diff options
| author | Peter Breitenlohner <peb@mppmu.mpg.de> | 2011-04-14 06:24:21 +0000 |
|---|---|---|
| committer | Peter Breitenlohner <peb@mppmu.mpg.de> | 2011-04-14 06:24:21 +0000 |
| commit | 210ecd46c941591f22752d21bd7c01609e9cd1df (patch) | |
| tree | 5de12ae487f3238991a576240ca768a8c0561292 /Build | |
| parent | 64bb02ff3ddf68d5b88da2111b22f124819f5178 (diff) | |
Bug fix: t1lib "token()" and "linetoken()" buffer overflow
git-svn-id: svn://tug.org/texlive/trunk@22083 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
3 files changed, 42 insertions, 2 deletions
diff --git a/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog new file mode 100644 index 00000000000..fef1131b818 --- /dev/null +++ b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/ChangeLog @@ -0,0 +1,6 @@ +2011-04-14 Peter Breitenlohner <peb@mppmu.mpg.de> + + * patch-01-buffer-limit (new): Avoid buffer overflow in + lib/t1lib/parseAFM.c token() and linetoken(). + http://secunia.com/advisories/43491/ + diff --git a/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit new file mode 100644 index 00000000000..01289f0d861 --- /dev/null +++ b/Build/source/libs/t1lib/t1lib-5.1.2-PATCHES/patch-01-buffer-limit @@ -0,0 +1,31 @@ +diff -ur t1lib-5.1.2.orig/lib/t1lib/parseAFM.c t1lib-5.1.2/lib/t1lib/parseAFM.c +--- t1lib-5.1.2.orig/lib/t1lib/parseAFM.c 2007-12-23 16:49:42.000000000 +0100 ++++ t1lib-5.1.2/lib/t1lib/parseAFM.c 2011-04-13 20:48:00.000000000 +0200 +@@ -179,6 +179,8 @@ + + /*************************** PARSING ROUTINES **************/ + ++#define MAX_NAME_1 MAX_NAME-1 /* check for buffer overflow */ ++ + /*************************** token *************************/ + + /* A "AFM File Conventions" tokenizer. That means that it will +@@ -198,7 +200,8 @@ + + idx = 0; + +- while (ch != EOF && ch != ' ' && ch != CR && ch != LF && ++ while (idx < MAX_NAME_1 && ++ ch != EOF && ch != ' ' && ch != CR && ch != LF && + ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){ + ident[idx++] = ch; + ch = fgetc(stream); +@@ -235,7 +238,7 @@ + while ((ch = fgetc(stream)) == ' ' || ch == '\t' ); + + idx = 0; +- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z) ++ while (idx < MAX_NAME_1 && ch != EOF && ch != CR && ch != LF && ch != CTRL_Z) + { + ident[idx++] = ch; + ch = fgetc(stream); diff --git a/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c b/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c index 6a31d7f3443..48dd1f0257d 100644 --- a/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c +++ b/Build/source/libs/t1lib/t1lib-5.1.2/lib/t1lib/parseAFM.c @@ -179,6 +179,8 @@ static char *keyStrings[] = { /*************************** PARSING ROUTINES **************/ +#define MAX_NAME_1 MAX_NAME-1 /* check for buffer overflow */ + /*************************** token *************************/ /* A "AFM File Conventions" tokenizer. That means that it will @@ -198,7 +200,8 @@ static char *token(stream) idx = 0; - while (ch != EOF && ch != ' ' && ch != CR && ch != LF && + while (idx < MAX_NAME_1 && + ch != EOF && ch != ' ' && ch != CR && ch != LF && ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){ ident[idx++] = ch; ch = fgetc(stream); @@ -235,7 +238,7 @@ static char *linetoken(stream) while ((ch = fgetc(stream)) == ' ' || ch == '\t' ); idx = 0; - while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z) + while (idx < MAX_NAME_1 && ch != EOF && ch != CR && ch != LF && ch != CTRL_Z) { ident[idx++] = ch; ch = fgetc(stream); |