diff options
author | Karl Berry <karl@freefriends.org> | 2023-11-15 21:23:49 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2023-11-15 21:23:49 +0000 |
commit | dba6307833213535a281fc9f5e2aa12d5d36e56e (patch) | |
tree | 290f7465b5903bdf135b98b52ce18900a8cb6a14 | |
parent | 7d2b63ca0feb2c0a5989f889fb9c15e76a5a6d06 (diff) |
check for more corruption in fmt/base
git-svn-id: svn://tug.org/texlive/trunk@68865 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r-- | Build/source/texk/web2c/ChangeLog | 8 | ||||
-rw-r--r-- | Build/source/texk/web2c/mf.ch | 9 | ||||
-rw-r--r-- | Build/source/texk/web2c/tex.ch | 9 |
3 files changed, 26 insertions, 0 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog index 19286859359..4bc6d326a1e 100644 --- a/Build/source/texk/web2c/ChangeLog +++ b/Build/source/texk/web2c/ChangeLog @@ -1,3 +1,11 @@ +2023-11-15 Karl Berry <karl@freefriends.org> + + * tex.ch, + * mf.ch (Undump the dynamic memory): check that p does not + become too small, due to fmt/base corruption. + Report from Gregory James DUCK to Karl, 14 Sep 2023. + Found with a fuzz tester similar to AFL-fuzz. + 2023-10-25 Andreas Scherer <https://ascherer.github.io> * weave.ch: Fine print for command-line options. diff --git a/Build/source/texk/web2c/mf.ch b/Build/source/texk/web2c/mf.ch index 1f34a479aff..4b13cacb441 100644 --- a/Build/source/texk/web2c/mf.ch +++ b/Build/source/texk/web2c/mf.ch @@ -1853,6 +1853,15 @@ if mem_min+1100>mem_top then goto off_base; mem:=xmalloc_array (memory_word, mem_max - mem_min + 1); @z +@x [48.1195] l.22714 - Check that p did not become corrupt. +if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base; +@y +{If the base file is messed up, that addition to |p| might cause it to + become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023. + Found with a fuzz tester similar to AFL-fuzz. Also changed in \TeX.} +if (p<mem_min)or(p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base; +@z + @x [48.1199] l.22750 - Allow command line to override dumped value. undump(batch_mode)(error_stop_mode)(interaction); @y diff --git a/Build/source/texk/web2c/tex.ch b/Build/source/texk/web2c/tex.ch index 60c4f8f1aaa..51307bf7c7b 100644 --- a/Build/source/texk/web2c/tex.ch +++ b/Build/source/texk/web2c/tex.ch @@ -3653,6 +3653,15 @@ repeat for k:=p to q+1 do undump_wd(mem[k]); repeat undump_things(mem[p], q+2-p); @z +@x [50.1312] l.23955 - Check that p did not become corrupt. +if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt; +@y +{If the format file is messed up, that addition to |p| might cause it to + become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023. + Found with a fuzz tester similar to AFL-fuzz. Also changed in \MF.} +if (p<mem_min)or(p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt; +@z + @x [50.1312] l.23878 - Make dumping/undumping more efficient. for k:=p to lo_mem_max do undump_wd(mem[k]); @y |