diff options
| author | Karl Berry <karl@freefriends.org> | 2010-03-25 23:58:27 +0000 |
|---|---|---|
| committer | Karl Berry <karl@freefriends.org> | 2010-03-25 23:58:27 +0000 |
| commit | dd8a83212fcabcff4600aa0a9d7f3264b0fd07dd (patch) | |
| tree | 1b5df041965fd25b2f7abc04117ba45b1c174eb1 /Build/source/texk/dvipsk/virtualfont.c | |
| parent | 5c71f7dcce52cab382d58624cc13df5caf788723 (diff) | |
avoid sprintf buffer overflow, CVE-2010-0827
git-svn-id: svn://tug.org/texlive/trunk@17560 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk/virtualfont.c')
| -rw-r--r-- | Build/source/texk/dvipsk/virtualfont.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/Build/source/texk/dvipsk/virtualfont.c b/Build/source/texk/dvipsk/virtualfont.c index 291b42b2bef..eb1ffc4ad3c 100644 --- a/Build/source/texk/dvipsk/virtualfont.c +++ b/Build/source/texk/dvipsk/virtualfont.c @@ -15,7 +15,7 @@ * Subroutine vfbyte returns the next byte. */ static FILE *vffile ; -static char name[50] ; +static char name[500] ; void badvf(const char *s) { @@ -72,6 +72,10 @@ vfopen(register fontdesctype *fd) if (*d==0) d = vfpath ; #endif + if (strlen(n) + 5 >= sizeof (name)) { + /* 5 for vf() + null */ + error("! VF file name too long in vfopen") ; + } #ifdef MVSXA /* IBM: MVS/XA */ (void)sprintf(name, "vf(%s)", n) ; #else |