File fig2dev-3.2.6a-style-overflow.patch of Package transfig.11759

Description: Sanitize input of fill patterns.
Bug-Debian: https://bugs.debian.org/881396
Author: Thomas Loimer <thomas.loimer@tuwien.ac.at>

--- a/fig2dev/read.c
+++ b/fig2dev/read.c
@@ -71,6 +71,8 @@ static int		 save_comment(void);
 
 #define		FILL_CONVERT(f)	((v2_flag || (f) < WHITE_FILL) \
 					? (v30_flag? f: (f-1)) : 20 - ((f)-1)*5)
+#define		FILL_SANITIZE(f)	((f) < UNFILLED || (f) >= \
+			NUMSHADES + NUMTINTS + NUMPATTERNS) ? UNFILLED : f
 
 /* input buffer size */
 #define		BUF_SIZE	1024
@@ -547,6 +549,7 @@ read_arcobject(FILE *fp)
 	}
 	a->thickness *= round(THICK_SCALE);
 	a->fill_style = FILL_CONVERT(a->fill_style);
+	a->fill_style = FILL_SANITIZE(a->fill_style);
 	NOTE_FILL(a);
 	fix_and_note_color(&a->pen_color);
 	if (fa) {
@@ -730,6 +733,7 @@ read_ellipseobject(void)
 	fix_and_note_color(&e->pen_color);
 	e->thickness *= round(THICK_SCALE);
 	e->fill_style = FILL_CONVERT(e->fill_style);
+	e->fill_style = FILL_SANITIZE(e->fill_style);
 	NOTE_FILL(e);
 	e->comments = attach_comments();	/* attach any comments */
 	return e;
@@ -895,6 +899,7 @@ read_lineobject(FILE *fp)
 	l->radius *= round(THICK_SCALE);
 	l->thickness *= round(THICK_SCALE);
 	l->fill_style = FILL_CONVERT(l->fill_style);
+	l->fill_style = FILL_SANITIZE(l->fill_style);
 	NOTE_FILL(l);
 	fix_and_note_color(&l->pen_color);
 	if (fa) {
@@ -1051,6 +1056,7 @@ read_splineobject(FILE *fp)
 	    }
 	s->thickness *= round(THICK_SCALE);
 	s->fill_style = FILL_CONVERT(s->fill_style);
+	s->fill_style = FILL_SANITIZE(s->fill_style);
 	NOTE_FILL(s);
 	fix_and_note_color(&s->pen_color);
 	if (fa) {