summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2010-03-25 23:55:25 +0000
committerKarl Berry <karl@freefriends.org>2010-03-25 23:55:25 +0000
commit5c71f7dcce52cab382d58624cc13df5caf788723 (patch)
tree81e2f774f1edce6aaf2aec13dc9adc8579f76da0
parentf8e66706cc8008765a0c876e6f4a8f58336fd6ec (diff)
avoid integer overflow, CVE-2010-0739
git-svn-id: svn://tug.org/texlive/trunk@17559 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipsk/ChangeLog6
-rw-r--r--Build/source/texk/dvipsk/dospecial.c6
2 files changed, 12 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 8fb408fca49..a86425f0655 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,9 @@
+2010-03-26 Karl Berry <karl@tug.org>
+
+ * dospecial.c (predospecial): avoid seg fault from integer overflow.
+ CVE-2010-0739, found by Marc Schoenefeld, patch prepared
+ by Jindrich Novy.
+
2010-02-26 Karl Berry <karl@tug.org>
* search.c (selfautoloc_prog, quote_name): remove kpse_ prefix for
diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c
index 8f0a352d407..63fefbf4ac8 100644
--- a/Build/source/texk/dvipsk/dospecial.c
+++ b/Build/source/texk/dvipsk/dospecial.c
@@ -297,6 +297,12 @@ predospecial(integer numbytes, Boolean scanning)
static int omega_specials = 0;
if (nextstring + numbytes > maxstring) {
+ if (numbytes < 0
+ || (numbytes > 0 && 2 > INT_MAX / numbytes)
+ || 2 * numbytes > 1000 + 2 * numbytes) {
+ error("! Integer overflow in predospecial");
+ exit(1);
+ }
p = nextstring = mymalloc(1000 + 2 * numbytes) ;
maxstring = nextstring + 2 * numbytes + 700 ;
}