avoid arbitrary %s sprintf into fixed errbuf

git-svn-id: svn://tug.org/texlive/trunk@50650 c570f23f-e606-0410-a88d-b1316a301751

11 files changed, 33 insertions, 19 deletions

diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 4b8c0a3a6e5..e92d8b7359f 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,5 +1,15 @@
 2019-03-29  Karl Berry  <karl@freefriends.org>
 
+	* loadfont.c (errbuf),
+	* protos.h (errbuf): increase to 1500.
+	* dospecial.c,
+	* flib.c,
+	* makefont.c,
+	* output.c,
+	* pprescan.c,
+	* scanpage.c,
+	* tfmload.c: limit sprintf %s arguments into buffers.
+
 	* dospecial.c (dospecial) <bare psfile>: reverse sense of maccess
 	test, as intended; check for buffer overflow.
 	(maccess): add doc.
diff --git a/Build/source/texk/dvipsk/dosection.c b/Build/source/texk/dvipsk/dosection.c
index c7987130e49..4ece3bce5a1 100644
--- a/Build/source/texk/dvipsk/dosection.c
+++ b/Build/source/texk/dvipsk/dosection.c
@@ -40,7 +40,7 @@ dosection(sectiontype *s, int c)
    doubleout(mag);
    numout((integer)DPI);
    numout((integer)VDPI);
-   snprintf(buf, sizeof(buf), "(%.99s)", fulliname);
+   snprintf(buf, sizeof(buf), "(%.500s)", fulliname);
    cmdout(buf);
    newline();
    cmdout("@start");
diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c
index 1e34c54a35f..b17255fe5c2 100644
--- a/Build/source/texk/dvipsk/dospecial.c
+++ b/Build/source/texk/dvipsk/dospecial.c
@@ -129,7 +129,7 @@ fgetboundingbox(char *f, float *llx_p, float *lly_p, float *urx_p, float *ury_p)
       }
       fclose(fp);
    }
-   sprintf(errbuf, "Couldn't get BoundingBox of %s: assuming full A4 size", f);
+   sprintf(errbuf, "Couldn't get BoundingBox of %.500s: assuming full A4 size", f);
    specerror(errbuf);
    *llx_p = 0.0;
    *lly_p = 0.0;
@@ -329,7 +329,7 @@ found: *tno = i;
    switch (KeyTab[i].Type) {
  case Integer:
       if(sscanf(ValStr,"%ld",&ValInt)!=1) {
-          sprintf(errbuf,"Non-integer value (%s) given for keyword %s",
+          sprintf(errbuf,"Non-integer value (%.500s) given for keyword %.500s",
               ValStr, KeyStr);
           specerror(errbuf);
           ValInt = 0;
@@ -338,7 +338,7 @@ found: *tno = i;
  case Number:
  case Dimension:
       if(sscanf(ValStr,"%f",&ValNum)!=1) {
-          sprintf(errbuf,"Non-numeric value (%s) given for keyword %s",
+          sprintf(errbuf,"Non-numeric value (%.500s) given for keyword %.500s",
               ValStr, KeyStr);
           specerror(errbuf);
           ValNum = 0.0;
@@ -702,7 +702,8 @@ case 'e':
                cmdout("@rhi");
                break;
             default:
-               sprintf(errbuf, "Unknown keyword `%s' in \\special{epsfile=%s...} will be ignored\n", KeyStr, psfile);
+               sprintf(errbuf, "Unknown keyword `%.500s' in \\special{epsfile=%.500s...} will be ignored\n",
+               KeyStr, psfile);
                specerror(errbuf);
                break;
          }
diff --git a/Build/source/texk/dvipsk/flib.c b/Build/source/texk/dvipsk/flib.c
index 4a93bab9dc9..8b5e88e9bb4 100644
--- a/Build/source/texk/dvipsk/flib.c
+++ b/Build/source/texk/dvipsk/flib.c
@@ -243,7 +243,7 @@ flisearch(char *n, halfword dpi)
                              fli_cache[i] = fli_cache[i-1];
                         /* put this font library at front */
                         if ( (pkfile=search(flipath,lib->name,READBIN)) == (FILE *)NULL ) {
-                           sprintf(errbuf,"Can't reopen font library %s", lib->name);
+                           sprintf(errbuf,"Can't reopen font library %.500s", lib->name);
                            error(errbuf);
                            return((FILE *)NULL);
 			}
@@ -253,7 +253,7 @@ flisearch(char *n, halfword dpi)
                      }
                      flib = 1;  /* tell loadfont() not to close it */
                      /* then seek font within library */
-                     sprintf(name,"%s %s %ddpi",lib->name, n, dpi1);
+                     sprintf(name,"%.500s %.500s %ddpi",lib->name, n, dpi1);
                      if (fseek(pkfile,entry->offset,0) )
                            badpk("couldn't seek font");
                         /* make sure it is a PK font */
@@ -263,7 +263,7 @@ flisearch(char *n, halfword dpi)
                                  badpk("couldn't seek font");
                               return(pkfile); /* found it */
                            }
-                        sprintf(errbuf,"%s %s %ddpi isn't PK format, ignoring",
+                        sprintf(errbuf,"%.500s %.500s %ddpi isn't PK format, ignoring",
                               lib->name, n, dpi1);
                         error(errbuf);
                } /* end if name correct */
diff --git a/Build/source/texk/dvipsk/loadfont.c b/Build/source/texk/dvipsk/loadfont.c
index dee7f1f2cfc..b0e6267c00e 100644
--- a/Build/source/texk/dvipsk/loadfont.c
+++ b/Build/source/texk/dvipsk/loadfont.c
@@ -27,7 +27,7 @@
  */
 #include "protos_add.h"
 
-char errbuf[1000];
+char errbuf[1500];
 int lastresortsizes[40];
 /*
  *   Now we have some routines to get stuff from the PK file.
diff --git a/Build/source/texk/dvipsk/makefont.c b/Build/source/texk/dvipsk/makefont.c
index 84d90cae13f..ef303888a57 100644
--- a/Build/source/texk/dvipsk/makefont.c
+++ b/Build/source/texk/dvipsk/makefont.c
@@ -161,7 +161,7 @@ case 'b' : case 'B' :
             sprintf(q, "%d", bdpi);
             break;
 case 'o' : case 'O' :
-            sprintf(q, "%s", mfmode ? mfmode : "default");
+            sprintf(q, "%.99s", mfmode ? mfmode : "default");
             modegiven = 1;
             break;
 case 'm' : case 'M' :
diff --git a/Build/source/texk/dvipsk/output.c b/Build/source/texk/dvipsk/output.c
index 14615db3eeb..1114ee7faf5 100644
--- a/Build/source/texk/dvipsk/output.c
+++ b/Build/source/texk/dvipsk/output.c
@@ -176,7 +176,7 @@ copyfile_general(const char *s, struct header_list *cur_header)
       }
 #endif /* VMCMS */
 #else /* VMCMS || MVSXA */
-      sprintf(errbuf, "Could not find figure file %s; continuing.", s);
+      sprintf(errbuf, "Could not find figure file %.500s; continuing.", s);
       if (secure == 2) {
          strcat(errbuf, "\nNote that an absolute path or a relative path with .. are denied in -R2 mode.");
       }
@@ -190,19 +190,20 @@ copyfile_general(const char *s, struct header_list *cur_header)
 #ifndef __THINK__
    case 2:
 #ifdef SECURE
-      sprintf(errbuf, "<%s>: Tick filename execution disabled", s);
+      sprintf(errbuf, "<%.500s>: Tick filename execution disabled", s);
 #else
 #ifdef OS2
       if (_osmode == OS2_MODE) {
 #endif
       if (secure == 0) {
-         sprintf(errbuf, "Execution of  <%s> failed ", s);
+         sprintf(errbuf, "Execution of <%.500s> failed ", s);
          f = popen(s, "r");
          if (f != 0)
             SET_BINARY(fileno(f));
 	}
 	else {
-      sprintf(errbuf,"Secure mode is %d so execute <%s> will not run", secure,s);
+      sprintf(errbuf,"Secure mode is %d so execute <%.500s> will not run",
+              secure, s);
 	}
 #ifdef OS2
       }
@@ -221,7 +222,7 @@ copyfile_general(const char *s, struct header_list *cur_header)
 	 if(f==NULL)
 	    f = search(figpath, s, READBIN);
       }
-      sprintf(errbuf, "! Could not find header file %s.", s);
+      sprintf(errbuf, "! Could not find header file %.500s.", s);
       if (secure == 2) {
          strcat(errbuf, "\nNote that an absolute path or a relative path with .. are denied in -R2 mode.");
       }
diff --git a/Build/source/texk/dvipsk/pprescan.c b/Build/source/texk/dvipsk/pprescan.c
index 71d0889e4fc..d1a024a50b8 100644
--- a/Build/source/texk/dvipsk/pprescan.c
+++ b/Build/source/texk/dvipsk/pprescan.c
@@ -113,7 +113,8 @@ dochar:
          if (curfnt==NULL)
             error("! Bad DVI file: no font selected");
          if (mychar>=curfnt->maxchars) {
-            sprintf(errbuf,"! invalid char %d from font %s", mychar, curfnt->name);
+            sprintf(errbuf,"! invalid char %d from font %.500s",
+                    mychar, curfnt->name);
             error(errbuf);
          }
          if (curfnt->loaded == 2) { /* scanning a virtual font character */
diff --git a/Build/source/texk/dvipsk/protos.h b/Build/source/texk/dvipsk/protos.h
index 95af3dd59b2..853dead174c 100644
--- a/Build/source/texk/dvipsk/protos.h
+++ b/Build/source/texk/dvipsk/protos.h
@@ -380,7 +380,7 @@ extern Boolean noprocset;
 #endif
 
 /* global variables from loadfont.c */
-extern char errbuf[1000];
+extern char errbuf[1500];
 extern int lastresortsizes[40];
 extern FILE *pkfile;
 
diff --git a/Build/source/texk/dvipsk/scanpage.c b/Build/source/texk/dvipsk/scanpage.c
index 824a8f5143f..ccb5142ee52 100644
--- a/Build/source/texk/dvipsk/scanpage.c
+++ b/Build/source/texk/dvipsk/scanpage.c
@@ -193,7 +193,8 @@ dochar:
          if (curfnt==NULL)
             error("! Bad DVI file: no font selected");
          if (mychar>=curfnt->maxchars) {
-            sprintf(errbuf,"! invalid char %d from font %s", mychar, curfnt->name);
+            sprintf(errbuf,"! invalid char %d from font %.500s",
+                    mychar, curfnt->name);
             error(errbuf);
          }
          if (curfnt->loaded == 2) { /* scanning a virtual font character */
diff --git a/Build/source/texk/dvipsk/tfmload.c b/Build/source/texk/dvipsk/tfmload.c
index e93e815ef91..cd507d0c2bd 100644
--- a/Build/source/texk/dvipsk/tfmload.c
+++ b/Build/source/texk/dvipsk/tfmload.c
@@ -73,7 +73,7 @@ tfmopen(register fontdesctype *fd)
 #endif
    if ((tfmfile=search(d, name, READBIN))!=NULL)
       return;
-   sprintf(errbuf, "Can't open font metric file %s%s",
+   sprintf(errbuf, "Can't open font metric file %.500s%.500s",
           fd->area, name);
    error(errbuf);
    error("I will use cmr10.tfm instead, so expect bad output.");