diff options
| -rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 6 | ||||
| -rw-r--r-- | Build/source/texk/dvipsk/emspecial.c | 16 |
2 files changed, 20 insertions, 2 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index e92d8b7359f..f3a3fc8bb26 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,9 @@ +2019-03-30 Karl Berry <karl@freefriends.org> + + * emspecial.c (bmpgraph): avoid writing after isblack + if clrtablesize is >256. + Report from Andy Nguyen of ETH Zurich. + 2019-03-29 Karl Berry <karl@freefriends.org> * loadfont.c (errbuf), diff --git a/Build/source/texk/dvipsk/emspecial.c b/Build/source/texk/dvipsk/emspecial.c index c96298ce267..f25b1eb5a1c 100644 --- a/Build/source/texk/dvipsk/emspecial.c +++ b/Build/source/texk/dvipsk/emspecial.c @@ -1,4 +1,4 @@ -/* +/* $Id$ * emspecial.c * This routine handles the emTeX special commands. */ @@ -1142,7 +1142,8 @@ bmpgraph(FILE *f, char *filename, float emwidth, float emheight) struct bitmapfileheader bmfh; struct bitmapinfoheader bmih; - unsigned char isblack[256]; + #define ISBLACKSIZ 256 + unsigned char isblack[ISBLACKSIZ]; unsigned char rr; unsigned char gg; unsigned char bb; @@ -1251,6 +1252,17 @@ bmpgraph(FILE *f, char *filename, float emwidth, float emheight) else clrtablesize = bmih.clrused; + if (clrtablesize > ISBLACKSIZ) { + /* This is wrong, since we won't read the whole file below. + But we can't give correct output without more work, + and it's unlikely these specials are still in use. */ + sprintf(errbuf, + "em color table size (%d) larger than %d; output incorrect", + clrtablesize, ISBLACKSIZ); + specerror(errbuf); + clrtablesize = ISBLACKSIZ; + } + /* read in the color table */ for (i = 0; i < clrtablesize; i++) { bb = fgetc(f); |