From 97133cba559769bddfca9965811fd359b40178f8 Mon Sep 17 00:00:00 2001 From: Debian Multimedia Maintainers Date: Sun, 7 Apr 2019 12:19:28 -0400 Subject: [PATCH] CVE-2018-20760 commit 4c1360818fc8948e9307059fba4dc47ba8ad255d Author: Aurelien David Date: Thu Dec 13 14:39:21 2018 +0100 Description: CVE-2018-20760 check error code on call to gf_utf8_wcstombs (#1177) Gbp-Pq: Name CVE-2018-20760.patch --- src/media_tools/text_import.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/media_tools/text_import.c b/src/media_tools/text_import.c index 9f6fb10..f111e05 100644 --- a/src/media_tools/text_import.c +++ b/src/media_tools/text_import.c @@ -292,6 +292,8 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod } sptr = (u16 *)szLine; i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr); + if (i >= (u32)ARRAY_LENGTH(szLineConv)) + return NULL; szLineConv[i] = 0; strcpy(szLine, szLineConv); /*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/ -- 2.30.2