diff options
author | Karl Berry <karl@freefriends.org> | 2010-05-03 17:42:53 +0000 |
---|---|---|
committer | Karl Berry <karl@freefriends.org> | 2010-05-03 17:42:53 +0000 |
commit | 4777a5efe301344ba98286eddc8708b95808ba2e (patch) | |
tree | 801e0d42437f30f49b83a4ed0aa7704e5c458861 /Build/source/texk/dvipsk | |
parent | 2457fb644a0b9adf6984ecf93f0b42e6de78a716 (diff) |
more integer overflows, tetex-3.0-CVE-2010-0739,1440 (from rh/suse)
git-svn-id: svn://tug.org/texlive/trunk@18095 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk')
-rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 7 | ||||
-rw-r--r-- | Build/source/texk/dvipsk/dospecial.c | 12 |
2 files changed, 14 insertions, 5 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 9b2c5bc9177..badabd9570c 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,10 @@ +2010-05-03 Jan Lieskovsky <jlieskov@redhat.com> + + * dospecial.c (predospecial, bbdospecial): avoid numeric overflow. + tetex-3.0-CVE-2010-0739,1440-integer-overflows.patch, + from Ludwig Nussel, Karel Srot. + tlsecurity mail 30 Apr 2010 16:59:37. + 2010-04-26 Akira Kakuto <kakuto@fuk.kindai.ac.jp> * afm2tfm.c: (write16()): cast argument to short to avoid warning. diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c index e68470913f8..2cdf3c2f4fb 100644 --- a/Build/source/texk/dvipsk/dospecial.c +++ b/Build/source/texk/dvipsk/dospecial.c @@ -296,10 +296,8 @@ predospecial(integer numbytes, Boolean scanning) int j; static int omega_specials = 0; - if (nextstring + numbytes > maxstring) { - if (numbytes < 0 - || (numbytes > 0 && 2 > INT_MAX / numbytes) - || 2 * numbytes > 1000 + 2 * numbytes) { + if (numbytes < 0 || numbytes > maxstring - nextstring) { + if (numbytes < 0 || numbytes > (INT_MAX - 1000) / 2 ) { error("! Integer overflow in predospecial"); exit(1); } @@ -850,7 +848,11 @@ bbdospecial(int nbytes) char seen[NKEYS]; float valseen[NKEYS]; - if (nextstring + nbytes > maxstring) { + if (nbytes < 0 || nbytes > maxstring - nextstring) { + if (nbytes < 0 || nbytes > (INT_MAX - 1000) / 2 ) { + error("! Integer overflow in bbdospecial"); + exit(1); + } p = nextstring = mymalloc(1000 + 2 * nbytes); maxstring = nextstring + 2 * nbytes + 700; } |