Mirrors/zint
1
0
Fork 0
mirror of https://git.code.sf.net/p/zint/code synced 2025-12-19 02:47:06 +00:00
Code Issues Projects Releases Wiki Activity

Prevent Data Matrix buffer overflow bug

Browse Source 
Fixes #176 reported by Daniel Gredler at OkapiBarcode
This commit is contained in:
Robin Stuart
2020-01-05 12:35:16 +00:00
parent 6954497fc1
commit 257da3fff5
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
backend/dmatrix.c
View File

@@ -756,7 +756,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
process_buffer[*process_p] = value; process_buffer[*process_p] = value;
(*process_p)++; (*process_p)++;
if (*process_p >= 3) { while (*process_p >= 3) {
int iv; int iv;
iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1; iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1;
@@ -824,7 +824,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
process_buffer[*process_p] = value; process_buffer[*process_p] = value;
(*process_p)++; (*process_p)++;
if (*process_p >= 3) { while (*process_p >= 3) {
int iv; int iv;
iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1; iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1;
@@ -885,7 +885,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
process_buffer[*process_p] = value; process_buffer[*process_p] = value;
(*process_p)++; (*process_p)++;
if (*process_p >= 3) { while (*process_p >= 3) {
int iv; int iv;
iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1; iv = (1600 * process_buffer[0]) + (40 * process_buffer[1]) + (process_buffer[2]) + 1;
@@ -932,7 +932,7 @@ static int dm200encode(struct zint_symbol *symbol, const unsigned char source[],
sp++; sp++;
} }
if (*process_p >= 4) { while (*process_p >= 4) {
target[tp] = (unsigned char) ((process_buffer[0] << 2) + ((process_buffer[1] & 0x30) >> 4)); target[tp] = (unsigned char) ((process_buffer[0] << 2) + ((process_buffer[1] & 0x30) >> 4));
tp++; tp++;
target[tp] = ((process_buffer[1] & 0x0f) << 4) + ((process_buffer[2] & 0x3c) >> 2); target[tp] = ((process_buffer[1] & 0x0f) << 4) + ((process_buffer[2] & 0x3c) >> 2);