summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorAkira Kakuto <kakuto@fuk.kindai.ac.jp>2021-03-13 21:26:22 +0000
committerAkira Kakuto <kakuto@fuk.kindai.ac.jp>2021-03-13 21:26:22 +0000
commit7ec02a18e61d4ee12d12f645e0f1502417bd2d64 (patch)
tree68c0e1ae8b7311669593b5a7eed5336c5cabc849 /Build
parentf9ca12695b4f3101c3c96dbe5e5ec8403d38bd2e (diff)
dvipdfmx: Do not allow directory separators in an optarg in an option -i optarg for security reason.
git-svn-id: svn://tug.org/texlive/trunk@58324 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/dvipdfm-x/ChangeLog5
-rw-r--r--Build/source/texk/dvipdfm-x/dvipdfmx.c13
2 files changed, 17 insertions, 1 deletions
diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog
index b807dd32795..532be677e40 100644
--- a/Build/source/texk/dvipdfm-x/ChangeLog
+++ b/Build/source/texk/dvipdfm-x/ChangeLog
@@ -1,3 +1,8 @@
+2021-03-14 Akira Kakuto <kakuto@w32tex.org>
+
+ * dvipdfmx.c: Do not allow directory separators in an optarg
+ in an option -i optarg for security reason.
+
2021-03-05 Akira Kakuto <kakuto@w32tex.org>
* pdfdev.c: Correct the incomplete fix on 2021-03-04.
diff --git a/Build/source/texk/dvipdfm-x/dvipdfmx.c b/Build/source/texk/dvipdfm-x/dvipdfmx.c
index f56c1d44ed3..3a4dfa35364 100644
--- a/Build/source/texk/dvipdfm-x/dvipdfmx.c
+++ b/Build/source/texk/dvipdfm-x/dvipdfmx.c
@@ -614,8 +614,19 @@ do_args_second_pass (int argc, char *argv[], const char *source, int unsafe)
case 'i':
{
+/*
+ -i ./foo.cfg, -i /usr/abc/foo.cfg, etc. are not allowed for
+ security reason.
+*/
+ char *dir1, *dir2;
int optind_save= optind;
- read_config_file(optarg);
+ dir1 = strrchr(optarg, '/');
+ dir2 = strrchr(optarg, '\\');
+ if (dir1 || dir2) {
+ WARN("%s is not allowed. Default configuration file is used.", optarg);
+ } else {
+ read_config_file(optarg);
+ }
optind = optind_save;
break;
}