Mathieu Malaterre 876c02206d [trunk] Import commit f4139d702559649e577a5df9cfd64b0ca6107a7a from ghostpdl
Several functions accept a buffer size but never actually check whether
the buffer overflows during reading/writing. This fixes all cases where
a size variable has explicitly been marked as unused (through a (void)
cast).

This was discovered while investigating an assertion caused by
7cc691f332f26802c64cdc47e17bff8b_signal_sigabrt_7ffff6d59425_2247_2509.pdf
among others.

Thanks to Mateusz Jurczyk and Gynvael Coldwind of the Google Security
Team for providing the example files.
2014-02-25 13:28:37 +00:00
..