Limit the amount of bytes read into char units[255], bug 278186. --- htmldoc/util.cxx.orig 2009-07-17 19:28:53.000000000 +0200 +++ htmldoc/util.cxx 2009-07-17 19:29:07.000000000 +0200 @@ -484,7 +484,7 @@ PageWidth = 595; PageLength = 792; } - else if (sscanf(size, "%fx%f%s", &width, &length, units) >= 2) + else if (sscanf(size, "%fx%f%254s", &width, &length, units) >= 2) { /* * Custom size...