From fb2bfce4ed49ac4656a8f7e5b5526e4838da1dde Mon Sep 17 00:00:00 2001 From: Christian Egli Date: Mon, 4 Jun 2018 14:11:50 +0200 Subject: [PATCH] Fix yet another buffer overflow in the braille table parser Reported by Henri Salo Fixes #592 diff --git a/liblouis/compileTranslationTable.c b/liblouis/compileTranslationTable.c index 2dc4c46..81a2ea1 100644 --- a/liblouis/compileTranslationTable.c +++ b/liblouis/compileTranslationTable.c @@ -4789,6 +4789,10 @@ includeFile (FileInfo * nested, CharsString * includedFile) int rv; for (k = 0; k < includedFile->length && k < MAXSTRING; k++) includeThis[k] = (char) includedFile->chars[k]; + if (k >= MAXSTRING) { + compileError(nested, "Include statement too long: 'include %s'", includeThis); + return 0; + } includeThis[k] = 0; tableFiles = resolveTable (includeThis, nested->fileName); if (tableFiles == NULL) @@ -4798,9 +4802,8 @@ includeFile (FileInfo * nested, CharsString * includedFile) } if (tableFiles[1] != NULL) { - errorCount++; free_tablefiles(tableFiles); - logMessage (LOG_ERROR, "Table list not supported in include statement: 'include %s'", includeThis); + compileError(nested, "Table list not supported in include statement: 'include %s'", includeThis); return 0; } rv = compileFile (*tableFiles);