From b1887814c31f69bfa5620e16ade245a1650046b3 Mon Sep 17 00:00:00 2001 From: "Richard M. Stallman" Date: Fri, 1 Feb 2002 04:34:21 +0000 Subject: [PATCH] (decode_composition_emacs_mule): Give up if NCOMPONENT gets too large to index `component'. --- src/coding.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/coding.c b/src/coding.c index 88ff0ca0a83..37a5e886547 100644 --- a/src/coding.c +++ b/src/coding.c @@ -811,6 +811,10 @@ decode_composition_emacs_mule (coding, src, src_end, return 0; for (ncomponent = 0; src < src_base + data_len; ncomponent++) { + /* If it is longer than this, it can't be valid. */ + if (ncomponent >= COMPOSITION_DATA_MAX_BUNCH_LENGTH) + return 0; + if (ncomponent % 2 && with_rule) { ONE_MORE_BYTE (gref); -- 2.39.2