summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-03-29 18:02:17 +0000
committerKarl Berry <karl@freefriends.org>2019-03-29 18:02:17 +0000
commitce78fe6084c04d173c8da96c95146633c129ea8d (patch)
treea8954f07dcde4ae26c6699084a724a4da3bb9bb9
parent6d3a7f7099dfb79e19a3574f81287c212d4185e1 (diff)
dvips buffer overflows reported by Andy Nguyen
git-svn-id: svn://tug.org/texlive/trunk@50641 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipsk/ChangeLog16
-rw-r--r--Build/source/texk/dvipsk/Makefile.am14
-rw-r--r--Build/source/texk/dvipsk/Makefile.in38
-rw-r--r--Build/source/texk/dvipsk/color.c16
-rw-r--r--Build/source/texk/dvipsk/dospecial.c29
-rwxr-xr-xBuild/source/texk/dvipsk/test-overflow-buffers.test14
-rw-r--r--Build/source/texk/dvipsk/testdata/color.pro46
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-color-push.dvibin0 -> 1296 bytes
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-color-push.tex17
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-epsfile.dvibin0 -> 1120 bytes
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-epsfile.tex17
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-psbox.dvibin0 -> 780 bytes
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-psbox.tex18
13 files changed, 201 insertions, 24 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index c6ce958c6b4..559ba09b741 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,19 @@
+2019-03-29 Karl Berry <karl@freefriends.org>
+
+ * color.c (colorcmdout),
+ * dospecial.c (dospecial) <epsfile>, <postscriptbox>: check for
+ buffer overflows.
+ * test-overflow-buffers.test,
+ * testdata/color.pro,
+ * testdata/overflow-color-push.dvi,
+ * testdata/overflow-color-push.tex,
+ * testdata/overflow-epsfile.dvi,
+ * testdata/overflow-epsfile.tex,
+ * testdata/overflow-psbox.dvi,
+ * testdata/overflow-psbox.tex: new test files and support.
+ * Makefile.am (TESTS, EXTRA_DIST, DISTCLEANFILES): add new tests.
+ Report from Andy Nguyen of ETH Zurich.
+
2019-02-26 Hironobu Yamashita <h.y.acetaminophen@gmail.com>
* afm2tfm.c: Forbid too long file name.
diff --git a/Build/source/texk/dvipsk/Makefile.am b/Build/source/texk/dvipsk/Makefile.am
index e7229b85b3e..a3a0e318e4c 100644
--- a/Build/source/texk/dvipsk/Makefile.am
+++ b/Build/source/texk/dvipsk/Makefile.am
@@ -1,7 +1,7 @@
## $Id$
## Makefile.am for the TeX Live subdirectory texk/dvipsk/
##
-## Copyright 2017 Karl Berry <tex-live@tug.org>
+## Copyright 2017-2019 Karl Berry <tex-live@tug.org>
## Copyright 2009-2015 Peter Breitenlohner <tex-live@tug.org>
## You may freely use, modify and/or distribute this file.
##
@@ -113,9 +113,11 @@ TEST_EXTENSIONS = .pl .test
TESTS = afm2tfm-test.pl
afm2tfm-test.log: afm2tfm$(EXEEXT)
TESTS += beginfontk1.test eepic-nan.test pfbincl.test \
- quotecmd-test.pl same-name.test test-dvips.test
+ quotecmd-test.pl same-name.test test-dvips.test \
+ test-overflow-buffers.test
beginfontk1.log eepic-nan.log pfbincl.log \
- quotecmd-test.log same-name.log test-dvips.log: dvips$(EXEEXT)
+ quotecmd-test.log same-name.log test-dvips.log \
+ test-overflow-buffers.log: dvips$(EXEEXT)
AM_TESTS_ENVIRONMENT = TEXMFCNF=$(srcdir)/../kpathsea; export TEXMFCNF;
AM_TESTS_ENVIRONMENT += TEXCONFIG=$(srcdir)/testdata; export TEXCONFIG;
@@ -138,6 +140,7 @@ EXTRA_DIST += \
testdata/cmsy10.tfm \
testdata/cmtt10.pfb \
testdata/cmtt10.tfm \
+ testdata/color.pro \
testdata/config.pdf \
testdata/config.ps \
testdata/psfonts.map \
@@ -171,6 +174,11 @@ DISTCLEANFILES += same-name.out
## test-dvips
EXTRA_DIST += testdata/dvipstst.tex testdata/dvipstst.xdv testdata/dvipstst.xps
DISTCLEANFILES += dvipstst.ps missfont.log mtest.ps
+## test-overflow-buffers
+EXTRA_DIST += overflow-color-push.dvi overflow-color-push.tex \
+ overflow-epsfile.dvi overflow-epsfile.tex \
+ overflow-psbox.dvi overflow-psbox.tex
+DISTCLEANFILES += overflow-color-push.ps overflow-epsfile.ps overflow-psbox.ps
EXTRA_DIST += \
NEWS \
diff --git a/Build/source/texk/dvipsk/Makefile.in b/Build/source/texk/dvipsk/Makefile.in
index 445572880c7..7743265c0ab 100644
--- a/Build/source/texk/dvipsk/Makefile.in
+++ b/Build/source/texk/dvipsk/Makefile.in
@@ -714,7 +714,8 @@ info_TEXINFOS = dvips.texi
dvips_TEXINFOS = contrib/config.proto dvips.help
DISTCLEANFILES = $(DVIS) $(PSS) afmtest.tfm beginfontk1.ps \
eepic-nan.ps pfbincl.ps *badnews* same-name.out dvipstst.ps \
- missfont.log mtest.ps
+ missfont.log mtest.ps overflow-color-push.ps \
+ overflow-epsfile.ps overflow-psbox.ps
prolog_DATA = $(prologues)
dist_prologues = \
color.lpro \
@@ -733,28 +734,32 @@ EXTRA_DIST = $(dist_prologues) texc.script $(TESTS) testdata/8r.enc \
testdata/cmex10.tfm testdata/cmmi10.pfb testdata/cmmi10.tfm \
testdata/cmr10.pfb testdata/cmr10.tfm testdata/cmsy10.pfb \
testdata/cmsy10.tfm testdata/cmtt10.pfb testdata/cmtt10.tfm \
- testdata/config.pdf testdata/config.ps testdata/psfonts.map \
- testdata/ptmbi.vf testdata/ptmbi8r.tfm testdata/ptmr.vf \
- testdata/ptmr8r.tfm testdata/ptmri.vf testdata/ptmri8r.tfm \
- testdata/special.pro testdata/tex.pro testdata/texc.pro \
- testdata/texps.pro testdata/beginfontk1.dvi \
+ testdata/color.pro testdata/config.pdf testdata/config.ps \
+ testdata/psfonts.map testdata/ptmbi.vf testdata/ptmbi8r.tfm \
+ testdata/ptmr.vf testdata/ptmr8r.tfm testdata/ptmri.vf \
+ testdata/ptmri8r.tfm testdata/special.pro testdata/tex.pro \
+ testdata/texc.pro testdata/texps.pro testdata/beginfontk1.dvi \
testdata/beginfontk1.eps testdata/beginfontk1.tex \
testdata/eepic-nan.dvi testdata/eepic-nan.tex \
testdata/pfbincl.eps testdata/pfbincl.tex testdata/pfbincl.xdv \
testdata/pfbincl.xps testdata/quotecmd.dvi \
testdata/quotecmd.tex testdata/dvipstst.tex \
- testdata/dvipstst.xdv testdata/dvipstst.xps NEWS TODO \
- testdata/intoverflow.dvi testdata/vfnameoverflow.dvi atari \
- cmfonts.map config.ps contrib/afm-extra contrib/colorsep.lpro \
- contrib/configs contrib/crop.lpr contrib/latex209 \
- contrib/treen.sh contrib/treen2.sh contrib/volker \
- contrib/whichinpath cyrfonts.map eufonts.map flib.c \
- hps/CHANGES_HPS.txt hps/README_HPS.txt lafonts.map makefont.c \
- mvs psfonts.map tex vmcms vms
+ testdata/dvipstst.xdv testdata/dvipstst.xps \
+ overflow-color-push.dvi overflow-color-push.tex \
+ overflow-epsfile.dvi overflow-epsfile.tex overflow-psbox.dvi \
+ overflow-psbox.tex NEWS TODO testdata/intoverflow.dvi \
+ testdata/vfnameoverflow.dvi atari cmfonts.map config.ps \
+ contrib/afm-extra contrib/colorsep.lpro contrib/configs \
+ contrib/crop.lpr contrib/latex209 contrib/treen.sh \
+ contrib/treen2.sh contrib/volker contrib/whichinpath \
+ cyrfonts.map eufonts.map flib.c hps/CHANGES_HPS.txt \
+ hps/README_HPS.txt lafonts.map makefont.c mvs psfonts.map tex \
+ vmcms vms
CLEANFILES = $(prologues) texc.lpro
TEST_EXTENSIONS = .pl .test
TESTS = afm2tfm-test.pl beginfontk1.test eepic-nan.test pfbincl.test \
- quotecmd-test.pl same-name.test test-dvips.test
+ quotecmd-test.pl same-name.test test-dvips.test \
+ test-overflow-buffers.test
AM_TESTS_ENVIRONMENT = TEXMFCNF=$(srcdir)/../kpathsea; export \
TEXMFCNF; TEXCONFIG=$(srcdir)/testdata; export TEXCONFIG; \
TEXFONTS=$(srcdir)/testdata; export TEXFONTS; \
@@ -1955,7 +1960,8 @@ squeeze/stamp-squeeze:
cd squeeze && $(MAKE) $(AM_MAKEFLAGS) stamp-squeeze
afm2tfm-test.log: afm2tfm$(EXEEXT)
beginfontk1.log eepic-nan.log pfbincl.log \
- quotecmd-test.log same-name.log test-dvips.log: dvips$(EXEEXT)
+ quotecmd-test.log same-name.log test-dvips.log \
+ test-overflow-buffers.log: dvips$(EXEEXT)
dist-hook:
cd "$(distdir)" && rm -rf $(NEVER_DIST)
diff --git a/Build/source/texk/dvipsk/color.c b/Build/source/texk/dvipsk/color.c
index f78d52630b3..3db791f528c 100644
--- a/Build/source/texk/dvipsk/color.c
+++ b/Build/source/texk/dvipsk/color.c
@@ -1,4 +1,4 @@
-/*
+/* $Id$
* This is a set of routines for dvips that are used to process color
* commands in the TeX file (passed by \special commands). This was
* orignally written by J. Hafner, E. Blanz and M. Flickner of IBM
@@ -27,6 +27,7 @@
#define COLORHASH (89)
#define MAXCOLORLEN (120) /* maximum color length for background */
#define INITCOLORLEN (10000) /* initial stack size in chars */
+#define OUTBUFSIZ (100) /* base limit on special length */
/*
* This is where we store the color information for a particular page.
* If we free all of these, we free all of the allocated color
@@ -51,7 +52,8 @@ static void
colorcmdout(char *s)
{
char *p;
- char tempword[100];
+ char tempword[OUTBUFSIZ];
+ integer templen;
while (*s && *s <= ' ')
s++;
@@ -66,7 +68,17 @@ colorcmdout(char *s)
return;
}
cmdout(p);
+
strcpy(tempword, "TeXcolor");
+ templen = strlen("TeXcolor") + strlen(s) + 2; /* 2 is slop, just in case */
+ if (templen >= OUTBUFSIZ) {
+ /* PostScript names get truncated to around 128 characters anyway,
+ so there's no reason to allow longer here. */
+ sprintf(errbuf, "! TeXcolor special name longer than %d characters",
+ OUTBUFSIZ);
+ error (errbuf);
+ }
+
for (p=tempword + strlen(tempword); *s && *s > ' '; p++, s++)
*p = *s;
*p = 0;
diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c
index fed4d811321..e44efae4502 100644
--- a/Build/source/texk/dvipsk/dospecial.c
+++ b/Build/source/texk/dvipsk/dospecial.c
@@ -1,4 +1,4 @@
-/*
+/* $Id$
* This routine handles special commands;
* predospecial() is for the prescan, dospecial() for the real thing.
*/
@@ -585,7 +585,9 @@ maccess(char *s)
const char *tasks[] = { 0, "iff2ps", "tek2ps" };
-static char psfile[511];
+#define PSFILESIZ 511
+static char psfile[PSFILESIZ];
+
void
dospecial(integer numbytes)
{
@@ -646,9 +648,20 @@ case 'e':
/* added for dvi2ps special */
if (strncmp(p, "epsfile=", 8)==0) { /* epsf.sty for dvi2ps-j */
float llx, lly, urx, ury;
+ unsigned psfilelen = 0;
p += 8;
- sscanf(p, "%s", psfile);
+ while (!isspace((unsigned char)*p)) {
+ if (psfilelen < PSFILESIZ) {
+ psfile[psfilelen] = *p;
+ psfilelen++;
+ } else {
+ sprintf(errbuf, "! epsfile= argument longer than %d characters",
+ PSFILESIZ);
+ error(errbuf);
+ }
+ }
+ psfile[psfilelen] = 0;
p += strlen(psfile);
fgetboundingbox(psfile, &llx, &lly, &urx, &ury);
hvpos();
@@ -752,6 +765,16 @@ case 'p':
if (strncmp(p, "postscriptbox", 13)==0) { /* epsbox.sty for jdvi2kps */
float w, h;
float llx, lly, urx, ury;
+ if (strlen(p)-13-6 >= PSFILESIZ) { /* -6 for the braces */
+ /* We're not allowing as long a name as we could, since however
+ many characters the two {%fpt} arguments consume is not
+ taken into account. But parsing it all so we know the
+ character length is too much work for this obscure special. */
+ sprintf(errbuf,
+ "! postscriptbox{} arguments longer than %d characters",
+ PSFILESIZ);
+ error(errbuf);
+ }
if (sscanf(p+13, "{%fpt}{%fpt}{%[^}]}", &w, &h, psfile) != 3)
break;
fgetboundingbox(psfile, &llx, &lly, &urx, &ury);
diff --git a/Build/source/texk/dvipsk/test-overflow-buffers.test b/Build/source/texk/dvipsk/test-overflow-buffers.test
new file mode 100755
index 00000000000..d95a71e7a3d
--- /dev/null
+++ b/Build/source/texk/dvipsk/test-overflow-buffers.test
@@ -0,0 +1,14 @@
+#! /bin/sh -vx
+# $Id$
+# Public domain. Various buffer overflows, reported by
+# Andy Nguyen of ETH Zurich. The program should detect and abort.
+
+for tst in overflow-color-push overflow-epsfile overflow-psbox; do
+ :
+ if ./dvips $srcdir/testdata/$tst.dvi -o; then
+ echo "$0: test $tst should have failed." >&2
+ exit 1
+ fi
+done
+
+exit 1
diff --git a/Build/source/texk/dvipsk/testdata/color.pro b/Build/source/texk/dvipsk/testdata/color.pro
new file mode 100644
index 00000000000..bf704cc3d08
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/color.pro
@@ -0,0 +1,46 @@
+%!
+TeXDict begin/setcmykcolor where{pop}{/setcmykcolor{dup 10 eq{pop
+setrgbcolor}{1 sub 4 1 roll 3{3 index add neg dup 0 lt{pop 0}if 3 1 roll
+}repeat setrgbcolor pop}ifelse}B}ifelse/TeXcolorcmyk{setcmykcolor}def
+/TeXcolorrgb{setrgbcolor}def/TeXcolorgrey{setgray}def/TeXcolorgray{
+setgray}def/TeXcolorhsb{sethsbcolor}def/currentcmykcolor where{pop}{
+/currentcmykcolor{currentrgbcolor 10}B}ifelse/DC{exch dup userdict exch
+known{pop pop}{X}ifelse}B/GreenYellow{0.15 0 0.69 0 setcmykcolor}DC
+/Yellow{0 0 1 0 setcmykcolor}DC/Goldenrod{0 0.10 0.84 0 setcmykcolor}DC
+/Dandelion{0 0.29 0.84 0 setcmykcolor}DC/Apricot{0 0.32 0.52 0
+setcmykcolor}DC/Peach{0 0.50 0.70 0 setcmykcolor}DC/Melon{0 0.46 0.50 0
+setcmykcolor}DC/YellowOrange{0 0.42 1 0 setcmykcolor}DC/Orange{0 0.61
+0.87 0 setcmykcolor}DC/BurntOrange{0 0.51 1 0 setcmykcolor}DC
+/Bittersweet{0 0.75 1 0.24 setcmykcolor}DC/RedOrange{0 0.77 0.87 0
+setcmykcolor}DC/Mahogany{0 0.85 0.87 0.35 setcmykcolor}DC/Maroon{0 0.87
+0.68 0.32 setcmykcolor}DC/BrickRed{0 0.89 0.94 0.28 setcmykcolor}DC/Red{
+0 1 1 0 setcmykcolor}DC/OrangeRed{0 1 0.50 0 setcmykcolor}DC/RubineRed{
+0 1 0.13 0 setcmykcolor}DC/WildStrawberry{0 0.96 0.39 0 setcmykcolor}DC
+/Salmon{0 0.53 0.38 0 setcmykcolor}DC/CarnationPink{0 0.63 0 0
+setcmykcolor}DC/Magenta{0 1 0 0 setcmykcolor}DC/VioletRed{0 0.81 0 0
+setcmykcolor}DC/Rhodamine{0 0.82 0 0 setcmykcolor}DC/Mulberry{0.34 0.90
+0 0.02 setcmykcolor}DC/RedViolet{0.07 0.90 0 0.34 setcmykcolor}DC
+/Fuchsia{0.47 0.91 0 0.08 setcmykcolor}DC/Lavender{0 0.48 0 0
+setcmykcolor}DC/Thistle{0.12 0.59 0 0 setcmykcolor}DC/Orchid{0.32 0.64 0
+0 setcmykcolor}DC/DarkOrchid{0.40 0.80 0.20 0 setcmykcolor}DC/Purple{
+0.45 0.86 0 0 setcmykcolor}DC/Plum{0.50 1 0 0 setcmykcolor}DC/Violet{
+0.79 0.88 0 0 setcmykcolor}DC/RoyalPurple{0.75 0.90 0 0 setcmykcolor}DC
+/BlueViolet{0.86 0.91 0 0.04 setcmykcolor}DC/Periwinkle{0.57 0.55 0 0
+setcmykcolor}DC/CadetBlue{0.62 0.57 0.23 0 setcmykcolor}DC
+/CornflowerBlue{0.65 0.13 0 0 setcmykcolor}DC/MidnightBlue{0.98 0.13 0
+0.43 setcmykcolor}DC/NavyBlue{0.94 0.54 0 0 setcmykcolor}DC/RoyalBlue{1
+0.50 0 0 setcmykcolor}DC/Blue{1 1 0 0 setcmykcolor}DC/Cerulean{0.94 0.11
+0 0 setcmykcolor}DC/Cyan{1 0 0 0 setcmykcolor}DC/ProcessBlue{0.96 0 0 0
+setcmykcolor}DC/SkyBlue{0.62 0 0.12 0 setcmykcolor}DC/Turquoise{0.85 0
+0.20 0 setcmykcolor}DC/TealBlue{0.86 0 0.34 0.02 setcmykcolor}DC
+/Aquamarine{0.82 0 0.30 0 setcmykcolor}DC/BlueGreen{0.85 0 0.33 0
+setcmykcolor}DC/Emerald{1 0 0.50 0 setcmykcolor}DC/JungleGreen{0.99 0
+0.52 0 setcmykcolor}DC/SeaGreen{0.69 0 0.50 0 setcmykcolor}DC/Green{1 0
+1 0 setcmykcolor}DC/ForestGreen{0.91 0 0.88 0.12 setcmykcolor}DC
+/PineGreen{0.92 0 0.59 0.25 setcmykcolor}DC/LimeGreen{0.50 0 1 0
+setcmykcolor}DC/YellowGreen{0.44 0 0.74 0 setcmykcolor}DC/SpringGreen{
+0.26 0 0.76 0 setcmykcolor}DC/OliveGreen{0.64 0 0.95 0.40 setcmykcolor}
+DC/RawSienna{0 0.72 1 0.45 setcmykcolor}DC/Sepia{0 0.83 1 0.70
+setcmykcolor}DC/Brown{0 0.81 1 0.60 setcmykcolor}DC/Tan{0.14 0.42 0.56 0
+setcmykcolor}DC/Gray{0 0 0 0.50 setcmykcolor}DC/Black{0 0 0 1
+setcmykcolor}DC/White{0 0 0 0 setcmykcolor}DC end
diff --git a/Build/source/texk/dvipsk/testdata/overflow-color-push.dvi b/Build/source/texk/dvipsk/testdata/overflow-color-push.dvi
new file mode 100644
index 00000000000..02e40625376
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-color-push.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-color-push.tex b/Build/source/texk/dvipsk/testdata/overflow-color-push.tex
new file mode 100644
index 00000000000..6a68e925cc6
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-color-push.tex
@@ -0,0 +1,17 @@
+% Andy Nguyen of ETH Zurich. Public domain.
+% tlsecurity mail of 28 Mar 2019 18:20:48.
+% File "dvipsk/color.c", subroutine "colorcmdout": "s" is copied to
+% "tempword" without length validation.
+
+\documentclass{article}
+
+\begin{document}
+\thispagestyle{empty}
+
+\begin{figure}[p]
+
+\special{color push aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa a}
+
+\end{figure}
+
+\end{document}
diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
new file mode 100644
index 00000000000..b2b3a44f3f4
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.tex b/Build/source/texk/dvipsk/testdata/overflow-epsfile.tex
new file mode 100644
index 00000000000..5ae2cd13d63
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-epsfile.tex
@@ -0,0 +1,17 @@
+% Andy Nguyen of ETH Zurich. Public domain.
+% tlsecurity mail of 28 Mar 2019 18:20:48.
+% File "dvipsk/dospecial.c", subroutine "dospecial": "epsfile" is parsed
+% using "sscanf(p, "%s", psfile);", which has no length limitation.
+
+\documentclass{article}
+
+\begin{document}
+
+\begin{figure}[p]
+\thispagestyle{empty}
+
+\special{epsfile=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
+
+\end{figure}
+
+\end{document}
diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
new file mode 100644
index 00000000000..f890d469006
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
new file mode 100644
index 00000000000..a0431a70168
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
@@ -0,0 +1,18 @@
+% Andy Nguyen of ETH Zurich. Public domain.
+% tlsecurity mail of 28 Mar 2019 18:20:48.
+% File "dvipsk/dospecial.c", subroutine "dospecial": "psfile" is parsed using
+% "sscanf(p+13, "{%fpt}{%fpt}{%[^}]}", &w, &h, psfile)", which has no length
+% limitation.
+
+\documentclass{article}
+
+\begin{document}
+\thispagestyle{empty}
+
+\begin{figure}[p]
+
+\special{postscriptbox{}{}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}}
+
+\end{figure}
+
+\end{document}