summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-03-30 22:42:24 +0000
committerKarl Berry <karl@freefriends.org>2019-03-30 22:42:24 +0000
commitae8742c534fa40d57cdcf168c89aaed6d8edaa9d (patch)
tree389dfcc17f94371df9e70479f6dce08cbcd0df8d
parentab2b1e99acbd0085b73451a2286c1edb0ab2c6ed (diff)
avoid writing beyond end of isblack
git-svn-id: svn://tug.org/texlive/trunk@50670 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipsk/ChangeLog6
-rw-r--r--Build/source/texk/dvipsk/emspecial.c16
2 files changed, 20 insertions, 2 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index e92d8b7359f..f3a3fc8bb26 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,9 @@
+2019-03-30 Karl Berry <karl@freefriends.org>
+
+ * emspecial.c (bmpgraph): avoid writing after isblack
+ if clrtablesize is >256.
+ Report from Andy Nguyen of ETH Zurich.
+
2019-03-29 Karl Berry <karl@freefriends.org>
* loadfont.c (errbuf),
diff --git a/Build/source/texk/dvipsk/emspecial.c b/Build/source/texk/dvipsk/emspecial.c
index c96298ce267..f25b1eb5a1c 100644
--- a/Build/source/texk/dvipsk/emspecial.c
+++ b/Build/source/texk/dvipsk/emspecial.c
@@ -1,4 +1,4 @@
-/*
+/* $Id$
* emspecial.c
* This routine handles the emTeX special commands.
*/
@@ -1142,7 +1142,8 @@ bmpgraph(FILE *f, char *filename, float emwidth, float emheight)
struct bitmapfileheader bmfh;
struct bitmapinfoheader bmih;
- unsigned char isblack[256];
+ #define ISBLACKSIZ 256
+ unsigned char isblack[ISBLACKSIZ];
unsigned char rr;
unsigned char gg;
unsigned char bb;
@@ -1251,6 +1252,17 @@ bmpgraph(FILE *f, char *filename, float emwidth, float emheight)
else
clrtablesize = bmih.clrused;
+ if (clrtablesize > ISBLACKSIZ) {
+ /* This is wrong, since we won't read the whole file below.
+ But we can't give correct output without more work,
+ and it's unlikely these specials are still in use. */
+ sprintf(errbuf,
+ "em color table size (%d) larger than %d; output incorrect",
+ clrtablesize, ISBLACKSIZ);
+ specerror(errbuf);
+ clrtablesize = ISBLACKSIZ;
+ }
+
/* read in the color table */
for (i = 0; i < clrtablesize; i++) {
bb = fgetc(f);