diff options
author | Hironobu Yamashita <h.y.acetaminophen@gmail.com> | 2023-08-18 15:42:55 +0000 |
---|---|---|
committer | Hironobu Yamashita <h.y.acetaminophen@gmail.com> | 2023-08-18 15:42:55 +0000 |
commit | e5a1f72fc714b143dad55f6d0d71e5e69947dac1 (patch) | |
tree | 3e399175b8b9ea8f2c17bb62691d76c5e357dedb /Build | |
parent | 82f273487357890418ab50d434c84b94d7c297d0 (diff) |
aleph: introduce expand_depth to avoid overflow
based on tex-k list 2020-05-27
git-svn-id: svn://tug.org/texlive/trunk@67969 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build')
-rw-r--r-- | Build/source/texk/web2c/alephdir/ChangeLog | 7 | ||||
-rw-r--r-- | Build/source/texk/web2c/alephdir/com16bit.ch | 43 | ||||
-rw-r--r-- | Build/source/texk/web2c/alephdir/comsrcspec.ch | 2 | ||||
-rw-r--r-- | Build/source/texk/web2c/alephdir/eobase.ch | 3 |
4 files changed, 53 insertions, 2 deletions
diff --git a/Build/source/texk/web2c/alephdir/ChangeLog b/Build/source/texk/web2c/alephdir/ChangeLog index 41ddddaf71e..97f5be72980 100644 --- a/Build/source/texk/web2c/alephdir/ChangeLog +++ b/Build/source/texk/web2c/alephdir/ChangeLog @@ -1,3 +1,10 @@ +2023-08-18 Hironobu Yamashita <h.y.acetaminophen@gmail.com> + + * com16bit.ch: Sync with tex.ch changes: + - 2008-01-02 r6024 introduce expand_depth. + * eobase.ch: Sync with etex.ch changes: + - 2021-02-22 r57850 avoid "expansion depth" overflow. + 2023-03-09 Karl Berry <karl@tug.org> * TL'23 release. diff --git a/Build/source/texk/web2c/alephdir/com16bit.ch b/Build/source/texk/web2c/alephdir/com16bit.ch index 7af53f518c2..ff01fdc5a0e 100644 --- a/Build/source/texk/web2c/alephdir/com16bit.ch +++ b/Build/source/texk/web2c/alephdir/com16bit.ch @@ -230,6 +230,9 @@ if ini_version then @!sup_hyph_size = ssup_hyph_size; @!inf_hyph_size = iinf_hyphen_size; {Must be not less than |hyph_prime|!} + +@!inf_expand_depth = 10; +@!sup_expand_depth = 10000000; @z @x [1.12] l.427 - Constants that are WEB numeric macros. @@ -466,6 +469,7 @@ tini@/ @!save_size:integer; {space for saving values outside of current group; must be at most |max_halfword|} @!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8} +@!expand_depth:integer; {limits recursive calls to the |expand| procedure} @!quoted_filename:boolean; {current filename is quoted} @z @@ -1039,6 +1043,22 @@ begin input_ptr:=0; max_in_stack:=0; source_filename_stack[0]:=0;full_source_filename_stack[0]:=0; @z +@x [25.366] l.7672 - expansion depth overflow +begin cv_backup:=cur_val; cvl_backup:=cur_val_level; radix_backup:=radix; +@y +begin +incr(expand_depth_count); +if expand_depth_count>=expand_depth then overflow("expansion depth",expand_depth); +cv_backup:=cur_val; cvl_backup:=cur_val_level; radix_backup:=radix; +@z + +@x [25.366] l.7678 - expansion depth overflow +cur_order:=co_backup; link(backup_head):=backup_backup; +@y +cur_order:=co_backup; link(backup_head):=backup_backup; +decr(expand_depth_count); +@z + % Original report: https://tex.stackexchange.com/questions/609423 % TeX bug entry: https://tug.org/texmfbug/newbug.html#B155endwrite @x [25.369] l.7717 - disallow \noexpand\endwrite @@ -2564,6 +2584,7 @@ begin @!{|start_here|} setup_bound_var (79)('error_line')(error_line); setup_bound_var (50)('half_error_line')(half_error_line); setup_bound_var (79)('max_print_line')(max_print_line); + setup_bound_var (10000)('expand_depth')(expand_depth); const_chk (main_memory); @+init if ini_version then begin @@ -3021,5 +3042,27 @@ begin get_nullstr := ""; end; + +@* \[54/web2c] More changes for Web2c. +% Related to [25.366] expansion depth check +Sometimes, recursive calls to the |expand| routine may +cause exhaustion of the run-time calling stack, resulting in +forced execution stops by the operating system. To diminish the chance +of this happening, a counter is used to keep track of the recursion +depth, in conjunction with a constant called |expand_depth|. + +This does not catch all possible infinite recursion loops, just the ones +that exhaust the application calling stack. The actual maximum value of +|expand_depth| is outside of our control, but the initial setting of +|10000| should be enough to prevent problems. +@^system dependencies@> + +@<Global...@>= +expand_depth_count:integer; + +@ @<Set init...@>= +expand_depth_count:=0; + + @* \[54] System-dependent changes. @z diff --git a/Build/source/texk/web2c/alephdir/comsrcspec.ch b/Build/source/texk/web2c/alephdir/comsrcspec.ch index 9a1680c4a6f..0e6a0ce90be 100644 --- a/Build/source/texk/web2c/alephdir/comsrcspec.ch +++ b/Build/source/texk/web2c/alephdir/comsrcspec.ch @@ -1,8 +1,6 @@ @x -@!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8} @!quoted_filename:boolean; {current filename is quoted} @y -@!dvi_buf_size:integer; {size of the output buffer; must be a multiple of 8} @!quoted_filename:boolean; {current filename is quoted} @!special_loc:pointer; @!special_token:halfword; diff --git a/Build/source/texk/web2c/alephdir/eobase.ch b/Build/source/texk/web2c/alephdir/eobase.ch index 080b99c50fc..3a6bda1630f 100644 --- a/Build/source/texk/web2c/alephdir/eobase.ch +++ b/Build/source/texk/web2c/alephdir/eobase.ch @@ -3586,7 +3586,10 @@ var a,@!b:boolean; {saved values of |arith_error|} @!p:pointer; {top of expression stack} @!q:pointer; {for stack manipulations} begin l:=cur_val_level; a:=arith_error; b:=false; p:=null; +incr(expand_depth_count); +if expand_depth_count>=expand_depth then overflow("expansion depth",expand_depth); @<Scan and evaluate an expression |e| of type |l|@>; +decr(expand_depth_count); if b then begin print_err("Arithmetic overflow"); @.Arithmetic overflow@> |