From: Carlos Garcia Campos <carlosgc@gnome.org>
Date: Thu, 30 Nov 2006 13:36:33 +0000 (+0000)
Subject: Fix CVE-2006-5864.
X-Git-Tag: EVINCE_0_7_0~45
X-Git-Url: https://www.fi.muni.cz/~kas/git//home/kas/public_html/git/?a=commitdiff_plain;h=b37f798df0c3a745dbc4c1fc8e98b070bcd3ecf3;p=evince.git

Fix CVE-2006-5864.

2006-11-30  Carlos Garcia Campos  <carlosgc@gnome.org>
	* ps/ps.c: (get_next_text):
	Fix CVE-2006-5864.
---

diff --git a/ChangeLog b/ChangeLog
index 40a70066..fdfb9e17 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2006-11-30  Carlos Garcia Campos  <carlosgc@gnome.org>
+
+	* ps/ps.c: (get_next_text):
+
+	Fix CVE-2006-5864.
+
 2006-11-22  Carlos Garcia Campos  <carlosgc@gnome.org>
 
 	* shell/ev-history.c: (ev_history_finalize), (ev_history_class_init):
diff --git a/ps/ps.c b/ps/ps.c
index 30b9e567..b4b54e05 100644
--- a/ps/ps.c
+++ b/ps/ps.c
@@ -1231,7 +1231,8 @@ get_next_text(line, next_char)
     int level = 0;
     quoted = 1;
     line++;
-    while(*line && !(*line == ')' && level == 0)) {
+    while(*line && !(*line == ')' && level == 0)
+	  && (cp - text) < PSLINELENGTH - 1) {
       if(*line == '\\') {
         if(*(line + 1) == 'n') {
           *cp++ = '\n';
@@ -1302,7 +1303,8 @@ get_next_text(line, next_char)
     }
   }
   else {
-    while(*line && !(*line == ' ' || *line == '\t' || *line == '\n'))
+    while(*line && !(*line == ' ' || *line == '\t' || *line == '\n')
+	  && (cp - text) < PSLINELENGTH - 1)
       *cp++ = *line++;
   }
   *cp = '\0';