29 lines
1.0 KiB
Diff
29 lines
1.0 KiB
Diff
From e5dcc36627ed4b19d12a70dc12f0f9eb51ae56ce Mon Sep 17 00:00:00 2001
|
|
From: Alx Sa <cmyk.student@gmail.com>
|
|
Date: Sat, 11 Apr 2026 14:33:42 +0000
|
|
Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken
|
|
|
|
Resolves #16206
|
|
pnmscanner_gettoken () in file-pnm assumes that the
|
|
buffer it receives is larger than its bufsize parameter.
|
|
In almost all cases this is true, except in pnm_load_ascii ().
|
|
This patch adds the + 4 that is used everywhere else to ensure
|
|
we don't have an issue with buffer overflow.
|
|
---
|
|
plug-ins/common/file-pnm.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c
|
|
index 65619be59d..81d73c1450 100644
|
|
--- a/plug-ins/common/file-pnm.c
|
|
+++ b/plug-ins/common/file-pnm.c
|
|
@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan,
|
|
gint x, y, i, b;
|
|
gint start, end, scanlines;
|
|
gint np;
|
|
- gchar buf[BUFLEN];
|
|
+ gchar buf[BUFLEN + 4];
|
|
gboolean aborted = FALSE;
|
|
|
|
np = (info->np) ? (info->np) : 1;
|