summaryrefslogtreecommitdiff
path: root/Build/source/texk/dvipsk/color.c
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-03-29 18:02:17 +0000
committerKarl Berry <karl@freefriends.org>2019-03-29 18:02:17 +0000
commitce78fe6084c04d173c8da96c95146633c129ea8d (patch)
treea8954f07dcde4ae26c6699084a724a4da3bb9bb9 /Build/source/texk/dvipsk/color.c
parent6d3a7f7099dfb79e19a3574f81287c212d4185e1 (diff)
dvips buffer overflows reported by Andy Nguyen
git-svn-id: svn://tug.org/texlive/trunk@50641 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk/color.c')
-rw-r--r--Build/source/texk/dvipsk/color.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/Build/source/texk/dvipsk/color.c b/Build/source/texk/dvipsk/color.c
index f78d52630b3..3db791f528c 100644
--- a/Build/source/texk/dvipsk/color.c
+++ b/Build/source/texk/dvipsk/color.c
@@ -1,4 +1,4 @@
-/*
+/* $Id$
* This is a set of routines for dvips that are used to process color
* commands in the TeX file (passed by \special commands). This was
* orignally written by J. Hafner, E. Blanz and M. Flickner of IBM
@@ -27,6 +27,7 @@
#define COLORHASH (89)
#define MAXCOLORLEN (120) /* maximum color length for background */
#define INITCOLORLEN (10000) /* initial stack size in chars */
+#define OUTBUFSIZ (100) /* base limit on special length */
/*
* This is where we store the color information for a particular page.
* If we free all of these, we free all of the allocated color
@@ -51,7 +52,8 @@ static void
colorcmdout(char *s)
{
char *p;
- char tempword[100];
+ char tempword[OUTBUFSIZ];
+ integer templen;
while (*s && *s <= ' ')
s++;
@@ -66,7 +68,17 @@ colorcmdout(char *s)
return;
}
cmdout(p);
+
strcpy(tempword, "TeXcolor");
+ templen = strlen("TeXcolor") + strlen(s) + 2; /* 2 is slop, just in case */
+ if (templen >= OUTBUFSIZ) {
+ /* PostScript names get truncated to around 128 characters anyway,
+ so there's no reason to allow longer here. */
+ sprintf(errbuf, "! TeXcolor special name longer than %d characters",
+ OUTBUFSIZ);
+ error (errbuf);
+ }
+
for (p=tempword + strlen(tempword); *s && *s > ' '; p++, s++)
*p = *s;
*p = 0;