diff options
author | Andreas Scherer <andreas_tex@freenet.de> | 2023-07-17 15:15:21 +0000 |
---|---|---|
committer | Andreas Scherer <andreas_tex@freenet.de> | 2023-07-17 15:15:21 +0000 |
commit | 9d29307dcb777eb5399b047b75e6e454234fa5e4 (patch) | |
tree | 872192aedf2324fdfef3a8b68128aafd78593c19 /Build/source/texk | |
parent | 0f0235553c87bac50fae9bfabd6aa81c619a29ae (diff) |
[C/WEB] Deal with malign user input.
'break_out' and 'flush_buffer' were tricked into putting an extremely
long TeX macro (longer than 'line_length', i.e., 80 chars) into
'out_buf', which overflowed. This, of course, would wreak havoc, both in
the TeX output and in the runtime system.
See https://tug.org/pipermail/tex-live/2023-July/049306.htm for the
initial bug report.
git-svn-id: svn://tug.org/texlive/trunk@67656 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk')
-rw-r--r-- | Build/source/texk/web2c/ChangeLog | 4 | ||||
-rw-r--r-- | Build/source/texk/web2c/cwebdir/ChangeLog | 4 | ||||
-rw-r--r-- | Build/source/texk/web2c/cwebdir/cweave.w | 6 | ||||
-rw-r--r-- | Build/source/texk/web2c/weave.ch | 15 |
4 files changed, 26 insertions, 3 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog index 06a24f2a4d1..2cdc40a1a21 100644 --- a/Build/source/texk/web2c/ChangeLog +++ b/Build/source/texk/web2c/ChangeLog @@ -1,3 +1,7 @@ +2023-07-17 Andreas Scherer <https://ascherer.github.io> + + * weave.ch: Deal with malign user input. + 2023-07-09 Andreas Scherer <https://ascherer.github.io> * cwebboot.cin: Regenerate boot source. diff --git a/Build/source/texk/web2c/cwebdir/ChangeLog b/Build/source/texk/web2c/cwebdir/ChangeLog index 564d570c49a..fa92f4560ad 100644 --- a/Build/source/texk/web2c/cwebdir/ChangeLog +++ b/Build/source/texk/web2c/cwebdir/ChangeLog @@ -1,3 +1,7 @@ +2023-07-17 Andreas Scherer <https://ascherer.github.io> + + * cweave.w: Deal with malign user input. + 2023-07-16 Andreas Scherer <https://ascherer.github.io> * ctwill-mini.ch, diff --git a/Build/source/texk/web2c/cwebdir/cweave.w b/Build/source/texk/web2c/cwebdir/cweave.w index 3f92f12c82f..dbdfa3c0291 100644 --- a/Build/source/texk/web2c/cwebdir/cweave.w +++ b/Build/source/texk/web2c/cwebdir/cweave.w @@ -1443,8 +1443,8 @@ to overflow. To make this routine a little faster, we initialize position out_buf[0]='\\'; @ A long line is broken at a blank space or just before a backslash that isn't -preceded by another backslash. In the latter case, a |'%'| is output at -the break. +preceded by another backslash or a \TeX\ comment marker. In the latter case, a +|'%'| is output at the break. @c static void @@ -1456,7 +1456,7 @@ break_out(void) /* finds a way to break the output line */ if (*k==' ') { flush_buffer(k,false,true); return; } - if (*(k--)=='\\' && *k!='\\') { /* we've decreased |k| */ + if (*(k--)=='\\' && *k!='\\' && *k!='%') { /* we've decreased |k| */ flush_buffer(k,true,true); return; } } diff --git a/Build/source/texk/web2c/weave.ch b/Build/source/texk/web2c/weave.ch index 024fbbc207c..136fc89d27f 100644 --- a/Build/source/texk/web2c/weave.ch +++ b/Build/source/texk/web2c/weave.ch @@ -325,6 +325,21 @@ begin if no_xref then return; if (reserved(p)or(byte_start[p]+1=byte_start[p+ww]))and @z +@x [127] see https://tug.org/pipermail/tex-live/2023-July/049306.htm +preceded by another backslash. In the latter case, a |"%"| is output at +the break. +@y +preceded by another backslash or a \TeX\ comment marker. In the latter case, a +|'%'| is output at the break. +@z + +@x [127] deal with malign user input + if (d="\")and(out_buf[k-1]<>"\") then {in this case |k>1|} +@y + if (d="\")and(out_buf[k-1]<>"\")and(out_buf[k-1]<>"%") then + {in this case |k>1|} +@z + @x [148] Purify 'reduce' and 'squash'. @d production(#)==@!debug prod(#) gubed; goto found @d reduce(#)==red(#); production |