|
|
@@ -0,0 +1,36 @@
|
|
|
+Security Bugfix
|
|
|
+http://www.securityfocus.com/archive/1/345844/2003-11-24/2003-11-30/0
|
|
|
+
|
|
|
+Index: ansi.c
|
|
|
+--- ansi.c.orig 2003-09-08 16:24:44.000000000 +0200
|
|
|
++++ ansi.c 2003-11-27 20:08:53.000000000 +0100
|
|
|
+@@ -559,7 +559,7 @@
|
|
|
+ {
|
|
|
+ case '0': case '1': case '2': case '3': case '4':
|
|
|
+ case '5': case '6': case '7': case '8': case '9':
|
|
|
+- if (curr->w_NumArgs < MAXARGS)
|
|
|
++ if (curr->w_NumArgs >= 0 && curr->w_NumArgs < MAXARGS)
|
|
|
+ {
|
|
|
+ if (curr->w_args[curr->w_NumArgs] < 100000000)
|
|
|
+ curr->w_args[curr->w_NumArgs] =
|
|
|
+Index: resize.c
|
|
|
+--- resize.c.orig 2003-09-08 16:26:31.000000000 +0200
|
|
|
++++ resize.c 2003-11-27 20:09:49.000000000 +0100
|
|
|
+@@ -682,6 +682,17 @@
|
|
|
+ if (wi == 0)
|
|
|
+ he = hi = 0;
|
|
|
+
|
|
|
++ if (wi > 1000)
|
|
|
++ {
|
|
|
++ Msg(0, "Window width too large, truncated");
|
|
|
++ wi = 1000;
|
|
|
++ }
|
|
|
++ if (he > 1000)
|
|
|
++ {
|
|
|
++ Msg(0, "Window height too large, truncated");
|
|
|
++ he = 1000;
|
|
|
++ }
|
|
|
++
|
|
|
+ if (p->w_width == wi && p->w_height == he && p->w_histheight == hi)
|
|
|
+ {
|
|
|
+ debug("ChangeWindowSize: No change.\n");
|