diff options
author | Luigi Scarso <luigi.scarso@gmail.com> | 2021-03-12 22:55:21 +0000 |
---|---|---|
committer | Luigi Scarso <luigi.scarso@gmail.com> | 2021-03-12 22:55:21 +0000 |
commit | 103102eecab04099acc1e76d824477331b29c01f (patch) | |
tree | a6c93d0be49c6b32202c9675d6f1dc12f64d74fa /Build/source/texk/web2c/luatexdir/luafontloader | |
parent | 3ad0207b57ca7afedcc2ba063e6adb79bad710f7 (diff) |
Luatex: when restricted system commands is enabled os.setenv has no effect. Patched Decompress to avoid execution of arbitrary commands.
git-svn-id: svn://tug.org/texlive/trunk@58292 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/web2c/luatexdir/luafontloader')
-rw-r--r-- | Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c b/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c index 84e062c013e..e26666636c9 100644 --- a/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c +++ b/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c @@ -246,6 +246,12 @@ char *Decompress(char *name, int compression) { char buf[1500]; char *tmpfile; + if ( strchr(name,'$') || strchr(name,'!') || strchr(name,'*') || strchr(name,'?') + || strchr(name,'[') || strchr(name,'[') || strchr(name,']') || strchr(name,']') + || strchr(name,';') || strchr(name,'&') || strchr(name,'>') || strchr(name,'<') + || strchr(name,'`') || strchr(name,'"') || strchr(name,'|') || strchr(name,'\'') + || strchr(name,'\\')) +return( NULL ); if ( dir==NULL ) dir = P_tmpdir; tmpfile = galloc(strlen(dir)+strlen(GFileNameTail(name))+2); strcpy(tmpfile,dir); @@ -253,9 +259,9 @@ char *Decompress(char *name, int compression) { strcat(tmpfile,GFileNameTail(name)); *strrchr(tmpfile,'.') = '\0'; #if defined( _NO_SNPRINTF ) || defined( __VMS ) - sprintf( buf, "%s < %s > %s", compressors[compression].decomp, name, tmpfile ); + sprintf( buf, "%s < \"%s\" > \"%s\"", compressors[compression].decomp, name, tmpfile ); #else - snprintf( buf, sizeof(buf), "%s < %s > %s", compressors[compression].decomp, name, tmpfile ); + snprintf( buf, sizeof(buf), "%s < \"%s\" > \"%s\"", compressors[compression].decomp, name, tmpfile ); #endif if ( system(buf)==0 ) return( tmpfile ); |