starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2021-22552 (published 2021-08-02T16:15Z)

An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader that is then used by sysno() and can bypass validation. This can allow the attacker to read memory from within the secure enclave. We recommend updating to Asylo 0.6.3 or past https://github.com/google/asylo/commit/90d7619e9dd99bcdb6cd28c7649d741d254d9a1a

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/google/asylo
commit_details: repo_url: https://github.com/google/asylo
author: Chong Cai
author_date: 2021-06-03 11:02:29-07:00
msg: Add sysno check in MessageReader

The sysno in MessageReader is interpreted from the Message header passed
from the host. A malicious Message header may provide a modified sysno
to bypass the validation, and overwrites enclave memory. This change
adds a check for sysno to make sure it matches the expected value.

This issue was reported by Qinkun Bao, Zhaofeng Chen, Mingshen Sun, and
Kang Li from Baidu Security.

PiperOrigin-RevId: 377328054
Change-Id: I3ff6f60694d3390f66da89d139cf7cc7b49abaea
repository: repo_url: https://github.com/google/asylo
repo_name: google/asylo
description: An open and flexible framework for developing enclave applications
repo_language: C++
owner: google
file_changes: filename: system_call.cc
change_type: ModificationType.MODIFY
diff: @@ -115,6 +115,9 @@ extern "C" int64_t enc_untrusted_syscall(int sysno, ...) {
   // Copy outputs back into pointer parameters.
   auto response_reader =
       asylo::system_call::MessageReader({response_buffer, response_size});
+  if (response_reader.sysno() != sysno) {
+    error_handler("system_call.cc: Unexpected sysno in response");
+  }
   const asylo::primitives::PrimitiveStatus response_status =
       response_reader.Validate();
   if (!response_status.ok()) {

programming_language: C++
CVE-2023-4877 (published 2023-09-10T01:15Z)

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository hamza417/inure prior to build92.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/hamza417/inure
commit_details: repo_url: https://github.com/hamza417/inure
author: Hamza417
author_date: 2023-08-30 01:02:08+05:30
msg: Build92

  - Patched Android Manifest Misconfiguration Leading to Task Hijacking
repository: repo_url: https://github.com/hamza417/inure
repo_name: Hamza417/Inure
description: An elegant and beautiful premium Android app manager for rooted and non-rooted devices with a built-in terminal, analytics, debloat, stats and various other panels with an independent custom theme engine, developed with purely custom APIs created for this app.
repo_language: Kotlin
owner: hamza417
file_changes: filename: AndroidManifest.xml
change_type: ModificationType.MODIFY
diff: @@ -76,6 +76,7 @@
         android:theme="@style/Inure"
         android:windowSoftInputMode="adjustPan"
         tools:ignore="AllowBackup"
+        android:taskAffinity="app.simple.inure"
         tools:targetApi="tiramisu">
 
         <profileable android:shell="true" />
@@ -107,7 +108,6 @@
             android:exported="true"
             android:label="@string/terminal"
             android:launchMode="singleTask"
-            android:taskAffinity="app.simple.inure"
             android:windowSoftInputMode="adjustResize" />
 
         <activity

programming_language: Ruby
filename: changelogs.html
change_type: ModificationType.MODIFY
diff: @@ -28,6 +28,8 @@
 <ul>
     <li>Patched <i>Exposure of Sensitive Information to an Unauthorized Actor</i> vulnerability.
     </li>
+    <li>Patched <i>Android Manifest Misconfiguration Leading to Task Hijacking</i> vulnerability.
+    </li>
 </ul>
 
 <br>

programming_language: HTML
CVE-2014-8483 (published 2014-11-06T15:55Z)

The blowfishECB function in core/cipher.cpp in Quassel IRC 0.10.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a malformed string.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/quassel/quassel
commit_details: repo_url: https://github.com/quassel/quassel
author: Manuel Nickschas
author_date: 2014-10-21 21:20:07+02:00
msg: Check for invalid input in encrypted buffers

The ECB Blowfish decryption function assumed that encrypted input would
always come in blocks of 12 characters, as specified. However, buggy
clients or annoying people may not adhere to that assumption, causing
the core to crash while trying to process the invalid base64 input.

With this commit we make sure that we're not overstepping the bounds of
the input string while decoding it; instead we bail out early and display
the original input. Fixes #1314.

Thanks to Tucos for finding that one!
repository: repo_url: https://github.com/quassel/quassel
repo_name: quassel/quassel
description: Quassel IRC: Chat comfortably.  Everywhere.
repo_language: C++
owner: quassel
file_changes: filename: cipher.cpp
change_type: ModificationType.MODIFY
diff: @@ -364,6 +364,10 @@ QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)
     }
     else
     {
+        // ECB Blowfish encodes in blocks of 12 chars, so anything else is malformed input
+        if ((temp.length() % 12) != 0)
+            return cipherText;
+
         temp = b64ToByte(temp);
         while ((temp.length() % 8) != 0) temp.append('\0');
     }
@@ -376,8 +380,13 @@ QByteArray Cipher::blowfishECB(QByteArray cipherText, bool direction)
     if (!cipher.ok())
         return cipherText;
 
-    if (direction)
+    if (direction) {
+        // Sanity check
+        if ((temp2.length() % 8) != 0)
+            return cipherText;
+
         temp2 = byteToB64(temp2);
+    }
 
     return temp2;
 }

programming_language: C++
CVE-2019-18397 (published 2019-11-13T14:15Z)

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/fribidi/fribidi
commit_details: repo_url: https://github.com/fribidi/fribidi
author: Dov Grobgeld
author_date: 2019-10-24 09:37:29+03:00
msg: Truncate isolate_level to FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL
repository: repo_url: https://github.com/fribidi/fribidi
repo_name: fribidi/fribidi
description: GNU FriBidi
repo_language: C
owner: fribidi
file_changes: filename: fribidi-bidi.c
change_type: ModificationType.MODIFY
diff: @@ -747,7 +747,9 @@ fribidi_get_par_embedding_levels_ex (
             }
 
 	  RL_LEVEL (pp) = level;
-          RL_ISOLATE_LEVEL (pp) = isolate_level++;
+          RL_ISOLATE_LEVEL (pp) = isolate_level;
+          if (isolate_level < FRIBIDI_BIDI_MAX_EXPLICIT_LEVEL-1)
+              isolate_level++;
           base_level_per_iso_level[isolate_level] = new_level;
 
 	  if (!FRIBIDI_IS_NEUTRAL (override))

programming_language: C
CVE-2022-3457 (published 2022-10-13T20:15Z)

Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-346
cwe_name: Origin Validation Error
description: The product does not properly verify that the source of data or communication is valid.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/ikus060/rdiffweb
commit_details: repo_url: https://github.com/ikus060/rdiffweb
author: Patrik Dufresne
author_date: 2022-10-11 17:21:04-04:00
msg: Enforce 'Origin' validation
repository: repo_url: https://github.com/ikus060/rdiffweb
repo_name: ikus060/rdiffweb
description: A simplified backup management software for quick access to your archives through an efficient web interface.
repo_language: Python
owner: ikus060
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -135,6 +135,7 @@ This next release focus on two-factor-authentication as a measure to increase se
 * Limit incorrect attempts to change the user's password to prevent brute force attacks #225 [CVE-2022-3273](https://nvd.nist.gov/vuln/detail/CVE-2022-3273)
 * Enforce password policy new password cannot be set as new password [CVE-2022-3376](https://nvd.nist.gov/vuln/detail/CVE-2022-3376)
 * Enforce better rate limit on login, mfa, password change and API [CVE-2022-3439](https://nvd.nist.gov/vuln/detail/CVE-2022-3439) [CVE-2022-3456](https://nvd.nist.gov/vuln/detail/CVE-2022-3456)
+* Enforce 'Origin' validation [CVE-2022-3457](https://nvd.nist.gov/vuln/detail/CVE-2022-3457)
 
 Breaking changes:
 

programming_language: Markdown
filename: test_secure_headers.py
change_type: ModificationType.MODIFY
diff: @@ -93,6 +93,15 @@ class SecureHeadersTest(rdiffweb.test.WebCase):
         self.assertStatus(403)
         self.assertInBody('Unexpected Origin header')
 
+    def test_post_with_prefixed_origin(self):
+        # Given a POST request made to rdiffweb
+        # When the request is made using a different origin
+        base = 'http://%s:%s' % (self.HOST + 'anything.com', self.PORT)
+        self.getPage('/dashboard/', headers=[('Origin', base)], method='POST')
+        # Then the request is accepted with 200 OK
+        self.assertStatus(403)
+        self.assertInBody('Unexpected Origin header')
+
     def test_post_with_valid_origin(self):
         # Given a POST request made to rdiffweb
         # When the request is made using a different origin

programming_language: Python
filename: secure_headers.py
change_type: ModificationType.MODIFY
diff: @@ -59,7 +59,7 @@ def set_headers(
     # Check if Origin matches our target.
     if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
         origin = request.headers.get('Origin', None)
-        if origin and not origin.startswith(request.base):
+        if origin and origin != request.base:
             raise cherrypy.HTTPError(403, 'Unexpected Origin header')
 
     # Check if https is enabled

programming_language: Python
CVE-2021-40145 (published 2021-08-26T01:15Z)

gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor\'s position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/libgd/libgd
commit_details: repo_url: https://github.com/libgd/libgd
author: Pierre Joye
author_date: 2021-08-24 16:34:59+07:00
msg: Merge pull request #713 from me22bee/_gdImageGd2

gdImageGd2Ptr memory leak
repository: repo_url: https://github.com/libgd/libgd
repo_name: libgd/libgd
description: GD Graphics Library
repo_language: C
owner: libgd
CVE-2018-10360 (published 2018-06-11T10:29Z)

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/file/file
commit_details: repo_url: https://github.com/file/file
author: Christos Zoulas
author_date: 2018-06-09 16:00:06+00:00
msg: Avoid reading past the end of buffer (Rui Reis)
repository: repo_url: https://github.com/file/file
repo_name: file/file
description: Read-only mirror of file CVS repository, updated every half hour. NOTE: do not make pull requests here, nor comment any commits, submit them usual way to bug tracker or to the mailing list. Maintainer(s) are not tracking  this git mirror.
repo_language: C
owner: file
file_changes: filename: readelf.c
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readelf.c,v 1.142 2018/05/24 18:08:01 christos Exp $")
+FILE_RCSID("@(#)$File: readelf.c,v 1.143 2018/06/09 16:00:06 christos Exp $")
 #endif
 
 #ifdef BUILTIN_ELF
@@ -842,7 +842,8 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
 
 				cname = (unsigned char *)
 				    &nbuf[doff + prpsoffsets(i)];
-				for (cp = cname; *cp && isprint(*cp); cp++)
+				for (cp = cname; cp < nbuf + size && *cp
+				    && isprint(*cp); cp++)
 					continue;
 				/*
 				 * Linux apparently appends a space at the end

programming_language: C
CVE-2021-40574 (published 2022-01-13T19:15Z)

The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-08-30 16:57:38+02:00
msg: fixed #1897
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: load_text.c
change_type: ModificationType.MODIFY
diff: @@ -255,7 +255,7 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 {
 	u32 i, j, len;
 	char *sOK;
-	char szLineConv[1024];
+	char szLineConv[2048];
 	unsigned short *sptr;
 
 	memset(szLine, 0, sizeof(char)*lineSize);
@@ -328,7 +328,7 @@ char *gf_text_get_utf8_line(char *szLine, u32 lineSize, FILE *txt_in, s32 unicod
 		}
 	}
 	sptr = (u16 *)szLine;
-	i = (u32) gf_utf8_wcstombs(szLineConv, 1024, (const unsigned short **) &sptr);
+	i = (u32) gf_utf8_wcstombs(szLineConv, 2048, (const unsigned short **) &sptr);
 	szLineConv[i] = 0;
 	strcpy(szLine, szLineConv);
 	/*this is ugly indeed: since input is UTF16-LE, there are many chances the gf_fgets never reads the \0 after a \n*/
@@ -2338,6 +2338,8 @@ static GF_Err gf_text_process_sub(GF_Filter *filter, GF_TXTIn *ctx)
 		while (szLine[i+1] && szLine[i+1]!='}') {
 			szTime[i] = szLine[i+1];
 			i++;
+			if (i>=19)
+				break;
 		}
 		szTime[i] = 0;
 		ctx->start = atoi(szTime);

programming_language: C
CVE-2018-17294 (published 2018-09-21T07:29Z)

The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/liblouis/liblouis
commit_details: repo_url: https://github.com/liblouis/liblouis
author: Christian Egli
author_date: 2018-09-03 11:52:24+02:00
msg: Fix a buffer overflow

Fixes #635

Thanks to HongxuChen for reporting it
repository: repo_url: https://github.com/liblouis/liblouis
repo_name: liblouis/liblouis
description: Open-source braille translator and back-translator.
repo_language: C
owner: liblouis
file_changes: filename: lou_translateString.c
change_type: ModificationType.MODIFY
diff: @@ -354,7 +354,9 @@ matchCurrentInput(
 		const InString *input, int pos, const widechar *passInstructions, int passIC) {
 	int k;
 	int kk = pos;
-	for (k = passIC + 2; k < passIC + 2 + passInstructions[passIC + 1]; k++)
+	for (k = passIC + 2;
+			((k < passIC + 2 + passInstructions[passIC + 1]) && (kk < input->length));
+			k++)
 		if (input->chars[kk] == ENDSEGMENT || passInstructions[k] != input->chars[kk++])
 			return 0;
 	return 1;

programming_language: C
CVE-2020-15187 (published 2020-09-17T22:15Z)

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 4.7, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/helm/helm
commit_details: repo_url: https://github.com/helm/helm
author: Matthew Fisher
author_date: 2020-09-17 11:44:07-07:00
msg: Merge pull request from GHSA-c52f-pq47-2r9j

switched to stricter YAML parsing on plugin metadata files
repository: repo_url: https://github.com/helm/helm
repo_name: helm/helm
description: The Kubernetes Package Manager
repo_language: Go
owner: helm
CVE-2009-1194 (published 2009-05-11T15:30Z)

Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-189
cwe_name: Numeric Errors
description: Weaknesses in this category are related to improper calculation or conversion of numbers.

Fix information:
repo_url: https://github.com/bratsche/pango
commit_details: repo_url: https://github.com/bratsche/pango
author: Behdad Esfahbod
author_date: 2009-03-02 12:00:52+03:30
msg: [glyphstring] Handle overflow with very long glyphstrings
repository: repo_url: https://github.com/bratsche/pango
repo_name: bratsche/pango
description: Library for laying out and rendering of text, with an emphasis on internationalization.
repo_language: C
owner: bratsche
file_changes: filename: glyphstring.c
change_type: ModificationType.MODIFY
diff: @@ -61,14 +61,28 @@ pango_glyph_string_set_size (PangoGlyphString *string, gint new_len)
   while (new_len > string->space)
     {
       if (string->space == 0)
-	string->space = 1;
+	{
+	  string->space = 4;
+	}
       else
-	string->space *= 2;
-
-      if (string->space < 0)
 	{
-	  g_warning ("glyph string length overflows maximum integer size, truncated");
-	  new_len = string->space = G_MAXINT - 8;
+	  const guint max_space =
+	    MIN (G_MAXINT, G_MAXSIZE / MAX (sizeof(PangoGlyphInfo), sizeof(gint)));
+
+	  guint more_space = (guint)string->space * 2;
+
+	  if (more_space > max_space)
+	    {
+	      more_space = max_space;
+
+	      if ((guint)new_len > max_space)
+		{
+		  g_error ("%s: failed to allocate glyph string of length %i\n",
+			   G_STRLOC, new_len);
+		}
+	    }
+
+	  string->space = more_space;
 	}
     }
 

programming_language: C