Fix more buffer overflows: Ghostscript command construction, read

from files into static arrays.


git-svn-id: svn://tug.org/texlive/trunk@4524 c570f23f-e606-0410-a88d-b1316a301751

3 files changed, 26 insertions, 11 deletions

diff --git a/Build/source/texk/dviljk/ChangeLog b/Build/source/texk/dviljk/ChangeLog
index 08754485510..c51e85e9d6f 100644
--- a/Build/source/texk/dviljk/ChangeLog
+++ b/Build/source/texk/dviljk/ChangeLog
@@ -7,11 +7,17 @@
 	operations. Fixed also manual string copy operations on special
 	strings. Fixed array buffer overflow in defpoint and fill special
 	operations.
+	(DoSpecial): Call of ghostscript for psfile special had also a
+	potential buffer overflow caused by unchecked usage of sprintf.
 
 	Bumped version number up to 2.6p3.
 
 	* dvi2xx.h: Some fixed sized string arrays are pointers now, they
 	get dynamically allocated.
+	(GetBytes): Another buffer overflow: Check that the buffer size is
+	sufficient to store the read bytes. That relies on the invariant
+	that the GetBytes macro is always called with an array as argument
+	and not with a pointer.
 
 	* config.h: Throw an error if kpathsea is not used. dvi2xx.c
 	had previously already kpathsea dependencies without protecting
diff --git a/Build/source/texk/dviljk/dvi2xx.c b/Build/source/texk/dviljk/dvi2xx.c
index ac90edd7f5e..6c6459df911 100644
--- a/Build/source/texk/dviljk/dvi2xx.c
+++ b/Build/source/texk/dviljk/dvi2xx.c
@@ -3911,9 +3911,6 @@ int  n;
   static  bool  GrayFill = _TRUE;
   static  long4 p_x[MAX_SPECIAL_DEFPOINTS], p_y[MAX_SPECIAL_DEFPOINTS];
   int llx=0, lly=0, urx=0, ury=0, rwi=0, rhi=0;
-#ifdef WIN32
-  char    *gs_path;
-#endif
 
   str[n] = '\0';
   for ( i=0 ; i<MAX_SPECIAL_DEFPOINTS ; i++ )
@@ -4138,6 +4135,8 @@ int  n;
         int width  = urx - llx;
         int height = ury - lly;
         char cmd[255];
+	char *cmd_format = "%s -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit";
+	char *gs_cmd;
         int scale_factor    = 3000 * width / rwi;
         int adjusted_height = height * 300/scale_factor;
         int adjusted_llx    = llx    * 300/scale_factor;
@@ -4159,15 +4158,18 @@ int  n;
         BCLOSE( scalef );
 
 #ifdef WIN32
-	gs_path = getenv("GS_PATH");
-	if (!gs_path)
-	  gs_path = "gswin32c.exe";
-        sprintf(cmd,"%s -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit",
-		gs_path, printer, pcl_file, scale_file, psfile);
+	gs_cmd = ( getenv("GS_PATH") || "gswin32c.exe" );
 #else
-        sprintf(cmd,"gs -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit",
-                printer, pcl_file, scale_file, psfile);
+	gs_cmd = "gs";
 #endif
+	if ( strlen(cmd_format)-10 + strlen(gs_cmd) + strlen(printer) +
+	         strlen(pcl_file) + strlen(scale_file) + strlen(psfile) +1 >
+	     sizeof(cmd) ) {
+	  Warning ("Ghostscript command for %s would be too long, skipping special", psfile);
+	  return;
+	}
+        sprintf(cmd, cmd_format,
+		gs_cmd, printer, pcl_file, scale_file, psfile);
 #ifdef DEBUGGS
         fprintf(stderr,
           "PS-file '%s' w=%d, h=%d, urx=%d, ury=%d, llx=%d, lly=%d, rwi=%d\n",
diff --git a/Build/source/texk/dviljk/dvi2xx.h b/Build/source/texk/dviljk/dvi2xx.h
index 47fc31b36f4..15d37a59efa 100644
--- a/Build/source/texk/dviljk/dvi2xx.h
+++ b/Build/source/texk/dviljk/dvi2xx.h
@@ -282,7 +282,14 @@ char *MFMODE     = MFMODE600;
 #define VisChar(c) (unsigned char)(c)
 #endif
 
-#define GetBytes(fp,buf,n) read_multi(buf,1,n,fp) /* used to be a function */
+/* Used to be a function. buf is always an array, never a pointer.
+   Without that invariant, we would have to introduce full dynamic
+   memory management in this driver -- probably it would be easier to
+   write a new one. [27 Jun 07 -js] */
+#define GetBytes(fp,buf,n) \
+    ( sizeof(buf) != sizeof(void *) && sizeof(buf) > n ? \
+        read_multi(buf, 1, n, fp) \
+      : Fatal("Try to read %d bytes in an array of size %d", n, sizeof(buf)) )
 
 
 /**********************************************************************/