +0200 |
| @@ -4,6 +4,7 @@ |
| #include <string.h> |
| #include <unistd.h> |
| #include <stdlib.h> |
| +#include <stdint.h> |
| #include <stdio.h> |
| #include <sys/types.h> |
| #include <sys/stat.h> |
| @@ -233,10 +233,19 @@ |
| case 1: { achar = *piece; break; } |
| case 2: { if (*piece == 'Y') ff = XPRODUCT; break; } |
| case 3: { numents = atoi(piece); |
| - ptr = malloc(numents * sizeof(struct affent)); |
| - ptr->achar = achar; |
| - ptr->xpflg = ff; |
| - fprintf(stderr,"parsing %c entries %d\n",achar,numents); |
| + if ((numents < 0) || |
| + ((SIZE_MAX/sizeof(struct affent)) < numents)) |
| + { |
| + fprintf(stderr, |
| + "Error: too many entries: %d\n", numents); |
| + numents = 0; |
| + } else { |
| + ptr = malloc(numents * sizeof(struct affent)); |
| + ptr->achar = achar; |
| + ptr->xpflg = ff; |
| + fprintf(stderr,"parsing %c entries %d\n", |
| + achar,numents); |
| + } |
| break; |
| } |
| default: break; |
| --- misc/hunspell-1.3.2/src/tools/unmunch.c 2010-02-23 15:53:29.000000000 +0100 |
| +++ misc/build/hunspell-1.3.2/src/tools/unmunch.c 2011-05-18 20:53:43.843599726 +0200 |
| @@ -6,6 +6,7 @@ |
| #include <string.h> |
| #include <unistd.h> |
| #include <stdlib.h> |
| +#include <stdint.h> |
| #include <stdio.h> |
| #include <sys/types.h> |
| #include <sys/stat.h> |
| @@ -158,10 +159,19 @@ |
| case 1: { achar = *piece; break; } |
| case 2: { if (*piece == 'Y') ff = XPRODUCT; break; } |
| case 3: { numents = atoi(piece); |
| - ptr = malloc(numents * sizeof(struct affent)); |
| - ptr->achar = achar; |
| - ptr->xpflg = ff; |
| - fprintf(stderr,"parsing %c entries %d\n",achar,numents); |
| + if ((numents < 0) || |
| + ((SIZE_MAX/sizeof(struct affent)) < numents)) |
| + { |
| + fprintf(stderr, |
| + "Error: too many entries: %d\n", numents); |
| + numents = 0; |
| + } else { |
| + ptr = malloc(numents * sizeof(struct affent)); |
| + ptr->achar = achar; |
| + ptr->xpflg = ff; |
| + fprintf(stderr,"parsing %c entries %d\n", |
| + achar,numents); |
| + } |
| break; |
| } |
| default: break; |
