1*a5af9bdaSPedro Giffuni--- misc/hunspell-1.3.3/src/hunspell/affixmgr.cxx 2010-02-27 12:59:53.000000000 +0100 2*a5af9bdaSPedro Giffuni+++ misc/build/hunspell-1.3.3/src/hunspell/affixmgr.cxx 2011-05-18 16:29:45.919141893 +0200 3*a5af9bdaSPedro Giffuni@@ -8,6 +8,8 @@ 4*a5af9bdaSPedro Giffuni 5*a5af9bdaSPedro Giffuni #include <vector> 6*a5af9bdaSPedro Giffuni 7*a5af9bdaSPedro Giffuni+#include <limits> 8*a5af9bdaSPedro Giffuni+ 9*a5af9bdaSPedro Giffuni #include "affixmgr.hxx" 10*a5af9bdaSPedro Giffuni #include "affentry.hxx" 11*a5af9bdaSPedro Giffuni #include "langnum.hxx" 12*a5af9bdaSPedro Giffuni@@ -4238,7 +4240,10 @@ 13*a5af9bdaSPedro Giffuni case 3: { 14*a5af9bdaSPedro Giffuni np++; 15*a5af9bdaSPedro Giffuni numents = atoi(piece); 16*a5af9bdaSPedro Giffuni- if (numents == 0) { 17*a5af9bdaSPedro Giffuni+ if ((numents <= 0) || 18*a5af9bdaSPedro Giffuni+ ((::std::numeric_limits<size_t>::max() 19*a5af9bdaSPedro Giffuni+ / sizeof(struct affentry)) < numents)) 20*a5af9bdaSPedro Giffuni+ { 21*a5af9bdaSPedro Giffuni char * err = pHMgr->encode_flag(aflag); 22*a5af9bdaSPedro Giffuni if (err) { 23*a5af9bdaSPedro Giffuni HUNSPELL_WARNING(stderr, "error: line %d: bad entry number\n", 24*a5af9bdaSPedro Giffuni--- misc/hunspell-1.3.3/src/tools/munch.c 2010-02-27 21:49:49.000000000 +0100 25*a5af9bdaSPedro Giffuni+++ misc/build/hunspell-1.3.3/src/tools/munch.c 2011-05-18 15:53:53.427072106 +0200 26*a5af9bdaSPedro Giffuni@@ -4,6 +4,7 @@ 27*a5af9bdaSPedro Giffuni #include <string.h> 28*a5af9bdaSPedro Giffuni #include <unistd.h> 29*a5af9bdaSPedro Giffuni #include <stdlib.h> 30*a5af9bdaSPedro Giffuni+#include <stdint.h> 31*a5af9bdaSPedro Giffuni #include <stdio.h> 32*a5af9bdaSPedro Giffuni #include <sys/types.h> 33*a5af9bdaSPedro Giffuni #include <sys/stat.h> 34*a5af9bdaSPedro Giffuni@@ -235,10 +235,19 @@ 35*a5af9bdaSPedro Giffuni case 1: { achar = *piece; break; } 36*a5af9bdaSPedro Giffuni case 2: { if (*piece == 'Y') ff = XPRODUCT; break; } 37*a5af9bdaSPedro Giffuni case 3: { numents = atoi(piece); 38*a5af9bdaSPedro Giffuni- ptr = malloc(numents * sizeof(struct affent)); 39*a5af9bdaSPedro Giffuni- ptr->achar = achar; 40*a5af9bdaSPedro Giffuni- ptr->xpflg = ff; 41*a5af9bdaSPedro Giffuni- fprintf(stderr,"parsing %c entries %d\n",achar,numents); 42*a5af9bdaSPedro Giffuni+ if ((numents < 0) || 43*a5af9bdaSPedro Giffuni+ ((SIZE_MAX/sizeof(struct affent)) < numents)) 44*a5af9bdaSPedro Giffuni+ { 45*a5af9bdaSPedro Giffuni+ fprintf(stderr, 46*a5af9bdaSPedro Giffuni+ "Error: too many entries: %d\n", numents); 47*a5af9bdaSPedro Giffuni+ numents = 0; 48*a5af9bdaSPedro Giffuni+ } else { 49*a5af9bdaSPedro Giffuni+ ptr = malloc(numents * sizeof(struct affent)); 50*a5af9bdaSPedro Giffuni+ ptr->achar = achar; 51*a5af9bdaSPedro Giffuni+ ptr->xpflg = ff; 52*a5af9bdaSPedro Giffuni+ fprintf(stderr,"parsing %c entries %d\n", 53*a5af9bdaSPedro Giffuni+ achar,numents); 54*a5af9bdaSPedro Giffuni+ } 55*a5af9bdaSPedro Giffuni break; 56*a5af9bdaSPedro Giffuni } 57*a5af9bdaSPedro Giffuni default: break; 58*a5af9bdaSPedro Giffuni--- misc/hunspell-1.3.3/src/tools/unmunch.c 2010-02-23 15:53:29.000000000 +0100 59*a5af9bdaSPedro Giffuni+++ misc/build/hunspell-1.3.3/src/tools/unmunch.c 2011-05-18 20:53:43.843599726 +0200 60*a5af9bdaSPedro Giffuni@@ -6,6 +6,7 @@ 61*a5af9bdaSPedro Giffuni #include <string.h> 62*a5af9bdaSPedro Giffuni #include <unistd.h> 63*a5af9bdaSPedro Giffuni #include <stdlib.h> 64*a5af9bdaSPedro Giffuni+#include <stdint.h> 65*a5af9bdaSPedro Giffuni #include <stdio.h> 66*a5af9bdaSPedro Giffuni #include <sys/types.h> 67*a5af9bdaSPedro Giffuni #include <sys/stat.h> 68*a5af9bdaSPedro Giffuni@@ -160,10 +161,19 @@ 69*a5af9bdaSPedro Giffuni case 1: { achar = *piece; break; } 70*a5af9bdaSPedro Giffuni case 2: { if (*piece == 'Y') ff = XPRODUCT; break; } 71*a5af9bdaSPedro Giffuni case 3: { numents = atoi(piece); 72*a5af9bdaSPedro Giffuni- ptr = malloc(numents * sizeof(struct affent)); 73*a5af9bdaSPedro Giffuni- ptr->achar = achar; 74*a5af9bdaSPedro Giffuni- ptr->xpflg = ff; 75*a5af9bdaSPedro Giffuni- fprintf(stderr,"parsing %c entries %d\n",achar,numents); 76*a5af9bdaSPedro Giffuni+ if ((numents < 0) || 77*a5af9bdaSPedro Giffuni+ ((SIZE_MAX/sizeof(struct affent)) < numents)) 78*a5af9bdaSPedro Giffuni+ { 79*a5af9bdaSPedro Giffuni+ fprintf(stderr, 80*a5af9bdaSPedro Giffuni+ "Error: too many entries: %d\n", numents); 81*a5af9bdaSPedro Giffuni+ numents = 0; 82*a5af9bdaSPedro Giffuni+ } else { 83*a5af9bdaSPedro Giffuni+ ptr = malloc(numents * sizeof(struct affent)); 84*a5af9bdaSPedro Giffuni+ ptr->achar = achar; 85*a5af9bdaSPedro Giffuni+ ptr->xpflg = ff; 86*a5af9bdaSPedro Giffuni+ fprintf(stderr,"parsing %c entries %d\n", 87*a5af9bdaSPedro Giffuni+ achar,numents); 88*a5af9bdaSPedro Giffuni+ } 89*a5af9bdaSPedro Giffuni break; 90*a5af9bdaSPedro Giffuni } 91*a5af9bdaSPedro Giffuni default: break; 92