summaryrefslogtreecommitdiff
path: root/Build/source/texk/web2c/alephdir
diff options
context:
space:
mode:
authorHironobu Yamashita <h.y.acetaminophen@gmail.com>2023-08-18 15:42:55 +0000
committerHironobu Yamashita <h.y.acetaminophen@gmail.com>2023-08-18 15:42:55 +0000
commite5a1f72fc714b143dad55f6d0d71e5e69947dac1 (patch)
tree3e399175b8b9ea8f2c17bb62691d76c5e357dedb /Build/source/texk/web2c/alephdir
parent82f273487357890418ab50d434c84b94d7c297d0 (diff)
aleph: introduce expand_depth to avoid overflow
based on tex-k list 2020-05-27 git-svn-id: svn://tug.org/texlive/trunk@67969 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/web2c/alephdir')
-rw-r--r--Build/source/texk/web2c/alephdir/ChangeLog7
-rw-r--r--Build/source/texk/web2c/alephdir/com16bit.ch43
-rw-r--r--Build/source/texk/web2c/alephdir/comsrcspec.ch2
-rw-r--r--Build/source/texk/web2c/alephdir/eobase.ch3
4 files changed, 53 insertions, 2 deletions
diff --git a/Build/source/texk/web2c/alephdir/ChangeLog b/Build/source/texk/web2c/alephdir/ChangeLog
index 41ddddaf71e..97f5be72980 100644
--- a/Build/source/texk/web2c/alephdir/ChangeLog
+++ b/Build/source/texk/web2c/alephdir/ChangeLog
@@ -1,3 +1,10 @@
+2023-08-18 Hironobu Yamashita <h.y.acetaminophen@gmail.com>
+
+ * com16bit.ch: Sync with tex.ch changes:
+ - 2008-01-02 r6024 introduce expand_depth.
+ * eobase.ch: Sync with etex.ch changes:
+ - 2021-02-22 r57850 avoid "expansion depth" overflow.
+
2023-03-09 Karl Berry <karl@tug.org>
* TL'23 release.
diff --git a/Build/source/texk/web2c/alephdir/com16bit.ch b/Build/source/texk/web2c/alephdir/com16bit.ch
index 7af53f518c2..ff01fdc5a0e 100644
--- a/Build/source/texk/web2c/alephdir/com16bit.ch
+++ b/Build/source/texk/web2c/alephdir/com16bit.ch
@@ -230,6 +230,9 @@ if ini_version then
@!sup_hyph_size = ssup_hyph_size;
@!inf_hyph_size = iinf_hyphen_size; {Must be not less than |hyph_prime|!}
+
+@!inf_expand_depth = 10;
+@!sup_expand_depth = 10000000;
@z
@x [1.12] l.427 - Constants that are WEB numeric macros.
@@ -466,6 +469,7 @@ tini@/
@!save_size:integer; {space for saving values outside of current group; must be
at most |max_halfword|}
@!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8}
+@!expand_depth:integer; {limits recursive calls to the |expand| procedure}
@!quoted_filename:boolean; {current filename is quoted}
@z
@@ -1039,6 +1043,22 @@ begin input_ptr:=0; max_in_stack:=0;
source_filename_stack[0]:=0;full_source_filename_stack[0]:=0;
@z
+@x [25.366] l.7672 - expansion depth overflow
+begin cv_backup:=cur_val; cvl_backup:=cur_val_level; radix_backup:=radix;
+@y
+begin
+incr(expand_depth_count);
+if expand_depth_count>=expand_depth then overflow("expansion depth",expand_depth);
+cv_backup:=cur_val; cvl_backup:=cur_val_level; radix_backup:=radix;
+@z
+
+@x [25.366] l.7678 - expansion depth overflow
+cur_order:=co_backup; link(backup_head):=backup_backup;
+@y
+cur_order:=co_backup; link(backup_head):=backup_backup;
+decr(expand_depth_count);
+@z
+
% Original report: https://tex.stackexchange.com/questions/609423
% TeX bug entry: https://tug.org/texmfbug/newbug.html#B155endwrite
@x [25.369] l.7717 - disallow \noexpand\endwrite
@@ -2564,6 +2584,7 @@ begin @!{|start_here|}
setup_bound_var (79)('error_line')(error_line);
setup_bound_var (50)('half_error_line')(half_error_line);
setup_bound_var (79)('max_print_line')(max_print_line);
+ setup_bound_var (10000)('expand_depth')(expand_depth);
const_chk (main_memory);
@+init
if ini_version then begin
@@ -3021,5 +3042,27 @@ begin
get_nullstr := "";
end;
+
+@* \[54/web2c] More changes for Web2c.
+% Related to [25.366] expansion depth check
+Sometimes, recursive calls to the |expand| routine may
+cause exhaustion of the run-time calling stack, resulting in
+forced execution stops by the operating system. To diminish the chance
+of this happening, a counter is used to keep track of the recursion
+depth, in conjunction with a constant called |expand_depth|.
+
+This does not catch all possible infinite recursion loops, just the ones
+that exhaust the application calling stack. The actual maximum value of
+|expand_depth| is outside of our control, but the initial setting of
+|10000| should be enough to prevent problems.
+@^system dependencies@>
+
+@<Global...@>=
+expand_depth_count:integer;
+
+@ @<Set init...@>=
+expand_depth_count:=0;
+
+
@* \[54] System-dependent changes.
@z
diff --git a/Build/source/texk/web2c/alephdir/comsrcspec.ch b/Build/source/texk/web2c/alephdir/comsrcspec.ch
index 9a1680c4a6f..0e6a0ce90be 100644
--- a/Build/source/texk/web2c/alephdir/comsrcspec.ch
+++ b/Build/source/texk/web2c/alephdir/comsrcspec.ch
@@ -1,8 +1,6 @@
@x
-@!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8}
@!quoted_filename:boolean; {current filename is quoted}
@y
-@!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8}
@!quoted_filename:boolean; {current filename is quoted}
@!special_loc:pointer;
@!special_token:halfword;
diff --git a/Build/source/texk/web2c/alephdir/eobase.ch b/Build/source/texk/web2c/alephdir/eobase.ch
index 080b99c50fc..3a6bda1630f 100644
--- a/Build/source/texk/web2c/alephdir/eobase.ch
+++ b/Build/source/texk/web2c/alephdir/eobase.ch
@@ -3586,7 +3586,10 @@ var a,@!b:boolean; {saved values of |arith_error|}
@!p:pointer; {top of expression stack}
@!q:pointer; {for stack manipulations}
begin l:=cur_val_level; a:=arith_error; b:=false; p:=null;
+incr(expand_depth_count);
+if expand_depth_count>=expand_depth then overflow("expansion depth",expand_depth);
@<Scan and evaluate an expression |e| of type |l|@>;
+decr(expand_depth_count);
if b then
begin print_err("Arithmetic overflow");
@.Arithmetic overflow@>