summaryrefslogtreecommitdiff
path: root/Build/source
diff options
context:
space:
mode:
authorPeter Breitenlohner <peb@mppmu.mpg.de>2011-04-14 06:24:21 +0000
committerPeter Breitenlohner <peb@mppmu.mpg.de>2011-04-14 06:24:21 +0000
commit210ecd46c941591f22752d21bd7c01609e9cd1df (patch)
tree5de12ae487f3238991a576240ca768a8c0561292 /Build/source
parent64bb02ff3ddf68d5b88da2111b22f124819f5178 (diff)
Bug fix: t1lib "token()" and "linetoken()" buffer overflow
git-svn-id: svn://tug.org/texlive/trunk@22083 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source')
-rw-r--r--Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog6
-rw-r--r--Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit31
-rw-r--r--Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c7
3 files changed, 42 insertions, 2 deletions
diff --git a/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog
new file mode 100644
index 00000000000..fef1131b818
--- /dev/null
+++ b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog
@@ -0,0 +1,6 @@
+2011-04-14 Peter Breitenlohner <peb@mppmu.mpg.de>
+
+ * patch-01-buffer-limit (new): Avoid buffer overflow in
+ lib/t1lib/parseAFM.c token() and linetoken().
+ http://secunia.com/advisories/43491/
+
diff --git a/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit
new file mode 100644
index 00000000000..01289f0d861
--- /dev/null
+++ b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit
@@ -0,0 +1,31 @@
+diff -ur t1lib-5.1.2.orig/lib/t1lib/parseAFM.c t1lib-5.1.2/lib/t1lib/parseAFM.c
+--- t1lib-5.1.2.orig/lib/t1lib/parseAFM.c 2007-12-23 16:49:42.000000000 +0100
++++ t1lib-5.1.2/lib/t1lib/parseAFM.c 2011-04-13 20:48:00.000000000 +0200
+@@ -179,6 +179,8 @@
+
+ /*************************** PARSING ROUTINES **************/
+
++#define MAX_NAME_1 MAX_NAME-1 /* check for buffer overflow */
++
+ /*************************** token *************************/
+
+ /* A "AFM File Conventions" tokenizer. That means that it will
+@@ -198,7 +200,8 @@
+
+ idx = 0;
+
+- while (ch != EOF && ch != ' ' && ch != CR && ch != LF &&
++ while (idx < MAX_NAME_1 &&
++ ch != EOF && ch != ' ' && ch != CR && ch != LF &&
+ ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
+ ident[idx++] = ch;
+ ch = fgetc(stream);
+@@ -235,7 +238,7 @@
+ while ((ch = fgetc(stream)) == ' ' || ch == '\t' );
+
+ idx = 0;
+- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
++ while (idx < MAX_NAME_1 && ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
+ {
+ ident[idx++] = ch;
+ ch = fgetc(stream);
diff --git a/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c b/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c
index 6a31d7f3443..48dd1f0257d 100644
--- a/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c
+++ b/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c
@@ -179,6 +179,8 @@ static char *keyStrings[] = {
/*************************** PARSING ROUTINES **************/
+#define MAX_NAME_1 MAX_NAME-1 /* check for buffer overflow */
+
/*************************** token *************************/
/* A "AFM File Conventions" tokenizer. That means that it will
@@ -198,7 +200,8 @@ static char *token(stream)
idx = 0;
- while (ch != EOF && ch != ' ' && ch != CR && ch != LF &&
+ while (idx < MAX_NAME_1 &&
+ ch != EOF && ch != ' ' && ch != CR && ch != LF &&
ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){
ident[idx++] = ch;
ch = fgetc(stream);
@@ -235,7 +238,7 @@ static char *linetoken(stream)
while ((ch = fgetc(stream)) == ' ' || ch == '\t' );
idx = 0;
- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
+ while (idx < MAX_NAME_1 && ch != EOF && ch != CR && ch != LF && ch != CTRL_Z)
{
ident[idx++] = ch;
ch = fgetc(stream);