More fix to the previous fix for tt_cmap.c. Fix for a possible problem in cid.c. (S. Hirara)

git-svn-id: svn://tug.org/texlive/trunk@55999 c570f23f-e606-0410-a88d-b1316a301751

4 files changed, 36 insertions, 12 deletions

diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog
index c1d1176e8db..1a3acabefee 100644
--- a/Build/source/texk/dvipdfm-x/ChangeLog
+++ b/Build/source/texk/dvipdfm-x/ChangeLog
@@ -1,3 +1,9 @@
+2020-07-31  Shunsaku Hirata  <shunsaku.hirata74@gmail.com>
+
+	* cid.c: Avoid accessing array elements exceeding max array index.
+	* spc_pdfm.c: Check array elements also for to-unicode conversion.
+	* tt_cmap.c: Additional changes are required for the previous CMap name fix.
+
 2020-07-29  Shunsaku Hirata  <shunsaku.hirata74@gmail.com>
 
 	* spc_pdfm.c: Improve codes in unicode conversion and
diff --git a/Build/source/texk/dvipdfm-x/cid.c b/Build/source/texk/dvipdfm-x/cid.c
index 517b21d22b6..42554ad3123 100644
--- a/Build/source/texk/dvipdfm-x/cid.c
+++ b/Build/source/texk/dvipdfm-x/cid.c
@@ -1,6 +1,6 @@
 /* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks.
 
-    Copyright (C) 2002-2018 by Jin-Hwan Cho and Shunsaku Hirata,
+    Copyright (C) 2002-2020 by Jin-Hwan Cho and Shunsaku Hirata,
     the dvipdfmx project team.
     
     This program is free software; you can redistribute it and/or modify
@@ -80,6 +80,7 @@ static struct {
   {NULL,    NULL,       { 0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0}}
 };
+#define SUP_IDX_MAX 20
 #define UCS_CC    0
 #define ACC_START 1
 #define ACC_END   4
@@ -709,6 +710,7 @@ get_cidsysinfo (const char *map_name, fontmap_opt *fmap_opt)
   int i, csi_idx = -1, n, m;
 
   sup_idx = pdf_get_version() - 10;
+  sup_idx = (sup_idx > SUP_IDX_MAX) ? SUP_IDX_MAX : sup_idx;
 
   if (!fmap_opt || !fmap_opt->charcoll)
     return NULL;
diff --git a/Build/source/texk/dvipdfm-x/spc_pdfm.c b/Build/source/texk/dvipdfm-x/spc_pdfm.c
index f13aaef9d04..d6a72fe2c33 100644
--- a/Build/source/texk/dvipdfm-x/spc_pdfm.c
+++ b/Build/source/texk/dvipdfm-x/spc_pdfm.c
@@ -590,7 +590,7 @@ need_reencode (pdf_obj *kp, pdf_obj *vp, struct tounicode *cd)
 }
 
 static int
-modstrings (pdf_obj *kp, pdf_obj *vp, void *dp)
+modify_strings (pdf_obj *kp, pdf_obj *vp, void *dp)
 {
   int               r = 0; /* continue */
   struct tounicode *cd = dp;
@@ -598,7 +598,7 @@ modstrings (pdf_obj *kp, pdf_obj *vp, void *dp)
   ASSERT( pdf_obj_typeof(kp) == PDF_NAME );
 
   switch (pdf_obj_typeof(vp)) {
-  case  PDF_STRING:
+  case PDF_STRING:
     if (cd && cd->cmap_id >= 0 && cd->taintkeys) {
       CMap *cmap = CMap_cache_get(cd->cmap_id);
       if (need_reencode(kp, vp, cd))
@@ -610,11 +610,24 @@ modstrings (pdf_obj *kp, pdf_obj *vp, void *dp)
     if (r < 0) /* error occured... */
       WARN("Input string conversion (to UTF16BE) failed for %s...", pdf_name_value(kp));
     break;
-  case  PDF_DICT:
-    r = pdf_foreach_dict(vp, modstrings, dp);
+  /* Array elements are also checked. */
+  case PDF_ARRAY:
+    {
+      int i;
+      for (i = 0; i < pdf_array_length(vp); i++) {
+        pdf_obj *obj;
+        obj = pdf_get_array(vp, i);
+        r   = modify_strings(kp, obj, dp);
+        if (r < 0)
+          break;
+      }
+    }
     break;
-  case  PDF_STREAM:
-    r = pdf_foreach_dict(pdf_stream_dict(vp), modstrings, dp);
+  case PDF_DICT:
+    r = pdf_foreach_dict(vp, modify_strings, dp);
+    break;
+  case PDF_STREAM:
+    r = pdf_foreach_dict(pdf_stream_dict(vp), modify_strings, dp);
     break;
   }
 
@@ -647,7 +660,7 @@ parse_pdf_dict_with_tounicode (const char **pp, const char *endptr, struct touni
         pdf_release_obj(dict);
         dict = NULL;
       } else {
-        pdf_foreach_dict(dict, modstrings, cd);
+        pdf_foreach_dict(dict, modify_strings, cd);
       }
     }
   }
diff --git a/Build/source/texk/dvipdfm-x/tt_cmap.c b/Build/source/texk/dvipdfm-x/tt_cmap.c
index 3e9fea7274d..113d11699a5 100644
--- a/Build/source/texk/dvipdfm-x/tt_cmap.c
+++ b/Build/source/texk/dvipdfm-x/tt_cmap.c
@@ -1605,17 +1605,20 @@ otf_try_load_GID_to_CID_map (const char *map_name, int ttc_index, int wmode)
   ULONG       offset      = 0;
   char       *cmap_name   = NULL;
   FILE       *fp          = NULL;
+  int         len;
 
   if (!map_name)
     return -1;
 
-  if (ttc_index > 999 || ttc_index < 0) {
-    return -1; /* Sorry for this... */
+  if (ttc_index > 0xFFFFFFFFu || ttc_index < 0) {
+    return -1;
   }
 
   /* Check if already loaded */
-  cmap_name = NEW(strlen(map_name)+strlen("-GID")+5, char);
-  sprintf(cmap_name, "%s:%d-%d-GID", map_name, ttc_index, wmode);
+  len = strlen(map_name) + 32;
+  cmap_name = NEW(len, char);
+  snprintf(cmap_name, len, "%s:%d-%1d-GID", map_name, ttc_index, wmode);
+  cmap_name[len-1] = '\0';
   cmap_id = CMap_cache_find(cmap_name);
   if (cmap_id >= 0) {
     RELEASE(cmap_name);