Subject: Re: bug#72245: [PATCH] Fix integer overflow when reading XPM

From: Po Lu <[email-masked]>
Date: Tue, 23 Jul 2024 10:06:01 +0800

Stefan Kangas <[email-masked]> writes:

> Severity: minor
>
> Since XPM files are untrusted input, I think we'd better handle
> integer
> overflow when parsing it, in case the file is malformed.
>
> Proposed patch attached.

What are the security implications of accepting whatever scanf produces
in the event of an overflow?