summaryrefslogtreecommitdiff
path: root/Build/source/texk
diff options
context:
space:
mode:
authorAndreas Scherer <andreas_tex@freenet.de>2023-07-17 15:15:21 +0000
committerAndreas Scherer <andreas_tex@freenet.de>2023-07-17 15:15:21 +0000
commit9d29307dcb777eb5399b047b75e6e454234fa5e4 (patch)
tree872192aedf2324fdfef3a8b68128aafd78593c19 /Build/source/texk
parent0f0235553c87bac50fae9bfabd6aa81c619a29ae (diff)
[C/WEB] Deal with malign user input.
'break_out' and 'flush_buffer' were tricked into putting an extremely long TeX macro (longer than 'line_length', i.e., 80 chars) into 'out_buf', which overflowed. This, of course, would wreak havoc, both in the TeX output and in the runtime system. See https://tug.org/pipermail/tex-live/2023-July/049306.htm for the initial bug report. git-svn-id: svn://tug.org/texlive/trunk@67656 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk')
-rw-r--r--Build/source/texk/web2c/ChangeLog4
-rw-r--r--Build/source/texk/web2c/cwebdir/ChangeLog4
-rw-r--r--Build/source/texk/web2c/cwebdir/cweave.w6
-rw-r--r--Build/source/texk/web2c/weave.ch15
4 files changed, 26 insertions, 3 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index 06a24f2a4d1..2cdc40a1a21 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -1,3 +1,7 @@
+2023-07-17 Andreas Scherer <https://ascherer.github.io>
+
+ * weave.ch: Deal with malign user input.
+
2023-07-09 Andreas Scherer <https://ascherer.github.io>
* cwebboot.cin: Regenerate boot source.
diff --git a/Build/source/texk/web2c/cwebdir/ChangeLog b/Build/source/texk/web2c/cwebdir/ChangeLog
index 564d570c49a..fa92f4560ad 100644
--- a/Build/source/texk/web2c/cwebdir/ChangeLog
+++ b/Build/source/texk/web2c/cwebdir/ChangeLog
@@ -1,3 +1,7 @@
+2023-07-17 Andreas Scherer <https://ascherer.github.io>
+
+ * cweave.w: Deal with malign user input.
+
2023-07-16 Andreas Scherer <https://ascherer.github.io>
* ctwill-mini.ch,
diff --git a/Build/source/texk/web2c/cwebdir/cweave.w b/Build/source/texk/web2c/cwebdir/cweave.w
index 3f92f12c82f..dbdfa3c0291 100644
--- a/Build/source/texk/web2c/cwebdir/cweave.w
+++ b/Build/source/texk/web2c/cwebdir/cweave.w
@@ -1443,8 +1443,8 @@ to overflow. To make this routine a little faster, we initialize position
out_buf[0]='\\';
@ A long line is broken at a blank space or just before a backslash that isn't
-preceded by another backslash. In the latter case, a |'%'| is output at
-the break.
+preceded by another backslash or a \TeX\ comment marker. In the latter case, a
+|'%'| is output at the break.
@c
static void
@@ -1456,7 +1456,7 @@ break_out(void) /* finds a way to break the output line */
if (*k==' ') {
flush_buffer(k,false,true); return;
}
- if (*(k--)=='\\' && *k!='\\') { /* we've decreased |k| */
+ if (*(k--)=='\\' && *k!='\\' && *k!='%') { /* we've decreased |k| */
flush_buffer(k,true,true); return;
}
}
diff --git a/Build/source/texk/web2c/weave.ch b/Build/source/texk/web2c/weave.ch
index 024fbbc207c..136fc89d27f 100644
--- a/Build/source/texk/web2c/weave.ch
+++ b/Build/source/texk/web2c/weave.ch
@@ -325,6 +325,21 @@ begin if no_xref then return;
if (reserved(p)or(byte_start[p]+1=byte_start[p+ww]))and
@z
+@x [127] see https://tug.org/pipermail/tex-live/2023-July/049306.htm
+preceded by another backslash. In the latter case, a |"%"| is output at
+the break.
+@y
+preceded by another backslash or a \TeX\ comment marker. In the latter case, a
+|'%'| is output at the break.
+@z
+
+@x [127] deal with malign user input
+ if (d="\")and(out_buf[k-1]<>"\") then {in this case |k>1|}
+@y
+ if (d="\")and(out_buf[k-1]<>"\")and(out_buf[k-1]<>"%") then
+ {in this case |k>1|}
+@z
+
@x [148] Purify 'reduce' and 'squash'.
@d production(#)==@!debug prod(#) gubed; goto found
@d reduce(#)==red(#); production