diff options
| author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2016-03-24 05:37:10 +0000 |
|---|---|---|
| committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2016-03-24 05:37:10 +0000 |
| commit | 311869640590373b97552dd2570111528ae4ba15 (patch) | |
| tree | bf714ce01b162855526e5e0210a0ec04b67c1fbf | |
| parent | 64fadf4c456815e97ceafa779f14270f6530db86 (diff) | |
dvipsk/writet1.c, pdftexdir/writet1.c: Fix 1-byte buffer overflow bug
git-svn-id: svn://tug.org/texlive/trunk@40113 c570f23f-e606-0410-a88d-b1316a301751
| -rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 5 | ||||
| -rw-r--r-- | Build/source/texk/dvipsk/writet1.c | 6 | ||||
| -rw-r--r-- | Build/source/texk/web2c/pdftexdir/ChangeLog | 5 | ||||
| -rw-r--r-- | Build/source/texk/web2c/pdftexdir/writet1.c | 6 |
4 files changed, 16 insertions, 6 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index cde2f492927..3d06bf0435c 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,8 @@ +2016-03-24 Akira Kakuto <kakuto@fuk.kindai.ac.jp> + + * writet1.c: Fix one-byte buffer overflow bug reported by Hanno Boeck: + http://tug.org/pipermail/tex-live/2016-January/037686.html. + 2016-02-01 Karl Berry <karl@tug.org> * dvips.1, diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c index 460c477c5f5..0fcf269070b 100644 --- a/Build/source/texk/dvipsk/writet1.c +++ b/Build/source/texk/dvipsk/writet1.c @@ -699,8 +699,8 @@ static char **t1_builtin_enc(void) for (i = 0; i < 256; i++) glyph_names[i] = notdef; if (t1_suffix("def")) { /* predefined encoding */ - sscanf(t1_line_array + strlen("/Encoding"), "%256s", t1_buf_array); - if (strcmp(t1_buf_array, "StandardEncoding") == 0) { + if (sscanf(t1_line_array + strlen("/Encoding"), "%255s", t1_buf_array) == 1 + && strcmp(t1_buf_array, "StandardEncoding") == 0) { t1_encoding = ENC_STANDARD; for (i = 0; i < 256; i++) { if (standard_glyph_names[i] != notdef) @@ -765,7 +765,7 @@ static char **t1_builtin_enc(void) /* check for `dup <index> <glyph> put' */ - if (sscanf(p, "dup %i%256s put", &i, t1_buf_array) == 2 && + if (sscanf(p, "dup %i%255s put", &i, t1_buf_array) == 2 && *t1_buf_array == '/' && valid_code(i)) { if (strcmp(t1_buf_array + 1, notdef) != 0) glyph_names[i] = xstrdup(t1_buf_array + 1); diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog index 6f703efbcab..5c3a40c0337 100644 --- a/Build/source/texk/web2c/pdftexdir/ChangeLog +++ b/Build/source/texk/web2c/pdftexdir/ChangeLog @@ -1,3 +1,8 @@ +2016-03-24 Akira Kakuto <kakuto@fuk.kindai.ac.jp> + + * writet1.c: Fix one-byte buffer overflow bug reported by Hanno Boeck: + http://tug.org/pipermail/tex-live/2016-January/037686.html. + 2016-03-21 Karl Berry <karl@tug.org> * NEWS, diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c index 363853bf38a..d191b77ee5f 100644 --- a/Build/source/texk/web2c/pdftexdir/writet1.c +++ b/Build/source/texk/web2c/pdftexdir/writet1.c @@ -771,8 +771,8 @@ static char **t1_builtin_enc(void) for (i = 0; i < 256; i++) glyph_names[i] = notdef; if (t1_suffix("def")) { /* predefined encoding */ - sscanf(t1_line_array + strlen("/Encoding"), "%256s", t1_buf_array); - if (strcmp(t1_buf_array, "StandardEncoding") == 0) { + if (sscanf(t1_line_array + strlen("/Encoding"), "%255s", t1_buf_array) == 1 + && strcmp(t1_buf_array, "StandardEncoding") == 0) { t1_encoding = ENC_STANDARD; for (i = 0; i < 256; i++) { if (standard_glyph_names[i] != notdef) @@ -837,7 +837,7 @@ static char **t1_builtin_enc(void) /* check for `dup <index> <glyph> put' */ - if (sscanf(p, "dup %i%256s put", &i, t1_buf_array) == 2 && + if (sscanf(p, "dup %i%255s put", &i, t1_buf_array) == 2 && *t1_buf_array == '/' && valid_code(i)) { if (strcmp(t1_buf_array + 1, notdef) != 0) glyph_names[i] = xstrdup(t1_buf_array + 1); |