summaryrefslogtreecommitdiff
path: root/Master
diff options
context:
space:
mode:
authorAkira Kakuto <kakuto@fuk.kindai.ac.jp>2018-03-12 20:41:15 +0000
committerAkira Kakuto <kakuto@fuk.kindai.ac.jp>2018-03-12 20:41:15 +0000
commit66c916d7b780f33480bc05e78c302230216a02ea (patch)
treeb84c9e063213c7bfa7817be341d01057a84c75c9 /Master
parent06a29c260a39508ef0fd55b0a6a42a6eddaaf912 (diff)
make search path of scripts in w32_wrapper more secure
git-svn-id: svn://tug.org/texlive/trunk@46933 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Master')
-rwxr-xr-xMaster/bin/win32/runscript.tlu44
1 files changed, 43 insertions, 1 deletions
diff --git a/Master/bin/win32/runscript.tlu b/Master/bin/win32/runscript.tlu
index f0e1025d520..65d064114cf 100755
--- a/Master/bin/win32/runscript.tlu
+++ b/Master/bin/win32/runscript.tlu
@@ -262,6 +262,8 @@ local docstr = [[
2017/05/06
- introduce sys_user_progs, make checks for updmap/fmtutil
use sys_user_progs instead, add kanji-config-updmap
+ 2018/03/12
+ - introduce a new function gettexmfdist() for security.
]]
-- HELPER SUBROUTINES --
@@ -386,6 +388,44 @@ local function mkdir_plus(dir)
end
end
+--
+-- return the TEXMFDIST directory in TeX Live
+--
+local function gettexmfdist()
+ local ffi = require("ffi")
+ ffi.cdef[[
+ typedef void* HANDLE;
+ typedef char* LPCSTR;
+ int GetModuleFileNameA(HANDLE h, LPCSTR l, int i);
+ HANDLE GetModuleHandleA(const char *a);
+ ]]
+ local buffer = ffi.new("char[?]", 512)
+ local runscripthandle = ffi.C.GetModuleHandleA("runscript.dll")
+ if runscripthandle == nil then
+ return nil
+ end
+ local err = ffi.C.GetModuleFileNameA(runscripthandle, buffer, 256)
+ if err == nil then
+ return nil
+ end
+ local str = ffi.string(buffer)
+ str = string.gsub(str, "\\","/")
+ str = string.reverse(str)
+ local a, b
+-- remove /runscript.dll
+ a, b = string.find(str, '/', 1, true)
+ str = string.sub(str,a+1)
+-- remove /win32
+ a, b = string.find(str, '/', 1, true)
+ str = string.sub(str,a+1)
+-- remove /bin
+ a, b = string.find(str, '/', 1, true)
+ str = string.sub(str,a+1)
+ str = string.reverse(str)
+ str = str .. '/texmf-dist'
+ return str
+end
+
-- MAIN_CHUNK -- encapsulated in a function for more robust execution with pcall
local function MAIN_CHUNK()
@@ -472,7 +512,9 @@ kpse.set_program_name(lua_binary, progname)
-- various dir-vars
local TEXDIR = kpse.var_value('SELFAUTOPARENT')
-local TEXMFDIST = kpse.var_value('TEXMFDIST')
+-- local TEXMFDIST = kpse.var_value('TEXMFDIST')
+-- use a new function to obtain TEXMFDIST
+local TEXMFDIST = gettexmfdist()
local BINDIR = kpse.var_value('SELFAUTOLOC')
local PATH = os.getenv('PATH') or ''