summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2023-11-15 21:23:49 +0000
committerKarl Berry <karl@freefriends.org>2023-11-15 21:23:49 +0000
commitdba6307833213535a281fc9f5e2aa12d5d36e56e (patch)
tree290f7465b5903bdf135b98b52ce18900a8cb6a14
parent7d2b63ca0feb2c0a5989f889fb9c15e76a5a6d06 (diff)
check for more corruption in fmt/base
git-svn-id: svn://tug.org/texlive/trunk@68865 c570f23f-e606-0410-a88d-b1316a301751
-rw-r--r--Build/source/texk/web2c/ChangeLog8
-rw-r--r--Build/source/texk/web2c/mf.ch9
-rw-r--r--Build/source/texk/web2c/tex.ch9
3 files changed, 26 insertions, 0 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index 19286859359..4bc6d326a1e 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -1,3 +1,11 @@
+2023-11-15 Karl Berry <karl@freefriends.org>
+
+ * tex.ch,
+ * mf.ch (Undump the dynamic memory): check that p does not
+ become too small, due to fmt/base corruption.
+ Report from Gregory James DUCK to Karl, 14 Sep 2023.
+ Found with a fuzz tester similar to AFL-fuzz.
+
2023-10-25 Andreas Scherer <https://ascherer.github.io>
* weave.ch: Fine print for command-line options.
diff --git a/Build/source/texk/web2c/mf.ch b/Build/source/texk/web2c/mf.ch
index 1f34a479aff..4b13cacb441 100644
--- a/Build/source/texk/web2c/mf.ch
+++ b/Build/source/texk/web2c/mf.ch
@@ -1853,6 +1853,15 @@ if mem_min+1100>mem_top then goto off_base;
mem:=xmalloc_array (memory_word, mem_max - mem_min + 1);
@z
+@x [48.1195] l.22714 - Check that p did not become corrupt.
+if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base;
+@y
+{If the base file is messed up, that addition to |p| might cause it to
+ become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023.
+ Found with a fuzz tester similar to AFL-fuzz. Also changed in \TeX.}
+if (p<mem_min)or(p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base;
+@z
+
@x [48.1199] l.22750 - Allow command line to override dumped value.
undump(batch_mode)(error_stop_mode)(interaction);
@y
diff --git a/Build/source/texk/web2c/tex.ch b/Build/source/texk/web2c/tex.ch
index 60c4f8f1aaa..51307bf7c7b 100644
--- a/Build/source/texk/web2c/tex.ch
+++ b/Build/source/texk/web2c/tex.ch
@@ -3653,6 +3653,15 @@ repeat for k:=p to q+1 do undump_wd(mem[k]);
repeat undump_things(mem[p], q+2-p);
@z
+@x [50.1312] l.23955 - Check that p did not become corrupt.
+if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt;
+@y
+{If the format file is messed up, that addition to |p| might cause it to
+ become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023.
+ Found with a fuzz tester similar to AFL-fuzz. Also changed in \MF.}
+if (p<mem_min)or(p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt;
+@z
+
@x [50.1312] l.23878 - Make dumping/undumping more efficient.
for k:=p to lo_mem_max do undump_wd(mem[k]);
@y