diff options
| author | Hironobu Yamashita <h.y.acetaminophen@gmail.com> | 2019-02-19 11:35:57 +0000 |
|---|---|---|
| committer | Hironobu Yamashita <h.y.acetaminophen@gmail.com> | 2019-02-19 11:35:57 +0000 |
| commit | d816f9205a7a69547bf25b92e4d60187f5381681 (patch) | |
| tree | 9f1308e0fe53875bbec3abc08f1a3789ebab00fa /Build | |
| parent | f6e0f1432025529ef19587111f380bd8e74e03ef (diff) | |
makejvf: more security fix
git-svn-id: svn://tug.org/texlive/trunk@50057 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
| -rw-r--r-- | Build/source/texk/makejvf/ChangeLog | 3 | ||||
| -rw-r--r-- | Build/source/texk/makejvf/tfmread.c | 6 | ||||
| -rw-r--r-- | Build/source/texk/makejvf/write.c | 4 |
3 files changed, 11 insertions, 2 deletions
diff --git a/Build/source/texk/makejvf/ChangeLog b/Build/source/texk/makejvf/ChangeLog index 958ec1eb175..d600c26fba7 100644 --- a/Build/source/texk/makejvf/ChangeLog +++ b/Build/source/texk/makejvf/ChangeLog @@ -1,6 +1,7 @@ 2019-02-19 Hironobu Yamashita <h.y.acetaminophen@gmail.com> - * tfmread.c, tool.c: Avoid compiler warnings. + * tfmread.c, tool.c: Avoid compiler warnings for fgetc(). + * tfmread.c, write.c: Security fix for too long file names. * write.c (writevfu): Removed unnecessary conditionals. Thanks to @ngothan for a report by covscan. https://github.com/TeX-Live/texlive-source/issues/11 diff --git a/Build/source/texk/makejvf/tfmread.c b/Build/source/texk/makejvf/tfmread.c index f7ce53b6224..275ecd9164b 100644 --- a/Build/source/texk/makejvf/tfmread.c +++ b/Build/source/texk/makejvf/tfmread.c @@ -96,6 +96,10 @@ int tfmget(char *name) char nbuff[1024]; FILE *fp; + if (strlen(name) >= 1020) { /* <buffer size> - ".tfm" */ + fprintf(stderr,"Too long input file name.\n"); + exit(1); + } strcpy(nbuff,name); fp = fopen(nbuff,"rb"); if (fp == NULL) { @@ -103,7 +107,7 @@ int tfmget(char *name) fp = fopen(nbuff,"rb"); if (fp == NULL) { fprintf(stderr,"%s is not found.\n",name); - exit(0); + exit(1); } } diff --git a/Build/source/texk/makejvf/write.c b/Build/source/texk/makejvf/write.c index 0b141ade7b9..34eeeaf0074 100644 --- a/Build/source/texk/makejvf/write.c +++ b/Build/source/texk/makejvf/write.c @@ -794,6 +794,10 @@ void maketfm(char *name) FILE *fp; int i; + if (strlen(name) >= 252) { /* <buffer size> - ".tfm" */ + fprintf(stderr,"Too long output file name.\n"); + exit(1); + } strcpy(nbuf,name); strcat(nbuf,".tfm"); fp = fopen(nbuf,"wb"); |