From eab84c69086cec402aca3fa2b65831942a6ec48c Mon Sep 17 00:00:00 2001 From: Debian Multimedia Maintainers Date: Fri, 13 Nov 2020 21:27:34 -0500 Subject: [PATCH] CVE-2018-20760 commit 4c1360818fc8948e9307059fba4dc47ba8ad255d Author: Aurelien David Date: Thu Dec 13 14:39:21 2018 +0100 Description: CVE-2018-20760 check error code on call to gf_utf8_wcstombs (#1177) Gbp-Pq: Name CVE-2018-20760.patch --- src/media_tools/text_import.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/media_tools/text_import.c b/src/media_tools/text_import.c index 9f6fb10..f111e05 100644 --- a/src/media_tools/text_import.c +++ b/src/media_tools/text_import.c @@ -292,6 +292,8 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod } sptr = (u16 *)szLine; i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr); + if (i >= (u32)ARRAY_LENGTH(szLineConv)) + return NULL; szLineConv[i] = 0; strcpy(szLine, szLineConv); /*this is ugly indeed: since input is UTF16-LE, there are many chances the fgets never reads the \0 after a \n*/ -- 2.30.2