summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAkira Kakuto <kakuto@fuk.kindai.ac.jp>2019-05-08 12:30:06 +0000
committerAkira Kakuto <kakuto@fuk.kindai.ac.jp>2019-05-08 12:30:06 +0000
commit3cfdebe40a36bf7ad07f2a5a943996ade1f53a9d (patch)
tree20e67bcd82a7045b0cec092f32b473a82cbd6e32
parent6efb4cbbb31c8789b8404b43d98f5ffb3f133af6 (diff)
avoid buffer overflow
git-svn-id: svn://tug.org/texlive/trunk@51045 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/dvipdfm-x/ChangeLog4
-rw-r--r--Build/source/texk/dvipdfm-x/dpxfile.c27
2 files changed, 28 insertions, 3 deletions
diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog
index c7a72489024..d904fa943c5 100644
--- a/Build/source/texk/dvipdfm-x/ChangeLog
+++ b/Build/source/texk/dvipdfm-x/ChangeLog
@@ -1,3 +1,7 @@
+2019-05-08 Akira Kakuto <kakuto@w32tex.org>
+
+ * dpxfile.c: Avoid buffer overflow.
+
2019-05-08 Shunsaku Hirata <shunsaku.hirata74@gmail.com>
* spc_pdfm.c: Transformation also applies to annotations
diff --git a/Build/source/texk/dvipdfm-x/dpxfile.c b/Build/source/texk/dvipdfm-x/dpxfile.c
index d0afe8dcdfa..6a596d555f5 100644
--- a/Build/source/texk/dvipdfm-x/dpxfile.c
+++ b/Build/source/texk/dvipdfm-x/dpxfile.c
@@ -163,11 +163,13 @@ static char _tmpbuf[PATH_MAX+1];
extern int utf8name_failed;
#endif /* WIN32 */
+#define CMDBUFSIZ 1024
static int exec_spawn (char *cmd)
{
char **cmdv, **qv;
char *p, *pp;
- char buf[1024];
+ char buf[CMDBUFSIZ];
+ int charcnt;
int i, ret = -1;
#ifdef WIN32
wchar_t **cmdvw, **qvw;
@@ -186,11 +188,12 @@ static int exec_spawn (char *cmd)
i++;
p++;
}
- cmdv = xcalloc (i + 2, sizeof (char *));
+ cmdv = xcalloc (i + 4, sizeof (char *));
p = cmd;
qv = cmdv;
while (*p) {
pp = buf;
+ charcnt = 0;
if (*p == '"') {
p++;
while (*p != '"') {
@@ -198,6 +201,10 @@ static int exec_spawn (char *cmd)
goto done;
}
*pp++ = *p++;
+ charcnt++;
+ if (charcnt > CMDBUFSIZ - 1) {
+ ERROR("Too long a command line.");
+ }
}
p++;
} else if (*p == '\'') {
@@ -207,6 +214,10 @@ static int exec_spawn (char *cmd)
goto done;
}
*pp++ = *p++;
+ charcnt++;
+ if (charcnt > CMDBUFSIZ - 1) {
+ ERROR("Too long a command line.");
+ }
}
p++;
} else {
@@ -218,10 +229,18 @@ static int exec_spawn (char *cmd)
goto done;
}
*pp++ = *p++;
+ charcnt++;
+ if (charcnt > CMDBUFSIZ - 1) {
+ ERROR("Too long a command line.");
+ }
}
p++;
} else {
*pp++ = *p++;
+ charcnt++;
+ if (charcnt > CMDBUFSIZ - 1) {
+ ERROR("Too long a command line.");
+ }
}
}
}
@@ -239,11 +258,13 @@ static int exec_spawn (char *cmd)
p++;
qv++;
}
+ *qv = NULL;
+
#ifdef WIN32
#if defined(MIKTEX)
ret = _spawnvp(_P_WAIT, *cmdv, (const char* const*)cmdv);
#else
- cmdvw = xcalloc (i + 2, sizeof (wchar_t *));
+ cmdvw = xcalloc (i + 4, sizeof (wchar_t *));
if (utf8name_failed == 0) {
qv = cmdv;
qvw = cmdvw;