summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-04-05 14:13:24 +0000
committerKarl Berry <karl@freefriends.org>2019-04-05 14:13:24 +0000
commitf18e0204ee35c67b4999e527e6e1db2328a6776c (patch)
treea89d7cefb30ace9a011b20383fe66dc1a7a7a473
parent78478500ddb64ead8d877dbec869333252c86b30 (diff)
pk parsing check, again from Andy Nguyen of ETH Zurich
git-svn-id: svn://tug.org/texlive/trunk@50775 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipng/dvipng-src/ChangeLog5
-rw-r--r--Build/source/texk/dvipng/dvipng-src/pk.c9
2 files changed, 14 insertions, 0 deletions
diff --git a/Build/source/texk/dvipng/dvipng-src/ChangeLog b/Build/source/texk/dvipng/dvipng-src/ChangeLog
index 55954f623ed..c0bce84764f 100644
--- a/Build/source/texk/dvipng/dvipng-src/ChangeLog
+++ b/Build/source/texk/dvipng/dvipng-src/ChangeLog
@@ -1,3 +1,8 @@
+2019-04-05 Karl Berry <karl@freefriends.org>
+
+ * pk.c (InitPK): check for packet_length reading outside file bounds.
+ Report from Andy Nguyen of ETH Zurich.
+
2019-04-04 Karl Berry <karl@freefriends.org>
* tfm.c (ReadTFM): check for reading outside file bounds.
diff --git a/Build/source/texk/dvipng/dvipng-src/pk.c b/Build/source/texk/dvipng/dvipng-src/pk.c
index e814513c7e4..37be10fe32b 100644
--- a/Build/source/texk/dvipng/dvipng-src/pk.c
+++ b/Build/source/texk/dvipng/dvipng-src/pk.c
@@ -354,15 +354,24 @@ void InitPK(struct font_entry * tfontp)
tcharptr->data = NULL;
tcharptr->tfmw = 0;
if ((*position & 7) == 7) {
+ if (tfontp->fmmap.size < (char *)position-tfontp->fmmap.data + 9) {
+ Fatal("file too short (%u) for 9-byte packet_length",tfontp->fmmap.size);
+ }
packet_length = UNumRead(position+1,4);
c = UNumRead(position+5, 4);
position += 9;
} else if (*position & 4) {
+ if (tfontp->fmmap.size < (char *)position-tfontp->fmmap.data + 4) {
+ Fatal("file too short (%u) for 4-byte packet_length",tfontp->fmmap.size);
+ }
packet_length = (*position & 3) * 65536l +
UNumRead(position+1, 2);
c = UNumRead(position+3, 1);
position += 4;
} else {
+ if (tfontp->fmmap.size < (char *)position-tfontp->fmmap.data + 3) {
+ Fatal("file too short (%u) for 3-byte packet_length",tfontp->fmmap.size);
+ }
packet_length = (*position & 3) * 256 +
UNumRead(position+1, 1);
c = UNumRead(position+2, 1);