summaryrefslogtreecommitdiff
path: root/Build
diff options
context:
space:
mode:
authorHironobu Yamashita <h.y.acetaminophen@gmail.com>2019-02-19 11:35:57 +0000
committerHironobu Yamashita <h.y.acetaminophen@gmail.com>2019-02-19 11:35:57 +0000
commitd816f9205a7a69547bf25b92e4d60187f5381681 (patch)
tree9f1308e0fe53875bbec3abc08f1a3789ebab00fa /Build
parentf6e0f1432025529ef19587111f380bd8e74e03ef (diff)
makejvf: more security fix
git-svn-id: svn://tug.org/texlive/trunk@50057 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r--Build/source/texk/makejvf/ChangeLog3
-rw-r--r--Build/source/texk/makejvf/tfmread.c6
-rw-r--r--Build/source/texk/makejvf/write.c4
3 files changed, 11 insertions, 2 deletions
diff --git a/Build/source/texk/makejvf/ChangeLog b/Build/source/texk/makejvf/ChangeLog
index 958ec1eb175..d600c26fba7 100644
--- a/Build/source/texk/makejvf/ChangeLog
+++ b/Build/source/texk/makejvf/ChangeLog
@@ -1,6 +1,7 @@
2019-02-19 Hironobu Yamashita <h.y.acetaminophen@gmail.com>
- * tfmread.c, tool.c: Avoid compiler warnings.
+ * tfmread.c, tool.c: Avoid compiler warnings for fgetc().
+ * tfmread.c, write.c: Security fix for too long file names.
* write.c (writevfu): Removed unnecessary conditionals.
Thanks to @ngothan for a report by covscan.
https://github.com/TeX-Live/texlive-source/issues/11
diff --git a/Build/source/texk/makejvf/tfmread.c b/Build/source/texk/makejvf/tfmread.c
index f7ce53b6224..275ecd9164b 100644
--- a/Build/source/texk/makejvf/tfmread.c
+++ b/Build/source/texk/makejvf/tfmread.c
@@ -96,6 +96,10 @@ int tfmget(char *name)
char nbuff[1024];
FILE *fp;
+ if (strlen(name) >= 1020) { /* <buffer size> - ".tfm" */
+ fprintf(stderr,"Too long input file name.\n");
+ exit(1);
+ }
strcpy(nbuff,name);
fp = fopen(nbuff,"rb");
if (fp == NULL) {
@@ -103,7 +107,7 @@ int tfmget(char *name)
fp = fopen(nbuff,"rb");
if (fp == NULL) {
fprintf(stderr,"%s is not found.\n",name);
- exit(0);
+ exit(1);
}
}
diff --git a/Build/source/texk/makejvf/write.c b/Build/source/texk/makejvf/write.c
index 0b141ade7b9..34eeeaf0074 100644
--- a/Build/source/texk/makejvf/write.c
+++ b/Build/source/texk/makejvf/write.c
@@ -794,6 +794,10 @@ void maketfm(char *name)
FILE *fp;
int i;
+ if (strlen(name) >= 252) { /* <buffer size> - ".tfm" */
+ fprintf(stderr,"Too long output file name.\n");
+ exit(1);
+ }
strcpy(nbuf,name);
strcat(nbuf,".tfm");
fp = fopen(nbuf,"wb");