* [gentoo-commits] gentoo-x86 commit in app-accessibility/brltty/files: brltty-4.5-range-checking-and-array-bounds.patch
@ 2013-08-23 18:19 Christopher Brannon (teiresias)
0 siblings, 0 replies; only message in thread
From: Christopher Brannon (teiresias) @ 2013-08-23 18:19 UTC (permalink / raw
To: gentoo-commits
teiresias 13/08/23 18:19:22
Added: brltty-4.5-range-checking-and-array-bounds.patch
Log:
Add a patch to fix range-checking and array out-of-bounds access issues.
The patch comes from upstream's svn repository, so it can go away on the
next release. Fixes bug #481802.
(Portage version: 2.1.12.2/cvs/Linux x86_64, signed Manifest commit with key 0x6521e06d)
Revision Changes Path
1.1 app-accessibility/brltty/files/brltty-4.5-range-checking-and-array-bounds.patch
file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-accessibility/brltty/files/brltty-4.5-range-checking-and-array-bounds.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-accessibility/brltty/files/brltty-4.5-range-checking-and-array-bounds.patch?rev=1.1&content-type=text/plain
Index: brltty-4.5-range-checking-and-array-bounds.patch
===================================================================
diff --git a/Programs/options.c b/Programs/options.c
--- a/Programs/options.c (revision 7568)
+++ b/Programs/options.c (revision 7570)
@@ -219,10 +219,10 @@
while (option->strings[index]) {
strings[index] = option->strings[index];
- ++index;
+ index += 1;
}
- while (index < count) strings[index++] = NULL;
+ while (index < count) strings[index++] = "";
snprintf(buffer, sizeof(buffer),
description, strings[0], strings[1], strings[2], strings[3]);
description = buffer;
@@ -233,19 +233,36 @@
while (1) {
unsigned int charCount = charsLeft;
+
if (charCount > descriptionWidth) {
charCount = descriptionWidth;
- while (description[charCount] != ' ') --charCount;
- while (description[charCount] == ' ') --charCount;
- ++charCount;
+
+ while (charCount > 0) {
+ if (description[charCount] == ' ') break;
+ charCount -= 1;
+ }
+
+ while (charCount > 0) {
+ if (description[--charCount] != ' ') {
+ charCount += 1;
+ break;
+ }
+ }
}
- memcpy(line+lineLength, description, charCount);
- lineLength += charCount;
- line[lineLength] = 0;
- fprintf(outputStream, "%s\n", line);
+ if (charCount > 0) {
+ memcpy(line+lineLength, description, charCount);
+ lineLength += charCount;
- while (description[charCount] == ' ') ++charCount;
+ line[lineLength] = 0;
+ fprintf(outputStream, "%s\n", line);
+ }
+
+ while (charCount < charsLeft) {
+ if (description[charCount] != ' ') break;
+ charCount += 1;
+ }
+
if (!(charsLeft -= charCount)) break;
description += charCount;
diff --git a/Drivers/Speech/Alva/speech.c b/Drivers/Speech/Alva/speech.c
--- a/Drivers/Speech/Alva/speech.c (revision 7568)
+++ b/Drivers/Speech/Alva/speech.c (revision 7570)
@@ -33,7 +33,7 @@
/* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
* for chars >=128.
*/
-static unsigned char latin2cp437[128] =
+static unsigned char latin2cp437[0X80] =
{199, 252, 233, 226, 228, 224, 229, 231,
234, 235, 232, 239, 238, 236, 196, 197,
201, 181, 198, 244, 247, 242, 251, 249,
@@ -75,7 +75,7 @@
for (i = 0; i < len; i++)
{
c = buffer[i];
- if (c >= 128) c = latin2cp437[c];
+ if (c >= 0X80) c = latin2cp437[c-0X80];
if (c < 33) /* space or control character */
{
buf[0] = ' ';
diff --git a/Drivers/Speech/CombiBraille/speech.c b/Drivers/Speech/CombiBraille/speech.c
--- a/Drivers/Speech/CombiBraille/speech.c (revision 7568)
+++ b/Drivers/Speech/CombiBraille/speech.c (revision 7570)
@@ -43,7 +43,7 @@
/* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
* for chars >=128.
*/
-static unsigned char latin2cp437[128] =
+static unsigned char latin2cp437[0X80] =
{199, 252, 233, 226, 228, 224, 229, 231,
234, 235, 232, 239, 238, 236, 196, 197,
201, 181, 198, 244, 247, 242, 251, 249,
@@ -99,7 +99,7 @@
unsigned char byte = buffer[i];
unsigned char *byte_address = &byte;
unsigned int byte_count = 1;
- if (byte >= 0X80) byte = latin2cp437[byte];
+ if (byte >= 0X80) byte = latin2cp437[byte-0X80];
if (byte < 33) { /* space or control character */
byte = ' ';
} else if (byte <= MAX_TRANS) {
diff --git a/Drivers/Speech/MultiBraille/speech.c b/Drivers/Speech/MultiBraille/speech.c
--- a/Drivers/Speech/MultiBraille/speech.c (revision 7568)
+++ b/Drivers/Speech/MultiBraille/speech.c (revision 7570)
@@ -35,7 +35,7 @@
/* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
* for chars >=128.
*/
-static unsigned char latin2cp437[128] =
+static unsigned char latin2cp437[0X80] =
{199, 252, 233, 226, 228, 224, 229, 231,
234, 235, 232, 239, 238, 236, 196, 197,
201, 181, 198, 244, 247, 242, 251, 249,
@@ -75,7 +75,7 @@
for (i = 0; i < len; i++)
{
c = buffer[i];
- if (c >= 128) c = latin2cp437[c];
+ if (c >= 0X80) c = latin2cp437[c-0X80];
if (c < 33) /* space or control character */
{
static const char blank = ' ';
diff --git a/Drivers/Speech/BrailleLite/speech.c b/Drivers/Speech/BrailleLite/speech.c
--- a/Drivers/Speech/BrailleLite/speech.c (revision 7568)
+++ b/Drivers/Speech/BrailleLite/speech.c (revision 7570)
@@ -36,7 +36,7 @@
/* charset conversion table from iso latin-1 == iso 8859-1 to cp437==ibmpc
* for chars >=128.
*/
-static unsigned char latin2cp437[128] =
+static unsigned char latin2cp437[0X80] =
{199, 252, 233, 226, 228, 224, 229, 231,
234, 235, 232, 239, 238, 236, 196, 197,
201, 181, 198, 244, 247, 242, 251, 249,
@@ -87,7 +87,7 @@
for (i = 0; i < len; i++)
{
c = buffer[i];
- if (c >= 128) c = latin2cp437[c];
+ if (c >= 0X80) c = latin2cp437[c-0X80];
if (c < 33) /* space or control character */
{
rawdata[0] = ' ';
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-08-23 18:19 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-08-23 18:19 [gentoo-commits] gentoo-x86 commit in app-accessibility/brltty/files: brltty-4.5-range-checking-and-array-bounds.patch Christopher Brannon (teiresias)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox