# # Updated but not checked in: # (will commit) # # modified: src/Type1/afm.c # # # Untracked files: # (use "git add" to add to commit) # # src/Type1/afm.c~ diff --git a/src/Type1/afm.c b/src/Type1/afm.c index b8ce2d3..e3cb93b 100644 --- a/src/Type1/afm.c +++ b/src/Type1/afm.c @@ -34,6 +34,7 @@ #include "Xmd.h" /* For INT32 dec #include "Xdefs.h" /* For Bool */ #include "xf86_ansic.h" #endif +#include #include /* for xalloc/xfree */ #include "AFM.h" @@ -73,6 +74,7 @@ int CIDAFM(FILE *fd, FontInfo **pfi) { char *p = 0; int i, j, k = 0, found = 0; FontInfo *fi; + long n; if (fd == NULL || pfi == NULL) return(1); @@ -115,8 +117,15 @@ int CIDAFM(FILE *fd, FontInfo **pfi) { return(1); } bzero(fi, sizeof(FontInfo)); - - fi->nChars = atoi(p); + + n = strtol(p, NULL, 10); + if ((n <= 0) || (n > (INT_MAX / sizeof(Metrics)))) { + xfree(afmbuf); + xfree(fi); + return(1); + } + + fi->nChars = (int) n; fi->metrics = (Metrics *)xalloc(fi->nChars * sizeof(Metrics));