diff options
| author | Karl Berry <karl@freefriends.org> | 2010-03-25 23:55:25 +0000 |
|---|---|---|
| committer | Karl Berry <karl@freefriends.org> | 2010-03-25 23:55:25 +0000 |
| commit | 5c71f7dcce52cab382d58624cc13df5caf788723 (patch) | |
| tree | 81e2f774f1edce6aaf2aec13dc9adc8579f76da0 /Build | |
| parent | f8e66706cc8008765a0c876e6f4a8f58336fd6ec (diff) | |
avoid integer overflow, CVE-2010-0739
git-svn-id: svn://tug.org/texlive/trunk@17559 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
| -rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 6 | ||||
| -rw-r--r-- | Build/source/texk/dvipsk/dospecial.c | 6 |
2 files changed, 12 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 8fb408fca49..a86425f0655 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,9 @@ +2010-03-26 Karl Berry <karl@tug.org> + + * dospecial.c (predospecial): avoid seg fault from integer overflow. + CVE-2010-0739, found by Marc Schoenefeld, patch prepared + by Jindrich Novy. + 2010-02-26 Karl Berry <karl@tug.org> * search.c (selfautoloc_prog, quote_name): remove kpse_ prefix for diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c index 8f0a352d407..63fefbf4ac8 100644 --- a/Build/source/texk/dvipsk/dospecial.c +++ b/Build/source/texk/dvipsk/dospecial.c @@ -297,6 +297,12 @@ predospecial(integer numbytes, Boolean scanning) static int omega_specials = 0; if (nextstring + numbytes > maxstring) { + if (numbytes < 0 + || (numbytes > 0 && 2 > INT_MAX / numbytes) + || 2 * numbytes > 1000 + 2 * numbytes) { + error("! Integer overflow in predospecial"); + exit(1); + } p = nextstring = mymalloc(1000 + 2 * numbytes) ; maxstring = nextstring + 2 * numbytes + 700 ; } |