avoid potential buffer overrun on erroneous input, and rework test

git-svn-id: svn://tug.org/texlive/trunk@45594 c570f23f-e606-0410-a88d-b1316a301751

2 files changed, 21 insertions, 7 deletions

diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog
index 35f13c6f909..a14b6d3ffe1 100644
--- a/Build/source/texk/kpathsea/ChangeLog
+++ b/Build/source/texk/kpathsea/ChangeLog
@@ -1,3 +1,9 @@
+2017-10-25  Karl Berry  <karl@tug.org>
+
+	* expand.c (brace_expand): do not look past the terminating
+	null with bad input like "a{\0whatever".
+	From Doug McKenna, personal mail, 23oct17.
+
 2017-09-22  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
 
 	* tex-file.c: Use a standard API function GetLongPathName()
diff --git a/Build/source/texk/kpathsea/expand.c b/Build/source/texk/kpathsea/expand.c
index be01fda9ba9..ecf9f26711f 100644
--- a/Build/source/texk/kpathsea/expand.c
+++ b/Build/source/texk/kpathsea/expand.c
@@ -335,6 +335,8 @@ brace_expand (kpathsea kpse, const_string *text)
             /* Check for missing closing brace. */
             if (*p != '}') {
                 WARNING1 ("kpathsea: %s: Unmatched {", *text);
+                --p; /* undo ++p above for the next iteration,
+                        to avoid potential buffer overrun */
             }
             *text = p+1;
         } else if (*p == '$') {
@@ -373,30 +375,36 @@ report_error (format, arg1, arg2)
   fprintf (stderr, "\n");
 }
 
+int
 main (int argc, char **argv)
 {
   char example[256];
+  char *result;
+
   kpse_set_program_name(argv[0], NULL);
+  result = kpse_brace_expand ("a{\0exebad");
+  printf ("%s\n", result);
 
+#if 0 /* if you want an interactive loop */
   for (;;)
     {
-      char *result;
       int i;
 
       fprintf (stderr, "brace_expand> ");
 
-      if ((!fgets (example, 256, stdin)) ||
-          (strncmp (example, "quit", 4) == 0))
+      if ((!fgets (example, 256, stdin))
+          || strncmp (example, "quit", 4) == 0)
         break;
 
       if (strlen (example))
         example[strlen (example) - 1] = 0;
 
       result = kpse_brace_expand (example);
-
-        printf ("%s\n", result);
-
+      printf ("%s\n", result);
     }
+#endif
+  return 0;
+
 }
 
 
@@ -404,6 +412,6 @@ main (int argc, char **argv)
 
 /*
 Local variables:
-standalone-compile-command: "gcc -g -I. -I.. -DTEST expand.c kpathsea.a"
+standalone-compile-command: "gcc -g -DMAKE_KPSE_DLL -I. -I.. -I$kp -I$kp/.. -DTEST $kp/expand.c .libs/libkpathsea.a"
 end:
 */