diff options
author | Karl Berry <karl@freefriends.org> | 2019-03-29 18:02:17 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2019-03-29 18:02:17 +0000 |
commit | ce78fe6084c04d173c8da96c95146633c129ea8d (patch) | |
tree | a8954f07dcde4ae26c6699084a724a4da3bb9bb9 /Build/source/texk/dvipsk/color.c | |
parent | 6d3a7f7099dfb79e19a3574f81287c212d4185e1 (diff) |
dvips buffer overflows reported by Andy Nguyen
git-svn-id: svn://tug.org/texlive/trunk@50641 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk/color.c')
-rw-r--r-- | Build/source/texk/dvipsk/color.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/Build/source/texk/dvipsk/color.c b/Build/source/texk/dvipsk/color.c index f78d52630b3..3db791f528c 100644 --- a/Build/source/texk/dvipsk/color.c +++ b/Build/source/texk/dvipsk/color.c @@ -1,4 +1,4 @@ -/* +/* $Id$ * This is a set of routines for dvips that are used to process color * commands in the TeX file (passed by \special commands). This was * orignally written by J. Hafner, E. Blanz and M. Flickner of IBM @@ -27,6 +27,7 @@ #define COLORHASH (89) #define MAXCOLORLEN (120) /* maximum color length for background */ #define INITCOLORLEN (10000) /* initial stack size in chars */ +#define OUTBUFSIZ (100) /* base limit on special length */ /* * This is where we store the color information for a particular page. * If we free all of these, we free all of the allocated color @@ -51,7 +52,8 @@ static void colorcmdout(char *s) { char *p; - char tempword[100]; + char tempword[OUTBUFSIZ]; + integer templen; while (*s && *s <= ' ') s++; @@ -66,7 +68,17 @@ colorcmdout(char *s) return; } cmdout(p); + strcpy(tempword, "TeXcolor"); + templen = strlen("TeXcolor") + strlen(s) + 2; /* 2 is slop, just in case */ + if (templen >= OUTBUFSIZ) { + /* PostScript names get truncated to around 128 characters anyway, + so there's no reason to allow longer here. */ + sprintf(errbuf, "! TeXcolor special name longer than %d characters", + OUTBUFSIZ); + error (errbuf); + } + for (p=tempword + strlen(tempword); *s && *s > ' '; p++, s++) *p = *s; *p = 0; |