mirrors/zint
2
0
Fork 0
mirror of https://github.com/zint/zint synced 2024-11-16 20:57:25 +13:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent Data Matrix buffer overflow bug

Browse Source 
Fixes #176 reported by Daniel Gredler at OkapiBarcode
This commit is contained in:
Robin Stuart 2020-01-05 12:35:16 +00:00
parent 6954497fc1
commit 257da3fff5
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
backend/dmatrix.c
View File

@ -756,7 +756,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
process_buffer[*process_p] = value; process_buffer[*process_p] = value;
(*process_p)++; (*process_p)++;
if (*process_p >= 3) { while (*process_p >= 3) {
int iv; int iv;
iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1; iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1;
@ -824,7 +824,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
process_buffer[*process_p] = value; process_buffer[*process_p] = value;
(*process_p)++; (*process_p)++;
if (*process_p >= 3) { while (*process_p >= 3) {
int iv; int iv;
iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1; iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1;
@ -885,7 +885,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
process_buffer[*process_p] = value; process_buffer[*process_p] = value;
(*process_p)++; (*process_p)++;
if (*process_p >= 3) { while (*process_p >= 3) {
int iv; int iv;
iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1; iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1;
@ -932,7 +932,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
sp++; sp++;
} }
if (*process_p >= 4) { while (*process_p >= 4) {
target[tp] = (unsigned char) ((process_buffer[0] << 2) + ((process_buffer[1] & 0x30) >> 4)); target[tp] = (unsigned char) ((process_buffer[0] << 2) + ((process_buffer[1] & 0x30) >> 4));
tp++; tp++;
target[tp] = ((process_buffer[1] & 0x0f) << 4) + ((process_buffer[2] & 0x3c) >> 2); target[tp] = ((process_buffer[1] & 0x0f) << 4) + ((process_buffer[2] & 0x3c) >> 2);
@ -1253,7 +1253,7 @@ static int data_matrix_200(struct zint_symbol *symbol,const unsigned char source
#ifdef DEBUG #ifdef DEBUG
{ {
int CWCount; int CWCount;
int posCur; int posCur;
if (skew) if (skew)
CWCount = 1558 + 620; CWCount = 1558 + 620;
else else
@ -1289,7 +1289,7 @@ static int data_matrix_200(struct zint_symbol *symbol,const unsigned char source
// Print position matrix as in standard // Print position matrix as in standard
for (y = NR - 1; y >= 0; y--) { for (y = NR - 1; y >= 0; y--) {
for (x = 0; x < NC; x++) { for (x = 0; x < NC; x++) {
int v; int v;
if (x != 0) if (x != 0)
fprintf(stderr, "|"); fprintf(stderr, "|");
v = places[(NR - y - 1) * NC + x]; v = places[(NR - y - 1) * NC + x];