summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNorbert Preining <preining@logic.at>2018-09-17 23:55:58 +0000
committerNorbert Preining <preining@logic.at>2018-09-17 23:55:58 +0000
commit5faea90cb442dfe14a2c4e12687aa765a796e9f8 (patch)
treee873459388b7b85deba737977c2e64e17c766e71
parentb9533c7ad8a2f437eb086e52286ce9fd4b257d50 (diff)
writet1.(c,w) of dvips, pdftex, luatex: protect against buffer overflow
git-svn-id: svn://tug.org/texlive/branches/branch2018@48688 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipsk/ChangeLog5
-rw-r--r--Build/source/texk/dvipsk/writet1.c2
-rw-r--r--Build/source/texk/web2c/luatexdir/ChangeLog5
-rw-r--r--Build/source/texk/web2c/luatexdir/font/writet1.w2
-rw-r--r--Build/source/texk/web2c/pdftexdir/ChangeLog5
-rw-r--r--Build/source/texk/web2c/pdftexdir/writet1.c2
6 files changed, 21 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 88faea44775..4560c4b1906 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,8 @@
+2018-09-18 Norbert Preining <preining@logic.at>
+
+ * writet1.c (t1_check_unusual_charstring): protect against buffer
+ overflow.
+
2018-04-14 Karl Berry <karl@tug.org>
* Version 5.998 for TeX Live 2018 release.
diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c
index 0fcf269070b..3b478b90084 100644
--- a/Build/source/texk/dvipsk/writet1.c
+++ b/Build/source/texk/dvipsk/writet1.c
@@ -1449,7 +1449,9 @@ static void t1_check_unusual_charstring(void)
*(strend(t1_buf_array) - 1) = ' ';
t1_getline();
+ alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcat(t1_buf_array, t1_line_array);
+ alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcpy(t1_line_array, t1_buf_array);
t1_line_ptr = eol(t1_line_array);
}
diff --git a/Build/source/texk/web2c/luatexdir/ChangeLog b/Build/source/texk/web2c/luatexdir/ChangeLog
index 94cbfc3e6d5..2948f1cb75f 100644
--- a/Build/source/texk/web2c/luatexdir/ChangeLog
+++ b/Build/source/texk/web2c/luatexdir/ChangeLog
@@ -1,3 +1,8 @@
+2018-09-18 Norbert Preining <preining@logic.at>
+
+ * fonts/writet1.w (t1_check_unusual_charstring): protect against
+ buffer overflow.
+
2017-11-02 Luigi Scarso <luigi.scarso@gmail.com>
LuaFilesystem 1.7.0
diff --git a/Build/source/texk/web2c/luatexdir/font/writet1.w b/Build/source/texk/web2c/luatexdir/font/writet1.w
index fc1a89cd547..02786286585 100644
--- a/Build/source/texk/web2c/luatexdir/font/writet1.w
+++ b/Build/source/texk/web2c/luatexdir/font/writet1.w
@@ -1625,7 +1625,9 @@ static void t1_check_unusual_charstring(void)
if (sscanf(p, "%i", &i) != 1) {
strcpy(t1_buf_array, t1_line_array);
t1_getline();
+ alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcat(t1_buf_array, t1_line_array);
+ alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcpy(t1_line_array, t1_buf_array);
t1_line_ptr = eol(t1_line_array);
}
diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog
index c022bc2523d..596b943f543 100644
--- a/Build/source/texk/web2c/pdftexdir/ChangeLog
+++ b/Build/source/texk/web2c/pdftexdir/ChangeLog
@@ -1,3 +1,8 @@
+2018-09-18 Norbert Preining <preining@logic.at>
+
+ * writet1.c (t1_check_unusual_charstring): protect against buffer
+ overflow.
+
2018-04-14 Karl Berry <karl@tug.org>
* TeX Live 2018 release, pdftex 1.40.19.
diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c
index d191b77ee5f..8cfc2616ca3 100644
--- a/Build/source/texk/web2c/pdftexdir/writet1.c
+++ b/Build/source/texk/web2c/pdftexdir/writet1.c
@@ -1598,7 +1598,9 @@ static void t1_check_unusual_charstring(void)
*(strend(t1_buf_array) - 1) = ' ';
t1_getline();
+ alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcat(t1_buf_array, t1_line_array);
+ alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcpy(t1_line_array, t1_buf_array);
t1_line_ptr = eol(t1_line_array);
}