fix hongfuzz crash.

barak · Jul 13, 2018 · 89d71b01d606e57ecec2c2930c145bb20ba5bbe3 · 89d71b0
1 parent 44596e0
commit 89d71b01d606e57ecec2c2930c145bb20ba5bbe3
Unified Split

Showing with 9 additions and 3 deletions.

+7 −1 libdjvu/DjVmDir.cpp

+1 −1 libdjvu/miniexp.cpp

+1 −1 tools/csepdjvu.cpp
diff --git a/libdjvu/DjVmDir.cpp b/libdjvu/DjVmDir.cpp
@@ -299,7 +299,13 @@ DjVmDir::decode(const GP<ByteStream> &gstr)
         memcpy((char*) strings+strings_size, buffer, length);
      }
      DEBUG_MSG("size of decompressed names block=" << strings.size() << "\n");
-   
+      if (strings[strings.size()-1] != 0)
+        {
+         int strings_size=strings.size();
+         strings.resize(strings_size+1);
+         strings[strings_size] = 0;
+        }
+      
         // Copy names into the files
      const char * ptr=strings;
      for(pos=files_list;pos;++pos)
diff --git a/libdjvu/miniexp.cpp b/libdjvu/miniexp.cpp
@@ -1065,7 +1065,7 @@ print_c_string(const char *s, char *d, int flags, size_t len)
      c = (unsigned char)(*s++);
      if (char_quoted(c, flags))
        {
-          char buffer[10];
+          char buffer[16]; /* 10+1 */
          static const char *tr1 = "\"\\tnrbf";
          static const char *tr2 = "\"\\\t\n\r\b\f";
          buffer[0] = buffer[1] = 0;
diff --git a/tools/csepdjvu.cpp b/tools/csepdjvu.cpp
@@ -1834,7 +1834,7 @@ main(int argc, const char **argv)
                ByteStream::create(GURL::Filename::UTF8(arg),"rb");
              BufferByteStream ibs(*fbs);
              do {
-                char pagename[16];
+                char pagename[20];
                sprintf(pagename, "p%04d.djvu", ++pageno);
                if (opts.verbose > 1)
                  DjVuPrintErrorUTF8("%s","--------------------\n");