From: Alan Third <alan@idiocy.org>
Date: Sat, 13 Mar 2021 21:59:59 +0000 (+0000)
Subject: Fix buffer overflow in xbm_scan (bug#47094)
X-Git-Tag: emacs-27.2-rc1~5
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=b9ec6111e2;p=emacs.git

Fix buffer overflow in xbm_scan (bug#47094)

* src/image.c (xbm_scan): Ensure reading a string doesn't overflow the
buffer.

(cherry picked from commit ebc3b25409dd614c1814a0643960452683e37aa3)
---

diff --git a/src/image.c b/src/image.c
index cd095e0e659..e3eae5c497c 100644
--- a/src/image.c
+++ b/src/image.c
@@ -3256,6 +3256,7 @@ static int
 xbm_scan (char **s, char *end, char *sval, int *ival)
 {
   unsigned char c UNINIT;
+  char *sval_end = sval + BUFSIZ;
 
  loop:
 
@@ -3315,7 +3316,7 @@ xbm_scan (char **s, char *end, char *sval, int *ival)
   else if (c_isalpha (c) || c == '_')
     {
       *sval++ = c;
-      while (*s < end
+      while (*s < end && sval < sval_end
 	     && (c = *(*s)++, (c_isalnum (c) || c == '_')))
 	*sval++ = c;
       *sval = 0;