summaryrefslogtreecommitdiff
path: root/Build/source/texk/dvipsk
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2019-03-30 01:30:26 +0000
committerKarl Berry <karl@freefriends.org>2019-03-30 01:30:26 +0000
commitd26a25bf0e44eaad0cad5ddbcc71d69de823eb3f (patch)
treee65c9e4f3eaff42300513ac8f142770eacb074ca /Build/source/texk/dvipsk
parentea81187ac51a8fde27922e477b11eaf0ac00c54d (diff)
further buffer size corrections
git-svn-id: svn://tug.org/texlive/trunk@50649 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dvipsk')
-rw-r--r--Build/source/texk/dvipsk/ChangeLog8
-rw-r--r--Build/source/texk/dvipsk/dospecial.c44
-rwxr-xr-xBuild/source/texk/dvipsk/test-overflow-buffers.test9
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-epsfile.dvibin1120 -> 1120 bytes
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-ifffile.dvibin0 -> 1168 bytes
-rwxr-xr-xBuild/source/texk/dvipsk/testdata/overflow-ifffile.tex12
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-keyword.dvibin0 -> 1160 bytes
-rwxr-xr-xBuild/source/texk/dvipsk/testdata/overflow-keyword.tex12
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-psbox.dvibin780 -> 1140 bytes
-rw-r--r--Build/source/texk/dvipsk/testdata/overflow-psbox.tex4
10 files changed, 72 insertions, 17 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 559ba09b741..4b8c0a3a6e5 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,8 +1,12 @@
2019-03-29 Karl Berry <karl@freefriends.org>
+ * dospecial.c (dospecial) <bare psfile>: reverse sense of maccess
+ test, as intended; check for buffer overflow.
+ (maccess): add doc.
+
* color.c (colorcmdout),
- * dospecial.c (dospecial) <epsfile>, <postscriptbox>: check for
- buffer overflows.
+ * dospecial.c (dospecial) <epsfile>, <postscriptbox>, <psfile>:
+ check for buffer overflows.
* test-overflow-buffers.test,
* testdata/color.pro,
* testdata/overflow-color-push.dvi,
diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c
index e44efae4502..1e34c54a35f 100644
--- a/Build/source/texk/dvipsk/dospecial.c
+++ b/Build/source/texk/dvipsk/dospecial.c
@@ -574,13 +574,15 @@ default:
scanfontcomments(ValStr);
}
+/* Return 1 if S is readable along figpath, 0 if not. */
static int
maccess(char *s)
{
FILE *f = search(figpath, s, "r");
- if (f)
+ int found = (f != 0);
+ if (found)
(*close_file) (f);
- return (f != 0);
+ return found;
}
const char *tasks[] = { 0, "iff2ps", "tek2ps" };
@@ -651,16 +653,22 @@ case 'e':
unsigned psfilelen = 0;
p += 8;
- while (!isspace((unsigned char)*p)) {
+ while (*p && !isspace((unsigned char)*p)) {
if (psfilelen < PSFILESIZ) {
psfile[psfilelen] = *p;
psfilelen++;
+ p++;
} else {
- sprintf(errbuf, "! epsfile= argument longer than %d characters",
- PSFILESIZ);
+ psfile[psfilelen] = 0; /* should not strictly be necessary */
+ sprintf(errbuf,
+ "! epsfile=%.20s... argument longer than %d characters",
+ psfile, PSFILESIZ);
error(errbuf);
}
}
+ if (psfilelen == 0) {
+ error ("! epsfile= argument empty");
+ }
psfile[psfilelen] = 0;
p += strlen(psfile);
fgetboundingbox(psfile, &llx, &lly, &urx, &ury);
@@ -936,18 +944,23 @@ default:
while( (p=GetKeyVal(p,&j)) != NULL )
switch (j) {
- case -1: /* for compatability with old conventions, we allow a file name
+ case -1: /* for compatibility with old conventions, we allow a file name
* to be given without the 'psfile=' keyword */
- if (!psfile[0] && maccess(KeyStr)==0) /* yes we can read it */
+ if (!psfile[0] && maccess(KeyStr)==1) { /* yes we can read it */
+ if (strlen(KeyStr) >= PSFILESIZ) {
+ sprintf(errbuf,
+ "! Bare filename (%.20s...) in \\special longer than %d characters",
+ KeyStr, PSFILESIZ);
+ }
strcpy(psfile,KeyStr);
- else {
+ } else {
if (strlen(KeyStr) < 40) {
sprintf(errbuf,
"Unknown keyword (%s) in \\special will be ignored",
KeyStr);
} else {
sprintf(errbuf,
- "Unknown keyword (%.40s...) in \\special will be ignored",
+ "Unknown keyword (%.40s...) in \\special will be ignored",
KeyStr);
}
specerror(errbuf);
@@ -955,11 +968,18 @@ default:
break;
case 0: case 1: case 2: /* psfile */
if (psfile[0]) {
- sprintf(errbuf, "More than one \\special %s given; %s ignored",
- "psfile", ValStr);
+ sprintf(errbuf, "More than one \\special %s given; %.40s ignored",
+ "psfile", ValStr);
specerror(errbuf);
+ } else {
+ if (strlen(ValStr) >= PSFILESIZ) {
+ sprintf(errbuf,
+ "! PS filename (%.20s...) in \\special longer than %d characters",
+ ValStr, PSFILESIZ);
+ error(errbuf);
+ }
+ strcpy(psfile, ValStr);
}
- else strcpy(psfile,ValStr);
task = tasks[j];
break;
default: /* most keywords are output as PostScript procedure calls */
diff --git a/Build/source/texk/dvipsk/test-overflow-buffers.test b/Build/source/texk/dvipsk/test-overflow-buffers.test
index 4c2794826b9..28e314ef0ad 100755
--- a/Build/source/texk/dvipsk/test-overflow-buffers.test
+++ b/Build/source/texk/dvipsk/test-overflow-buffers.test
@@ -3,7 +3,8 @@
# Public domain. Various buffer overflows, reported by
# Andy Nguyen of ETH Zurich. The program should detect and abort.
-for tst in overflow-color-push overflow-epsfile overflow-psbox; do
+for tst in overflow-color-push overflow-epsfile \
+ overflow-ifffile overflow-psbox; do
:
if ./dvips $srcdir/testdata/$tst.dvi -o; then
echo "$0: test $tst should have failed." >&2
@@ -11,4 +12,10 @@ for tst in overflow-color-push overflow-epsfile overflow-psbox; do
fi
done
+# overflow-keyword succeeds, because the special is ignored,
+# because the file (named with 999 a's) does not exist.
+tst=overflow-keyword
+./dvips $srcdir/testdata/$tst.dvi -o || exit 1
+grep ' @setspecial' $tst.ps || exit 1
+
exit 0
diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
index b2b3a44f3f4..0d7e5429aef 100644
--- a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
+++ b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi b/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi
new file mode 100644
index 00000000000..00859cfedc2
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex b/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex
new file mode 100755
index 00000000000..aa6d95f7b55
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex
@@ -0,0 +1,12 @@
+\documentclass{article}
+
+\begin{document}
+\thispagestyle{empty}
+
+\begin{figure}[p]
+
+\special{ifffile=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
+
+\end{figure}
+
+\end{document}
diff --git a/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi b/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi
new file mode 100644
index 00000000000..0df5740c803
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-keyword.tex b/Build/source/texk/dvipsk/testdata/overflow-keyword.tex
new file mode 100755
index 00000000000..f3f6f31d280
--- /dev/null
+++ b/Build/source/texk/dvipsk/testdata/overflow-keyword.tex
@@ -0,0 +1,12 @@
+\documentclass{article}
+
+\begin{document}
+\thispagestyle{empty}
+
+\begin{figure}[p]
+
+\special{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}
+
+\end{figure}
+
+\end{document}
diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
index f890d469006..56ddd5e5b23 100644
--- a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
+++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi
Binary files differ
diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
index a0431a70168..f7628e27e3b 100644
--- a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
+++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex
@@ -1,5 +1,5 @@
% Andy Nguyen of ETH Zurich. Public domain.
-% tlsecurity mail of 28 Mar 2019 18:20:48.
+% tlsecurity mail of 29 Mar 2019 22:41:20.
% File "dvipsk/dospecial.c", subroutine "dospecial": "psfile" is parsed using
% "sscanf(p+13, "{%fpt}{%fpt}{%[^}]}", &w, &h, psfile)", which has no length
% limitation.
@@ -11,7 +11,7 @@
\begin{figure}[p]
-\special{postscriptbox{}{}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}}
+\special{postscriptbox{42pt}{1337pt}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}}
\end{figure}