ref: 6d815d2f620af548f0d7c9c00281c16656c5f1b1
parent: f5539068a087f734f795c6dc25d88372590b3806
author: Christopher Snowhill <kode54@gmail.com>
date: Tue Sep 12 10:26:13 EDT 2017
Change XM limit reader so it won't accept negative sizes on its signed size parameter.
--- a/src/it/readxm.c
+++ b/src/it/readxm.c
@@ -371,6 +371,8 @@
{DUMBFILE *df = f;
LIMITED_XM *lx = df->file;
+ if (n < 0)
+ return -1;
if (lx->buffered || n) { if (n > lx->allocated) {unsigned char *buffered = realloc( lx->buffered, n );