Skip to content

Commit

Permalink
Fix yet another buffer overflow in the braille table parser
Browse files Browse the repository at this point in the history
Reported by Henri Salo

Fixes #592
  • Loading branch information
egli committed Jun 4, 2018
1 parent d4fc803 commit fb2bfce
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 2 deletions.
2 changes: 2 additions & 0 deletions NEWS
Expand Up @@ -20,6 +20,8 @@ issues]].
- Fix a memory leak in default table resolver thanks to Timothy Lee.
- Fix an array out of bounds error which caused a crash on i386 thanks
to Samuel Thibault.
- Fix numerous stack-based buffer overflow in table parsing thanks
that were reported by Henri Salo thanks to Christian Egli.

** Braille table improvements
- Fix some forward- and back-translation errors in Unified French Grade
Expand Down
7 changes: 5 additions & 2 deletions liblouis/compileTranslationTable.c
Expand Up @@ -4557,16 +4557,19 @@ includeFile(FileInfo *nested, CharsString *includedFile,
int rv;
for (k = 0; k < includedFile->length; k++)
includeThis[k] = (char)includedFile->chars[k];
if (k >= MAXSTRING) {
compileError(nested, "Include statement too long: 'include %s'", includeThis);
return 0;
}
includeThis[k] = 0;
tableFiles = _lou_resolveTable(includeThis, nested->fileName);
if (tableFiles == NULL) {
errorCount++;
return 0;
}
if (tableFiles[1] != NULL) {
errorCount++;
free_tablefiles(tableFiles);
_lou_logMessage(LOG_ERROR,
compileError(nested,
"Table list not supported in include statement: 'include %s'",
includeThis);
return 0;
Expand Down

0 comments on commit fb2bfce

Please sign in to comment.