summaryrefslogtreecommitdiff
path: root/Build/source/texk/dvipsk
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2010-05-03 17:42:53 +0000
committerKarl Berry <karl@freefriends.org>2010-05-03 17:42:53 +0000
commit4777a5efe301344ba98286eddc8708b95808ba2e (patch)
tree801e0d42437f30f49b83a4ed0aa7704e5c458861 /Build/source/texk/dvipsk
parent2457fb644a0b9adf6984ecf93f0b42e6de78a716 (diff)
more integer overflows, tetex-3.0-CVE-2010-0739,1440 (from rh/suse)
git-svn-id: svn://tug.org/texlive/trunk@18095 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk')
-rw-r--r--Build/source/texk/dvipsk/ChangeLog7
-rw-r--r--Build/source/texk/dvipsk/dospecial.c12
2 files changed, 14 insertions, 5 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 9b2c5bc9177..badabd9570c 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,10 @@
+2010-05-03 Jan Lieskovsky <jlieskov@redhat.com>
+
+ * dospecial.c (predospecial, bbdospecial): avoid numeric overflow.
+ tetex-3.0-CVE-2010-0739,1440-integer-overflows.patch,
+ from Ludwig Nussel, Karel Srot.
+ tlsecurity mail 30 Apr 2010 16:59:37.
+
2010-04-26 Akira Kakuto <kakuto@fuk.kindai.ac.jp>
* afm2tfm.c: (write16()): cast argument to short to avoid warning.
diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c
index e68470913f8..2cdf3c2f4fb 100644
--- a/Build/source/texk/dvipsk/dospecial.c
+++ b/Build/source/texk/dvipsk/dospecial.c
@@ -296,10 +296,8 @@ predospecial(integer numbytes, Boolean scanning)
int j;
static int omega_specials = 0;
- if (nextstring + numbytes > maxstring) {
- if (numbytes < 0
- || (numbytes > 0 && 2 > INT_MAX / numbytes)
- || 2 * numbytes > 1000 + 2 * numbytes) {
+ if (numbytes < 0 || numbytes > maxstring - nextstring) {
+ if (numbytes < 0 || numbytes > (INT_MAX - 1000) / 2 ) {
error("! Integer overflow in predospecial");
exit(1);
}
@@ -850,7 +848,11 @@ bbdospecial(int nbytes)
char seen[NKEYS];
float valseen[NKEYS];
- if (nextstring + nbytes > maxstring) {
+ if (nbytes < 0 || nbytes > maxstring - nextstring) {
+ if (nbytes < 0 || nbytes > (INT_MAX - 1000) / 2 ) {
+ error("! Integer overflow in bbdospecial");
+ exit(1);
+ }
p = nextstring = mymalloc(1000 + 2 * nbytes);
maxstring = nextstring + 2 * nbytes + 700;
}