summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorKarl Berry <karl@freefriends.org>2010-03-25 23:58:27 +0000
committerKarl Berry <karl@freefriends.org>2010-03-25 23:58:27 +0000
commitdd8a83212fcabcff4600aa0a9d7f3264b0fd07dd (patch)
tree1b5df041965fd25b2f7abc04117ba45b1c174eb1 /Build
parent5c71f7dcce52cab382d58624cc13df5caf788723 (diff)
avoid sprintf buffer overflow, CVE-2010-0827
git-svn-id: svn://tug.org/texlive/trunk@17560 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/dvipsk/ChangeLog3
-rw-r--r--Build/source/texk/dvipsk/virtualfont.c6
2 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index a86425f0655..acd0592af89 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,5 +1,8 @@
2010-03-26 Karl Berry <karl@tug.org>
+ * virtualfont.c (vfopen): do not sprintf too long of a name.
+ CVE-2010-0827, found by Dan Rosenberg.
+
* dospecial.c (predospecial): avoid seg fault from integer overflow.
CVE-2010-0739, found by Marc Schoenefeld, patch prepared
by Jindrich Novy.
diff --git a/Build/source/texk/dvipsk/virtualfont.c b/Build/source/texk/dvipsk/virtualfont.c
index 291b42b2bef..eb1ffc4ad3c 100644
--- a/Build/source/texk/dvipsk/virtualfont.c
+++ b/Build/source/texk/dvipsk/virtualfont.c
@@ -15,7 +15,7 @@
* Subroutine vfbyte returns the next byte.
*/
static FILE *vffile ;
-static char name[50] ;
+static char name[500] ;
void
badvf(const char *s)
{
@@ -72,6 +72,10 @@ vfopen(register fontdesctype *fd)
if (*d==0)
d = vfpath ;
#endif
+ if (strlen(n) + 5 >= sizeof (name)) {
+ /* 5 for vf() + null */
+ error("! VF file name too long in vfopen") ;
+ }
#ifdef MVSXA /* IBM: MVS/XA */
(void)sprintf(name, "vf(%s)", n) ;
#else