diff options
author | Norbert Preining <preining@logic.at> | 2018-09-19 04:02:06 +0000 |
---|---|---|
committer | Norbert Preining <preining@logic.at> | 2018-09-19 04:02:06 +0000 |
commit | 945e3295915cf8a3cbd54872724cab28530e120f (patch) | |
tree | d33dc2ce0c046f2ff36c54e5d871ab43207dab96 | |
parent | 977b5f9cac35f42e2409b60d6e793a3327d54647 (diff) |
writet1 protection against buffer overflow
git-svn-id: svn://tug.org/texlive/trunk@48697 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 5 | ||||
-rw-r--r-- | Build/source/texk/dvipsk/writet1.c | 2 | ||||
-rw-r--r-- | Build/source/texk/web2c/luatexdir/ChangeLog | 4 | ||||
-rw-r--r-- | Build/source/texk/web2c/luatexdir/font/writet1.c | 2 | ||||
-rw-r--r-- | Build/source/texk/web2c/pdftexdir/ChangeLog | 5 | ||||
-rw-r--r-- | Build/source/texk/web2c/pdftexdir/writet1.c | 2 |
6 files changed, 20 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 88faea44775..bbce8fb3f86 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,8 @@ +2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com> + + * writet1.c (t1_check_unusual_charstring): protect against buffer + overflow. + 2018-04-14 Karl Berry <karl@tug.org> * Version 5.998 for TeX Live 2018 release. diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c index 0fcf269070b..3b478b90084 100644 --- a/Build/source/texk/dvipsk/writet1.c +++ b/Build/source/texk/dvipsk/writet1.c @@ -1449,7 +1449,9 @@ static void t1_check_unusual_charstring(void) *(strend(t1_buf_array) - 1) = ' '; t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } diff --git a/Build/source/texk/web2c/luatexdir/ChangeLog b/Build/source/texk/web2c/luatexdir/ChangeLog index 62d4ab0491f..7219983d41f 100644 --- a/Build/source/texk/web2c/luatexdir/ChangeLog +++ b/Build/source/texk/web2c/luatexdir/ChangeLog @@ -1,3 +1,7 @@ +2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com> + * fonts/writet1.w (t1_check_unusual_charstring): protect against + buffer overflow. + 2018-08-27 Luigi Scarso <luigi.scarso@gmail.com> * dropped dependency from gmp and mpfr diff --git a/Build/source/texk/web2c/luatexdir/font/writet1.c b/Build/source/texk/web2c/luatexdir/font/writet1.c index 0a0cadcfb93..d3bf29341c1 100644 --- a/Build/source/texk/web2c/luatexdir/font/writet1.c +++ b/Build/source/texk/web2c/luatexdir/font/writet1.c @@ -1581,7 +1581,9 @@ static void t1_check_unusual_charstring(void) if (sscanf(p, "%i", &i) != 1) { strcpy(t1_buf_array, t1_line_array); t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog index 9fbb8114909..6e936a0610a 100644 --- a/Build/source/texk/web2c/pdftexdir/ChangeLog +++ b/Build/source/texk/web2c/pdftexdir/ChangeLog @@ -1,3 +1,8 @@ +2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com> + + * writet1.c (t1_check_unusual_charstring): protect against buffer + overflow. + 2018-09-09 Karl Berry <karl@tug.org> * expanded.test, diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c index d191b77ee5f..8cfc2616ca3 100644 --- a/Build/source/texk/web2c/pdftexdir/writet1.c +++ b/Build/source/texk/web2c/pdftexdir/writet1.c @@ -1598,7 +1598,9 @@ static void t1_check_unusual_charstring(void) *(strend(t1_buf_array) - 1) = ' '; t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } |