summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAkira Kakuto <kakuto@fuk.kindai.ac.jp>2019-03-29 22:13:05 +0000
committerAkira Kakuto <kakuto@fuk.kindai.ac.jp>2019-03-29 22:13:05 +0000
commitd22ffd7a19d10bea6d6a6ee371c17cd8387a202f (patch)
tree36fd5d7dde1cc47957ca0d3faf5e0aea4868d3af
parent7c46aa4892ef00d7ea3c61c546e785186c1d3565 (diff)
fix security problem reported by Andy Nguyen
git-svn-id: svn://tug.org/texlive/trunk@50645 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipdfm-x/ChangeLog11
-rw-r--r--Build/source/texk/dvipdfm-x/spc_pdfm.c11
-rw-r--r--Build/source/texk/dvipdfm-x/spc_xtx.c13
-rw-r--r--Build/source/texk/dvipdfm-x/specials.c7
4 files changed, 34 insertions, 8 deletions
diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog
index 5bbc511cf52..709472bedae 100644
--- a/Build/source/texk/dvipdfm-x/ChangeLog
+++ b/Build/source/texk/dvipdfm-x/ChangeLog
@@ -1,3 +1,14 @@
+2019-03-30 Akira Kakuto <kakuto@w32tex.org>
+
+ * spc_xtx.c: "ap->curptr" was copied to "buffer" without
+ length validation. Fix this security problem.
+ * spc_pdfm.c: "ap->curptr" was copied to "buffer" without
+ length validation. Fix this security problem.
+ * specials.c: Error message was written using vsprintf(),
+ which has no length limitation. Use vsnprintf() instead.
+
+ Report from Andy Nguyen of ETH Zurich.
+
2019-03-05 Clerk Ma <maqiyuan130324@vip.qq.com>
* tt_table.c: Fix 'null character(s)' warning caused by
diff --git a/Build/source/texk/dvipdfm-x/spc_pdfm.c b/Build/source/texk/dvipdfm-x/spc_pdfm.c
index 71386613a50..a5e8d10b928 100644
--- a/Build/source/texk/dvipdfm-x/spc_pdfm.c
+++ b/Build/source/texk/dvipdfm-x/spc_pdfm.c
@@ -1764,15 +1764,17 @@ spc_handler_pdfm_bgcolor (struct spc_env *spe, struct spc_arg *args)
return error;
}
+#define THEBUFFLENGTH 1024
static int
spc_handler_pdfm_mapline (struct spc_env *spe, struct spc_arg *ap)
{
fontmap_rec *mrec;
char *map_name, opchr;
int error = 0;
- static char buffer[1024];
+ static char buffer[THEBUFFLENGTH];
const char *p;
char *q;
+ int count;
skip_white(&ap->curptr, ap->endptr);
if (ap->curptr >= ap->endptr) {
@@ -1800,8 +1802,13 @@ spc_handler_pdfm_mapline (struct spc_env *spe, struct spc_arg *ap)
default:
p = ap->curptr;
q = buffer;
- while (p < ap->endptr)
+ count = 0;
+ while (p < ap->endptr && count < THEBUFFLENGTH - 1) {
*q++ = *p++;
+ count++;
+ }
+ if (count == THEBUFFLENGTH - 1)
+ spc_warn(spe, "Too long a fontmap line.");
*q = '\0';
mrec = NEW(1, fontmap_rec);
pdf_init_fontmap_record(mrec);
diff --git a/Build/source/texk/dvipdfm-x/spc_xtx.c b/Build/source/texk/dvipdfm-x/spc_xtx.c
index e66889ef81b..33d43d60743 100644
--- a/Build/source/texk/dvipdfm-x/spc_xtx.c
+++ b/Build/source/texk/dvipdfm-x/spc_xtx.c
@@ -1,7 +1,7 @@
/* This is xdvipdfmx, an extended version of dvipdfmx,
an eXtended version of dvipdfm by Mark A. Wicks.
- Copyright (C) 2013-2016 by the dvipdfmx project team.
+ Copyright (C) 2013-2019 by the dvipdfmx project team.
Copyright (c) 2006 SIL International
Originally written by Jonathan Kew
@@ -195,15 +195,17 @@ spc_handler_xtx_backgroundcolor (struct spc_env *spe, struct spc_arg *args)
}
/* FIXME: xdv2pdf's x:fontmapline and x:fontmapfile may have slightly different syntax/semantics */
+#define THEBUFFLENGTH 1024
static int
spc_handler_xtx_fontmapline (struct spc_env *spe, struct spc_arg *ap)
{
fontmap_rec *mrec;
char *map_name, opchr;
int error = 0;
- static char buffer[1024];
+ static char buffer[THEBUFFLENGTH];
const char *p;
char *q;
+ int count;
skip_white(&ap->curptr, ap->endptr);
if (ap->curptr >= ap->endptr) {
@@ -231,8 +233,13 @@ spc_handler_xtx_fontmapline (struct spc_env *spe, struct spc_arg *ap)
default:
p = ap->curptr;
q = buffer;
- while (p < ap->endptr)
+ count = 0;
+ while (p < ap->endptr && count < THEBUFFLENGTH - 1) {
*q++ = *p++;
+ count++;
+ }
+ if (count == THEBUFFLENGTH - 1)
+ spc_warn(spe, "Too long a fontmap line.");
*q = '\0';
mrec = NEW(1, fontmap_rec);
pdf_init_fontmap_record(mrec);
diff --git a/Build/source/texk/dvipdfm-x/specials.c b/Build/source/texk/dvipdfm-x/specials.c
index 9d396ac5aeb..794938f57fd 100644
--- a/Build/source/texk/dvipdfm-x/specials.c
+++ b/Build/source/texk/dvipdfm-x/specials.c
@@ -1,6 +1,6 @@
/* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks.
- Copyright (C) 2002-2018 by Jin-Hwan Cho and Shunsaku Hirata,
+ Copyright (C) 2002-2019 by Jin-Hwan Cho and Shunsaku Hirata,
the dvipdfmx project team.
Copyright (C) 1998, 1999 by Mark A. Wicks <mwicks@kettering.edu>
@@ -53,15 +53,16 @@
#include "specials.h"
+#define THEBUFFLENGTH 1024
void
spc_warn (struct spc_env *spe, const char *fmt, ...)
{
va_list ap;
- static char buf[1024];
+ static char buf[THEBUFFLENGTH];
va_start(ap, fmt);
- vsprintf(buf, fmt, ap);
+ vsnprintf(buf, THEBUFFLENGTH, fmt, ap);
WARN(buf);
va_end(ap);