app-text/ptex/files/CVE-2009-1284.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

--- tetex-src-3.0.orig/texk/web2c/bibtex.ch	2004-07-15 02:32:51.000000000 +0900
+++ tetex-src-3.0/texk/web2c/bibtex.ch	2009-09-30 08:11:22.000000000 +0900
@@ -1077,6 +1077,15 @@
 @y
 @z
 
+% Forgot to check for pool overflow here.  Triggered by test case linked
+% from http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520920.
+@x
+while (sp_ptr < sp_end) do                      {shift the substring}
+@y
+str_room(sp_end - sp_ptr);
+while (sp_ptr < sp_end) do                      {shift the substring}
+@z
+
 % [459] Eliminate unreferenced statement label, because `undefined' is
 % now a constant expression that is not evaluated at the Web level. If
 % this label were ever required, it could be replaced by the constant