[bug-enscript] [bug #38998] get_next_token() crash

[Tim Waugh]

URL:
  <http://savannah.gnu.org/bugs/?38998>

                 Summary: get_next_token() crash
                 Project: GNU Enscript
            Submitted by: twaugh
            Submitted on: Wed 15 May 2013 13:56:36 GMT
                Category: None
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

There is insufficient bounds checking in the get_next_token() function in
psgen.c.

1931                          else if (bufpos - 2 > w
1932                                   && ISOCTAL (buffer[bufpos])
1933                                   && ISOCTAL (buffer[bufpos - 1])
1934                                   && ISOCTAL (buffer[bufpos - 2])
1935                                   && buffer[bufpos - 3] == '\\')

bufpos is an unsigned int, but w is an int.  If bufpos < 2, this comparison
evaluates as true.



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Wed 15 May 2013 13:56:36 GMT  Name: enscript-bufpos-crash.patch  Size:
571B   By: twaugh

<http://savannah.gnu.org/bugs/download.php?file_id=28087>

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?38998>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/