summaryrefslogtreecommitdiff
path: root/Build/source
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2023-11-19 16:03:33 +0000
committerKarl Berry <karl@freefriends.org>2023-11-19 16:03:33 +0000
commit953400636440b9766a2771d046ead7faad09671f (patch)
tree9b737d3387dcf32487ab14ebb0a0c2049a54d90a /Build/source
parenta980d02c398c6d9cafce33225206d13847de0204 (diff)
improve fmt/base corruption checks, from DRF
git-svn-id: svn://tug.org/texlive/trunk@68900 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source')
-rw-r--r--Build/source/texk/web2c/ChangeLog6
-rw-r--r--Build/source/texk/web2c/mf.ch11
-rw-r--r--Build/source/texk/web2c/tex.ch11
3 files changed, 24 insertions, 4 deletions
diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog
index d8b8c81d16c..06b9647abec 100644
--- a/Build/source/texk/web2c/ChangeLog
+++ b/Build/source/texk/web2c/ChangeLog
@@ -1,3 +1,9 @@
+2023-11-19 Karl Berry <karl@freefriends.org>
+
+ * tex.ch,
+ * mf.ch (Undump the dynamic memory): improve fmt/base corruption
+ tests, from DRF.
+
2023-11-19 Andreas Scherer <https://ascherer.github.io>
* ctangleboot.cin,
diff --git a/Build/source/texk/web2c/mf.ch b/Build/source/texk/web2c/mf.ch
index 4b13cacb441..af7a1ca1e9f 100644
--- a/Build/source/texk/web2c/mf.ch
+++ b/Build/source/texk/web2c/mf.ch
@@ -1854,12 +1854,19 @@ mem:=xmalloc_array (memory_word, mem_max - mem_min + 1);
@z
@x [48.1195] l.22714 - Check that p did not become corrupt.
+p:=q+node_size(q);
if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base;
@y
{If the base file is messed up, that addition to |p| might cause it to
become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023.
- Found with a fuzz tester similar to AFL-fuzz. Also changed in \TeX.}
-if (p<mem_min)or(p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base;
+ Also changed in \MF. Fix from DRF, who explains: we test before doing the
+ addition to avoid assuming silent wrap-around overflow, and also to to
+ catch cases where |node_size| was, say, bogusly the equivalent of $-1$
+ and thus |p+node_size| would still look valid.}
+if (node_size(q)>lo_mem_max-q) or (rlink(q)>lo_mem_max)
+ or ((q>=rlink(q))and(rlink(q)<>rover))
+then goto off_base;
+p:=q+node_size(q);
@z
@x [48.1199] l.22750 - Allow command line to override dumped value.
diff --git a/Build/source/texk/web2c/tex.ch b/Build/source/texk/web2c/tex.ch
index 51307bf7c7b..3243105730a 100644
--- a/Build/source/texk/web2c/tex.ch
+++ b/Build/source/texk/web2c/tex.ch
@@ -3654,12 +3654,19 @@ repeat undump_things(mem[p], q+2-p);
@z
@x [50.1312] l.23955 - Check that p did not become corrupt.
+p:=q+node_size(q);
if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt;
@y
{If the format file is messed up, that addition to |p| might cause it to
become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023.
- Found with a fuzz tester similar to AFL-fuzz. Also changed in \MF.}
-if (p<mem_min)or(p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt;
+ Also changed in \MF. Fix from DRF, who explains: we test before doing the
+ addition to avoid assuming silent wrap-around overflow, and also to to
+ catch cases where |node_size| was, say, bogusly the equivalent of $-1$
+ and thus |p+node_size| would still look valid.}
+if (node_size(q)>lo_mem_max-q) or (rlink(q)>lo_mem_max)
+ or ((q>=rlink(q))and(rlink(q)<>rover))
+then goto bad_fmt;
+p:=q+node_size(q);
@z
@x [50.1312] l.23878 - Make dumping/undumping more efficient.