diff options
author | Karl Berry <karl@freefriends.org> | 2019-03-29 18:02:17 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2019-03-29 18:02:17 +0000 |
commit | ce78fe6084c04d173c8da96c95146633c129ea8d (patch) | |
tree | a8954f07dcde4ae26c6699084a724a4da3bb9bb9 /Build/source/texk/dvipsk/testdata | |
parent | 6d3a7f7099dfb79e19a3574f81287c212d4185e1 (diff) |
dvips buffer overflows reported by Andy Nguyen
git-svn-id: svn://tug.org/texlive/trunk@50641 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk/testdata')
-rw-r--r-- | Build/source/texk/dvipsk/testdata/color.pro | 46 | ||||
-rw-r--r-- | Build/source/texk/dvipsk/testdata/overflow-color-push.dvi | bin | 0 -> 1296 bytes | |||
-rw-r--r-- | Build/source/texk/dvipsk/testdata/overflow-color-push.tex | 17 | ||||
-rw-r--r-- | Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi | bin | 0 -> 1120 bytes | |||
-rw-r--r-- | Build/source/texk/dvipsk/testdata/overflow-epsfile.tex | 17 | ||||
-rw-r--r-- | Build/source/texk/dvipsk/testdata/overflow-psbox.dvi | bin | 0 -> 780 bytes | |||
-rw-r--r-- | Build/source/texk/dvipsk/testdata/overflow-psbox.tex | 18 |
7 files changed, 98 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/testdata/color.pro b/Build/source/texk/dvipsk/testdata/color.pro new file mode 100644 index 00000000000..bf704cc3d08 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/color.pro @@ -0,0 +1,46 @@ +%! +TeXDict begin/setcmykcolor where{pop}{/setcmykcolor{dup 10 eq{pop +setrgbcolor}{1 sub 4 1 roll 3{3 index add neg dup 0 lt{pop 0}if 3 1 roll +}repeat setrgbcolor pop}ifelse}B}ifelse/TeXcolorcmyk{setcmykcolor}def +/TeXcolorrgb{setrgbcolor}def/TeXcolorgrey{setgray}def/TeXcolorgray{ +setgray}def/TeXcolorhsb{sethsbcolor}def/currentcmykcolor where{pop}{ +/currentcmykcolor{currentrgbcolor 10}B}ifelse/DC{exch dup userdict exch +known{pop pop}{X}ifelse}B/GreenYellow{0.15 0 0.69 0 setcmykcolor}DC +/Yellow{0 0 1 0 setcmykcolor}DC/Goldenrod{0 0.10 0.84 0 setcmykcolor}DC +/Dandelion{0 0.29 0.84 0 setcmykcolor}DC/Apricot{0 0.32 0.52 0 +setcmykcolor}DC/Peach{0 0.50 0.70 0 setcmykcolor}DC/Melon{0 0.46 0.50 0 +setcmykcolor}DC/YellowOrange{0 0.42 1 0 setcmykcolor}DC/Orange{0 0.61 +0.87 0 setcmykcolor}DC/BurntOrange{0 0.51 1 0 setcmykcolor}DC +/Bittersweet{0 0.75 1 0.24 setcmykcolor}DC/RedOrange{0 0.77 0.87 0 +setcmykcolor}DC/Mahogany{0 0.85 0.87 0.35 setcmykcolor}DC/Maroon{0 0.87 +0.68 0.32 setcmykcolor}DC/BrickRed{0 0.89 0.94 0.28 setcmykcolor}DC/Red{ +0 1 1 0 setcmykcolor}DC/OrangeRed{0 1 0.50 0 setcmykcolor}DC/RubineRed{ +0 1 0.13 0 setcmykcolor}DC/WildStrawberry{0 0.96 0.39 0 setcmykcolor}DC +/Salmon{0 0.53 0.38 0 setcmykcolor}DC/CarnationPink{0 0.63 0 0 +setcmykcolor}DC/Magenta{0 1 0 0 setcmykcolor}DC/VioletRed{0 0.81 0 0 +setcmykcolor}DC/Rhodamine{0 0.82 0 0 setcmykcolor}DC/Mulberry{0.34 0.90 +0 0.02 setcmykcolor}DC/RedViolet{0.07 0.90 0 0.34 setcmykcolor}DC +/Fuchsia{0.47 0.91 0 0.08 setcmykcolor}DC/Lavender{0 0.48 0 0 +setcmykcolor}DC/Thistle{0.12 0.59 0 0 setcmykcolor}DC/Orchid{0.32 0.64 0 +0 setcmykcolor}DC/DarkOrchid{0.40 0.80 0.20 0 setcmykcolor}DC/Purple{ +0.45 0.86 0 0 setcmykcolor}DC/Plum{0.50 1 0 0 setcmykcolor}DC/Violet{ +0.79 0.88 0 0 setcmykcolor}DC/RoyalPurple{0.75 0.90 0 0 setcmykcolor}DC +/BlueViolet{0.86 0.91 0 0.04 setcmykcolor}DC/Periwinkle{0.57 0.55 0 0 +setcmykcolor}DC/CadetBlue{0.62 0.57 0.23 0 setcmykcolor}DC +/CornflowerBlue{0.65 0.13 0 0 setcmykcolor}DC/MidnightBlue{0.98 0.13 0 +0.43 setcmykcolor}DC/NavyBlue{0.94 0.54 0 0 setcmykcolor}DC/RoyalBlue{1 +0.50 0 0 setcmykcolor}DC/Blue{1 1 0 0 setcmykcolor}DC/Cerulean{0.94 0.11 +0 0 setcmykcolor}DC/Cyan{1 0 0 0 setcmykcolor}DC/ProcessBlue{0.96 0 0 0 +setcmykcolor}DC/SkyBlue{0.62 0 0.12 0 setcmykcolor}DC/Turquoise{0.85 0 +0.20 0 setcmykcolor}DC/TealBlue{0.86 0 0.34 0.02 setcmykcolor}DC +/Aquamarine{0.82 0 0.30 0 setcmykcolor}DC/BlueGreen{0.85 0 0.33 0 +setcmykcolor}DC/Emerald{1 0 0.50 0 setcmykcolor}DC/JungleGreen{0.99 0 +0.52 0 setcmykcolor}DC/SeaGreen{0.69 0 0.50 0 setcmykcolor}DC/Green{1 0 +1 0 setcmykcolor}DC/ForestGreen{0.91 0 0.88 0.12 setcmykcolor}DC +/PineGreen{0.92 0 0.59 0.25 setcmykcolor}DC/LimeGreen{0.50 0 1 0 +setcmykcolor}DC/YellowGreen{0.44 0 0.74 0 setcmykcolor}DC/SpringGreen{ +0.26 0 0.76 0 setcmykcolor}DC/OliveGreen{0.64 0 0.95 0.40 setcmykcolor} +DC/RawSienna{0 0.72 1 0.45 setcmykcolor}DC/Sepia{0 0.83 1 0.70 +setcmykcolor}DC/Brown{0 0.81 1 0.60 setcmykcolor}DC/Tan{0.14 0.42 0.56 0 +setcmykcolor}DC/Gray{0 0 0 0.50 setcmykcolor}DC/Black{0 0 0 1 +setcmykcolor}DC/White{0 0 0 0 setcmykcolor}DC end diff --git a/Build/source/texk/dvipsk/testdata/overflow-color-push.dvi b/Build/source/texk/dvipsk/testdata/overflow-color-push.dvi Binary files differnew file mode 100644 index 00000000000..02e40625376 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-color-push.dvi diff --git a/Build/source/texk/dvipsk/testdata/overflow-color-push.tex b/Build/source/texk/dvipsk/testdata/overflow-color-push.tex new file mode 100644 index 00000000000..6a68e925cc6 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-color-push.tex @@ -0,0 +1,17 @@ +% Andy Nguyen of ETH Zurich. Public domain. +% tlsecurity mail of 28 Mar 2019 18:20:48. +% File "dvipsk/color.c", subroutine "colorcmdout": "s" is copied to +% "tempword" without length validation. + +\documentclass{article} + +\begin{document} +\thispagestyle{empty} + +\begin{figure}[p] + +\special{color push aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa a} + +\end{figure} + +\end{document} diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi Binary files differnew file mode 100644 index 00000000000..b2b3a44f3f4 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.tex b/Build/source/texk/dvipsk/testdata/overflow-epsfile.tex new file mode 100644 index 00000000000..5ae2cd13d63 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-epsfile.tex @@ -0,0 +1,17 @@ +% Andy Nguyen of ETH Zurich. Public domain. +% tlsecurity mail of 28 Mar 2019 18:20:48. +% File "dvipsk/dospecial.c", subroutine "dospecial": "epsfile" is parsed +% using "sscanf(p, "%s", psfile);", which has no length limitation. + +\documentclass{article} + +\begin{document} + +\begin{figure}[p] +\thispagestyle{empty} + +\special{epsfile=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa} + +\end{figure} + +\end{document} diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi Binary files differnew file mode 100644 index 00000000000..f890d469006 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex new file mode 100644 index 00000000000..a0431a70168 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex @@ -0,0 +1,18 @@ +% Andy Nguyen of ETH Zurich. Public domain. +% tlsecurity mail of 28 Mar 2019 18:20:48. +% File "dvipsk/dospecial.c", subroutine "dospecial": "psfile" is parsed using +% "sscanf(p+13, "{%fpt}{%fpt}{%[^}]}", &w, &h, psfile)", which has no length +% limitation. + +\documentclass{article} + +\begin{document} +\thispagestyle{empty} + +\begin{figure}[p] + +\special{postscriptbox{}{}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}} + +\end{figure} + +\end{document} |