further buffer size corrections

git-svn-id: svn://tug.org/texlive/trunk@50649 c570f23f-e606-0410-a88d-b1316a301751

10 files changed, 72 insertions, 17 deletions

diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 559ba09b741..4b8c0a3a6e5 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,8 +1,12 @@
 2019-03-29  Karl Berry  <karl@freefriends.org>
 
+	* dospecial.c (dospecial) <bare psfile>: reverse sense of maccess
+	test, as intended; check for buffer overflow.
+	(maccess): add doc.
+
 	* color.c (colorcmdout),
-	* dospecial.c (dospecial) <epsfile>, <postscriptbox>: check for
-	buffer overflows.
+	* dospecial.c (dospecial) <epsfile>, <postscriptbox>, <psfile>:
+	check for buffer overflows.
 	* test-overflow-buffers.test,
 	* testdata/color.pro,
 	* testdata/overflow-color-push.dvi,
diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c
index e44efae4502..1e34c54a35f 100644
--- a/Build/source/texk/dvipsk/dospecial.c
+++ b/Build/source/texk/dvipsk/dospecial.c
@@ -574,13 +574,15 @@ default:
       scanfontcomments(ValStr);
 }
 
+/* Return 1 if S is readable along figpath, 0 if not. */
 static int
 maccess(char *s)
 {
    FILE *f = search(figpath, s, "r");
-   if (f)
+   int found = (f != 0);
+   if (found)
       (*close_file) (f);
-   return (f != 0);
+   return found;
 }
 
 const char *tasks[] = { 0, "iff2ps", "tek2ps" };
@@ -651,16 +653,22 @@ case 'e':
       unsigned psfilelen = 0;
 
       p += 8;
-      while (!isspace((unsigned char)*p)) {
+      while (*p && !isspace((unsigned char)*p)) {
         if (psfilelen < PSFILESIZ) {
           psfile[psfilelen] = *p;
           psfilelen++;
+          p++;
         } else {
-          sprintf(errbuf, "! epsfile= argument longer than %d characters",
-                  PSFILESIZ);
+          psfile[psfilelen] = 0; /* should not strictly be necessary */
+          sprintf(errbuf,
+                  "! epsfile=%.20s... argument longer than %d characters",
+                  psfile, PSFILESIZ);
           error(errbuf);
         }
       }
+      if (psfilelen == 0) {
+        error ("! epsfile= argument empty");
+      }
       psfile[psfilelen] = 0;
       p += strlen(psfile);
       fgetboundingbox(psfile, &llx, &lly, &urx, &ury);
@@ -936,18 +944,23 @@ default:
 
    while( (p=GetKeyVal(p,&j)) != NULL )
       switch (j) {
- case -1: /* for compatability with old conventions, we allow a file name
+ case -1: /* for compatibility with old conventions, we allow a file name
            * to be given without the 'psfile=' keyword */
-         if (!psfile[0] && maccess(KeyStr)==0) /* yes we can read it */
+         if (!psfile[0] && maccess(KeyStr)==1) { /* yes we can read it */
+             if (strlen(KeyStr) >= PSFILESIZ) {
+               sprintf(errbuf, 
+           "! Bare filename (%.20s...) in \\special longer than %d characters",
+                       KeyStr, PSFILESIZ);
+             }
              strcpy(psfile,KeyStr);
-         else {
+         } else {
            if (strlen(KeyStr) < 40) {
               sprintf(errbuf,
                       "Unknown keyword (%s) in \\special will be ignored",
                               KeyStr);
            } else {
               sprintf(errbuf,
-                      "Unknown keyword (%.40s...) in \\special will be ignored",
+                     "Unknown keyword (%.40s...) in \\special will be ignored",
                               KeyStr);
            }
            specerror(errbuf);
@@ -955,11 +968,18 @@ default:
          break;
  case 0: case 1: case 2: /* psfile */
          if (psfile[0]) {
-           sprintf(errbuf, "More than one \\special %s given; %s ignored",
-                    "psfile",  ValStr);
+           sprintf(errbuf, "More than one \\special %s given; %.40s ignored",
+                    "psfile", ValStr);
            specerror(errbuf);
+         } else {
+           if (strlen(ValStr) >= PSFILESIZ) {
+               sprintf(errbuf, 
+           "! PS filename (%.20s...) in \\special longer than %d characters",
+                       ValStr, PSFILESIZ);
+	       error(errbuf);
+           }
+           strcpy(psfile, ValStr);
          }
-         else strcpy(psfile,ValStr);
          task = tasks[j];
          break;
  default: /* most keywords are output as PostScript procedure calls */
diff --git a/Build/source/texk/dvipsk/test-overflow-buffers.test b/Build/source/texk/dvipsk/test-overflow-buffers.test
index 4c2794826b9..28e314ef0ad 100755
--- a/Build/source/texk/dvipsk/test-overflow-buffers.test
+++ b/Build/source/texk/dvipsk/test-overflow-buffers.test
@@ -3,7 +3,8 @@
 # Public domain. Various buffer overflows, reported by
 # Andy Nguyen of ETH Zurich. The program should detect and abort.
 
-for tst in overflow-color-push overflow-epsfile overflow-psbox; do
+for tst in overflow-color-push overflow-epsfile \
+           overflow-ifffile overflow-psbox; do
   :
   if ./dvips $srcdir/testdata/$tst.dvi -o; then
     echo "$0: test $tst should have failed." >&2
@@ -11,4 +12,10 @@ for tst in overflow-color-push overflow-epsfile overflow-psbox; do
   fi
 done
 
+# overflow-keyword succeeds, because the special is ignored,
+# because the file (named with 999 a's) does not exist.
+tst=overflow-keyword
+./dvips $srcdir/testdata/$tst.dvi -o || exit 1
+grep ' @setspecial' $tst.ps || exit 1
+
 exit 0
diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
index b2b3a44f3f4..0d7e5429aef 100644
--- a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
+++ b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
diff --git a/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi b/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi
new file mode 100644
index 00000000000..00859cfedc2
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi
diff --git a/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex b/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex
new file mode 100755
index 00000000000..aa6d95f7b55
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex
@@ -0,0 +1,12 @@
+\documentclass{article}
+
+\begin{document}
+\thispagestyle{empty}
+
+\begin{figure}[p]
+
+\special{ifffile=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
+
+\end{figure}
+
+\end{document}
diff --git a/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi b/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi
new file mode 100644
index 00000000000..0df5740c803
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi
diff --git a/Build/source/texk/dvipsk/testdata/overflow-keyword.tex b/Build/source/texk/dvipsk/testdata/overflow-keyword.tex
new file mode 100755
index 00000000000..f3f6f31d280
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-keyword.tex
@@ -0,0 +1,12 @@
+\documentclass{article}
+
+\begin{document}
+\thispagestyle{empty}
+
+\begin{figure}[p]
+
+\special{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
+
+\end{figure}
+
+\end{document}
diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
index f890d469006..56ddd5e5b23 100644
--- a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
+++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
index a0431a70168..f7628e27e3b 100644
--- a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
+++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
@@ -1,5 +1,5 @@
 % Andy Nguyen of ETH Zurich. Public domain.
-% tlsecurity mail of 28 Mar 2019 18:20:48.
+% tlsecurity mail of 29 Mar 2019 22:41:20.
 % File "dvipsk/dospecial.c", subroutine "dospecial": "psfile" is parsed using
 % "sscanf(p+13, "{%fpt}{%fpt}{%[^}]}", &w, &h, psfile)", which has no length
 % limitation.
@@ -11,7 +11,7 @@
 
 \begin{figure}[p]
 
-\special{postscriptbox{}{}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}}
+\special{postscriptbox{42pt}{1337pt}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}}
 
 \end{figure}