summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorJoachim Schrod <jschrod@acm.org>2007-06-28 13:16:06 +0000
committerJoachim Schrod <jschrod@acm.org>2007-06-28 13:16:06 +0000
commit405dd674e335843ede7817de9697c50e696c13bb (patch)
tree11c9588ff570c15e9f2df109fc47d573c441be28 /Build
parentaeefc403ad4b686d3d937865747ed18de040cd4a (diff)
Fix more buffer overflows: Ghostscript command construction, read
from files into static arrays. git-svn-id: svn://tug.org/texlive/trunk@4524 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/dviljk/ChangeLog6
-rw-r--r--Build/source/texk/dviljk/dvi2xx.c22
-rw-r--r--Build/source/texk/dviljk/dvi2xx.h9
3 files changed, 26 insertions, 11 deletions
diff --git a/Build/source/texk/dviljk/ChangeLog b/Build/source/texk/dviljk/ChangeLog
index 08754485510..c51e85e9d6f 100644
--- a/Build/source/texk/dviljk/ChangeLog
+++ b/Build/source/texk/dviljk/ChangeLog
@@ -7,11 +7,17 @@
operations. Fixed also manual string copy operations on special
strings. Fixed array buffer overflow in defpoint and fill special
operations.
+ (DoSpecial): Call of ghostscript for psfile special had also a
+ potential buffer overflow caused by unchecked usage of sprintf.
Bumped version number up to 2.6p3.
* dvi2xx.h: Some fixed sized string arrays are pointers now, they
get dynamically allocated.
+ (GetBytes): Another buffer overflow: Check that the buffer size is
+ sufficient to store the read bytes. That relies on the invariant
+ that the GetBytes macro is always called with an array as argument
+ and not with a pointer.
* config.h: Throw an error if kpathsea is not used. dvi2xx.c
had previously already kpathsea dependencies without protecting
diff --git a/Build/source/texk/dviljk/dvi2xx.c b/Build/source/texk/dviljk/dvi2xx.c
index ac90edd7f5e..6c6459df911 100644
--- a/Build/source/texk/dviljk/dvi2xx.c
+++ b/Build/source/texk/dviljk/dvi2xx.c
@@ -3911,9 +3911,6 @@ int n;
static bool GrayFill = _TRUE;
static long4 p_x[MAX_SPECIAL_DEFPOINTS], p_y[MAX_SPECIAL_DEFPOINTS];
int llx=0, lly=0, urx=0, ury=0, rwi=0, rhi=0;
-#ifdef WIN32
- char *gs_path;
-#endif
str[n] = '\0';
for ( i=0 ; i<MAX_SPECIAL_DEFPOINTS ; i++ )
@@ -4138,6 +4135,8 @@ int n;
int width = urx - llx;
int height = ury - lly;
char cmd[255];
+ char *cmd_format = "%s -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit";
+ char *gs_cmd;
int scale_factor = 3000 * width / rwi;
int adjusted_height = height * 300/scale_factor;
int adjusted_llx = llx * 300/scale_factor;
@@ -4159,15 +4158,18 @@ int n;
BCLOSE( scalef );
#ifdef WIN32
- gs_path = getenv("GS_PATH");
- if (!gs_path)
- gs_path = "gswin32c.exe";
- sprintf(cmd,"%s -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit",
- gs_path, printer, pcl_file, scale_file, psfile);
+ gs_cmd = ( getenv("GS_PATH") || "gswin32c.exe" );
#else
- sprintf(cmd,"gs -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit",
- printer, pcl_file, scale_file, psfile);
+ gs_cmd = "gs";
#endif
+ if ( strlen(cmd_format)-10 + strlen(gs_cmd) + strlen(printer) +
+ strlen(pcl_file) + strlen(scale_file) + strlen(psfile) +1 >
+ sizeof(cmd) ) {
+ Warning ("Ghostscript command for %s would be too long, skipping special", psfile);
+ return;
+ }
+ sprintf(cmd, cmd_format,
+ gs_cmd, printer, pcl_file, scale_file, psfile);
#ifdef DEBUGGS
fprintf(stderr,
"PS-file '%s' w=%d, h=%d, urx=%d, ury=%d, llx=%d, lly=%d, rwi=%d\n",
diff --git a/Build/source/texk/dviljk/dvi2xx.h b/Build/source/texk/dviljk/dvi2xx.h
index 47fc31b36f4..15d37a59efa 100644
--- a/Build/source/texk/dviljk/dvi2xx.h
+++ b/Build/source/texk/dviljk/dvi2xx.h
@@ -282,7 +282,14 @@ char *MFMODE = MFMODE600;
#define VisChar(c) (unsigned char)(c)
#endif
-#define GetBytes(fp,buf,n) read_multi(buf,1,n,fp) /* used to be a function */
+/* Used to be a function. buf is always an array, never a pointer.
+ Without that invariant, we would have to introduce full dynamic
+ memory management in this driver -- probably it would be easier to
+ write a new one. [27 Jun 07 -js] */
+#define GetBytes(fp,buf,n) \
+ ( sizeof(buf) != sizeof(void *) && sizeof(buf) > n ? \
+ read_multi(buf, 1, n, fp) \
+ : Fatal("Try to read %d bytes in an array of size %d", n, sizeof(buf)) )
/**********************************************************************/