backends: Fix several security issues in the dvi-backend.

[evince.git] / backend / dvi / mdvi-lib / dviread.c

diff --git a/backend/dvi/mdvi-lib/dviread.c b/backend/dvi/mdvi-lib/dviread.c
index cd8cfa916113e821e87c344de300ba998a8b95a5..d01432056518ac6ae3518ed3eec5f5705159f02f 100644 (file)
--- a/backend/dvi/mdvi-lib/dviread.c
+++ b/backend/dvi/mdvi-lib/dviread.c
@@ -1507,6 +1507,10 @@ int      special(DviContext *dvi, int opcode)
        Int32   arg;
        
        arg = dugetn(dvi, opcode - DVI_XXX1 + 1);
+       if (arg <= 0) {
+               dvierr(dvi, _("malformed special length\n"));
+               return -1;
+       }
        s = mdvi_malloc(arg + 1);
        dread(dvi, s, arg);
        s[arg] = 0;