summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAkira Kakuto <kakuto@fuk.kindai.ac.jp>2016-03-24 05:37:10 +0000
committerAkira Kakuto <kakuto@fuk.kindai.ac.jp>2016-03-24 05:37:10 +0000
commit311869640590373b97552dd2570111528ae4ba15 (patch)
treebf714ce01b162855526e5e0210a0ec04b67c1fbf
parent64fadf4c456815e97ceafa779f14270f6530db86 (diff)
dvipsk/writet1.c, pdftexdir/writet1.c: Fix 1-byte buffer overflow bug
git-svn-id: svn://tug.org/texlive/trunk@40113 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipsk/ChangeLog5
-rw-r--r--Build/source/texk/dvipsk/writet1.c6
-rw-r--r--Build/source/texk/web2c/pdftexdir/ChangeLog5
-rw-r--r--Build/source/texk/web2c/pdftexdir/writet1.c6
4 files changed, 16 insertions, 6 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index cde2f492927..3d06bf0435c 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,8 @@
+2016-03-24 Akira Kakuto <kakuto@fuk.kindai.ac.jp>
+
+ * writet1.c: Fix one-byte buffer overflow bug reported by Hanno Boeck:
+ http://tug.org/pipermail/tex-live/2016-January/037686.html.
+
2016-02-01 Karl Berry <karl@tug.org>
* dvips.1,
diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c
index 460c477c5f5..0fcf269070b 100644
--- a/Build/source/texk/dvipsk/writet1.c
+++ b/Build/source/texk/dvipsk/writet1.c
@@ -699,8 +699,8 @@ static char **t1_builtin_enc(void)
for (i = 0; i < 256; i++)
glyph_names[i] = notdef;
if (t1_suffix("def")) { /* predefined encoding */
- sscanf(t1_line_array + strlen("/Encoding"), "%256s", t1_buf_array);
- if (strcmp(t1_buf_array, "StandardEncoding") == 0) {
+ if (sscanf(t1_line_array + strlen("/Encoding"), "%255s", t1_buf_array) == 1
+ && strcmp(t1_buf_array, "StandardEncoding") == 0) {
t1_encoding = ENC_STANDARD;
for (i = 0; i < 256; i++) {
if (standard_glyph_names[i] != notdef)
@@ -765,7 +765,7 @@ static char **t1_builtin_enc(void)
/*
check for `dup <index> <glyph> put'
*/
- if (sscanf(p, "dup %i%256s put", &i, t1_buf_array) == 2 &&
+ if (sscanf(p, "dup %i%255s put", &i, t1_buf_array) == 2 &&
*t1_buf_array == '/' && valid_code(i)) {
if (strcmp(t1_buf_array + 1, notdef) != 0)
glyph_names[i] = xstrdup(t1_buf_array + 1);
diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog
index 6f703efbcab..5c3a40c0337 100644
--- a/Build/source/texk/web2c/pdftexdir/ChangeLog
+++ b/Build/source/texk/web2c/pdftexdir/ChangeLog
@@ -1,3 +1,8 @@
+2016-03-24 Akira Kakuto <kakuto@fuk.kindai.ac.jp>
+
+ * writet1.c: Fix one-byte buffer overflow bug reported by Hanno Boeck:
+ http://tug.org/pipermail/tex-live/2016-January/037686.html.
+
2016-03-21 Karl Berry <karl@tug.org>
* NEWS,
diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c
index 363853bf38a..d191b77ee5f 100644
--- a/Build/source/texk/web2c/pdftexdir/writet1.c
+++ b/Build/source/texk/web2c/pdftexdir/writet1.c
@@ -771,8 +771,8 @@ static char **t1_builtin_enc(void)
for (i = 0; i < 256; i++)
glyph_names[i] = notdef;
if (t1_suffix("def")) { /* predefined encoding */
- sscanf(t1_line_array + strlen("/Encoding"), "%256s", t1_buf_array);
- if (strcmp(t1_buf_array, "StandardEncoding") == 0) {
+ if (sscanf(t1_line_array + strlen("/Encoding"), "%255s", t1_buf_array) == 1
+ && strcmp(t1_buf_array, "StandardEncoding") == 0) {
t1_encoding = ENC_STANDARD;
for (i = 0; i < 256; i++) {
if (standard_glyph_names[i] != notdef)
@@ -837,7 +837,7 @@ static char **t1_builtin_enc(void)
/*
check for `dup <index> <glyph> put'
*/
- if (sscanf(p, "dup %i%256s put", &i, t1_buf_array) == 2 &&
+ if (sscanf(p, "dup %i%255s put", &i, t1_buf_array) == 2 &&
*t1_buf_array == '/' && valid_code(i)) {
if (strcmp(t1_buf_array + 1, notdef) != 0)
glyph_names[i] = xstrdup(t1_buf_array + 1);