diff options
author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2021-03-13 21:26:22 +0000 |
---|---|---|
committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2021-03-13 21:26:22 +0000 |
commit | 7ec02a18e61d4ee12d12f645e0f1502417bd2d64 (patch) | |
tree | 68c0e1ae8b7311669593b5a7eed5336c5cabc849 /Build/source/texk/dvipdfm-x/dvipdfmx.c | |
parent | f9ca12695b4f3101c3c96dbe5e5ec8403d38bd2e (diff) |
dvipdfmx: Do not allow directory separators in an optarg in an option -i optarg for security reason.
git-svn-id: svn://tug.org/texlive/trunk@58324 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipdfm-x/dvipdfmx.c')
-rw-r--r-- | Build/source/texk/dvipdfm-x/dvipdfmx.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/Build/source/texk/dvipdfm-x/dvipdfmx.c b/Build/source/texk/dvipdfm-x/dvipdfmx.c index f56c1d44ed3..3a4dfa35364 100644 --- a/Build/source/texk/dvipdfm-x/dvipdfmx.c +++ b/Build/source/texk/dvipdfm-x/dvipdfmx.c @@ -614,8 +614,19 @@ do_args_second_pass (int argc, char *argv[], const char *source, int unsafe) case 'i': { +/* + -i ./foo.cfg, -i /usr/abc/foo.cfg, etc. are not allowed for + security reason. +*/ + char *dir1, *dir2; int optind_save= optind; - read_config_file(optarg); + dir1 = strrchr(optarg, '/'); + dir2 = strrchr(optarg, '\\'); + if (dir1 || dir2) { + WARN("%s is not allowed. Default configuration file is used.", optarg); + } else { + read_config_file(optarg); + } optind = optind_save; break; } |