transfig/0017-CVE-2021-32280.patch

30 lines
1003 B
Diff
Raw Normal View History

From fa5a2dced5cad973c3a9c9e83f21165942f1cd6d Mon Sep 17 00:00:00 2001
From: Ondrej Dubaj <odubaj@redhat.com>
Date: Thu, 23 Sep 2021 09:49:37 +0200
Subject: [PATCH] Do not crash on incomplete, closed splines
---
fig2dev/trans_spline.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/fig2dev/trans_spline.c b/fig2dev/trans_spline.c
index 0905c79..60c54ad 100644
--- a/fig2dev/trans_spline.c
+++ b/fig2dev/trans_spline.c
@@ -226,6 +226,12 @@ compute_closed_spline(F_spline *spline, float precision)
if (!init_point_array(300, 200))
return NULL;
+ if (!(spline->points /* p0 */ && spline->controls /* s0 */ &&
+ spline->points->next /* p1 */ && spline->controls->next /* s1 */ &&
+ spline->points->next->next && spline->controls->next->next/* p2, s2 */&&
+ spline->points->next->next->next && spline->controls->next->next->next))
+ return NULL;
+
INIT_CONTROL_POINTS(spline, p0, s0, p1, s1, p2, s2, p3, s3);
COPY_CONTROL_POINT(first, s_first, p0, s0);
--
2.31.1