summaryrefslogtreecommitdiff
path: root/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c
diff options
context:
space:
mode:
authorLuigi Scarso <luigi.scarso@gmail.com>2021-03-12 22:55:21 +0000
committerLuigi Scarso <luigi.scarso@gmail.com>2021-03-12 22:55:21 +0000
commit103102eecab04099acc1e76d824477331b29c01f (patch)
treea6c93d0be49c6b32202c9675d6f1dc12f64d74fa /Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c
parent3ad0207b57ca7afedcc2ba063e6adb79bad710f7 (diff)
Luatex: when restricted system commands is enabled os.setenv has no effect. Patched Decompress to avoid execution of arbitrary commands.
git-svn-id: svn://tug.org/texlive/trunk@58292 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c')
-rw-r--r--Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c b/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c
index 84e062c013e..e26666636c9 100644
--- a/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c
+++ b/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c
@@ -246,6 +246,12 @@ char *Decompress(char *name, int compression) {
char buf[1500];
char *tmpfile;
+ if ( strchr(name,'$') || strchr(name,'!') || strchr(name,'*') || strchr(name,'?')
+ || strchr(name,'[') || strchr(name,'[') || strchr(name,']') || strchr(name,']')
+ || strchr(name,';') || strchr(name,'&') || strchr(name,'>') || strchr(name,'<')
+ || strchr(name,'`') || strchr(name,'"') || strchr(name,'|') || strchr(name,'\'')
+ || strchr(name,'\\'))
+return( NULL );
if ( dir==NULL ) dir = P_tmpdir;
tmpfile = galloc(strlen(dir)+strlen(GFileNameTail(name))+2);
strcpy(tmpfile,dir);
@@ -253,9 +259,9 @@ char *Decompress(char *name, int compression) {
strcat(tmpfile,GFileNameTail(name));
*strrchr(tmpfile,'.') = '\0';
#if defined( _NO_SNPRINTF ) || defined( __VMS )
- sprintf( buf, "%s < %s > %s", compressors[compression].decomp, name, tmpfile );
+ sprintf( buf, "%s < \"%s\" > \"%s\"", compressors[compression].decomp, name, tmpfile );
#else
- snprintf( buf, sizeof(buf), "%s < %s > %s", compressors[compression].decomp, name, tmpfile );
+ snprintf( buf, sizeof(buf), "%s < \"%s\" > \"%s\"", compressors[compression].decomp, name, tmpfile );
#endif
if ( system(buf)==0 )
return( tmpfile );