summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--Build/source/texk/dvipng/dvipng-src/ChangeLog9
-rw-r--r--Build/source/texk/dvipng/dvipng-src/dvi.c6
-rw-r--r--Build/source/texk/dvipng/dvipng-src/tfm.c17
3 files changed, 30 insertions, 2 deletions
diff --git a/Build/source/texk/dvipng/dvipng-src/ChangeLog b/Build/source/texk/dvipng/dvipng-src/ChangeLog
index 6fb7cd99a5e..55954f623ed 100644
--- a/Build/source/texk/dvipng/dvipng-src/ChangeLog
+++ b/Build/source/texk/dvipng/dvipng-src/ChangeLog
@@ -1,3 +1,12 @@
+2019-04-04 Karl Berry <karl@freefriends.org>
+
+ * tfm.c (ReadTFM): check for reading outside file bounds.
+ Report from Andy Nguyen of ETH Zurich.
+
+ * dvi.c (DVIGetCommand): check for (unsigned value) overflow
+ so we don't fail to realloc buffer if needed.
+ Report from Andy Nguyen of ETH Zurich, found using afl-fuzz.
+
2015-03-01 Jan-Åke Larsson <jan-ake.larsson@liu.se>
* RELEASE: Release 1.15
diff --git a/Build/source/texk/dvipng/dvipng-src/dvi.c b/Build/source/texk/dvipng/dvipng-src/dvi.c
index 7221c315c00..283088d8188 100644
--- a/Build/source/texk/dvipng/dvipng-src/dvi.c
+++ b/Build/source/texk/dvipng/dvipng-src/dvi.c
@@ -208,6 +208,12 @@ unsigned char* DVIGetCommand(struct dvi_data* dvi)
break;
}
if (strlength > 0) { /* Read string */
+ if (strlength == UINT32_MAX
+ || strlength+1 > UINT32_MAX - (uint32_t)length) {
+ /* Have to check else we might not realloc buffer. */
+ Fatal("strlength %u + 1 + length %u would overflow",
+ strlength, (uint32_t)length);
+ }
if (strlength+1 + (uint32_t)length > commlen) {
/* string + command length exceeds that of buffer */
commlen=strlength+1 + (uint32_t)length;
diff --git a/Build/source/texk/dvipng/dvipng-src/tfm.c b/Build/source/texk/dvipng/dvipng-src/tfm.c
index 05c4b8a5d8b..549ef214fab 100644
--- a/Build/source/texk/dvipng/dvipng-src/tfm.c
+++ b/Build/source/texk/dvipng/dvipng-src/tfm.c
@@ -36,6 +36,9 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname)
("\n OPEN METRICS:\t'%s'", tfmname));
if (MmapFile(tfmname,&fmmap)) return(false);
position=(unsigned char*)fmmap.data;
+ if (fmmap.size < 10) {
+ Fatal("tfm file %s much too short (%u)", tfmname,fmmap.size);
+ }
lh = UNumRead(position+2,2);
bc = UNumRead(position+4,2);
ec = UNumRead(position+6,2);
@@ -45,6 +48,9 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname)
if ((width=malloc(nw*sizeof(dviunits)))==NULL)
Fatal("cannot allocate memory for TFM widths");
c=0;
+ if (fmmap.size < 24+(lh+ec-bc+1)*4) {
+ Fatal("tfm file %s ends in width table (size %u)", tfmname,fmmap.size);
+ }
position=position+24+(lh+ec-bc+1)*4;
while( c < nw ) {
width[c] = SNumRead(position,4);
@@ -53,6 +59,9 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname)
}
/* Read char widths */
c=bc;
+ if (fmmap.size < 24+lh*4) {
+ Fatal("tfm file %s ends in widths (size %u)", tfmname,fmmap.size);
+ }
position=(unsigned char*)fmmap.data+24+lh*4;
while(c <= ec) {
DEBUG_PRINT(DEBUG_TFM,("\n@%ld TFM METRICS:\t",
@@ -60,13 +69,17 @@ bool ReadTFM(struct font_entry * tfontp, char* tfmname)
if ((tcharptr=malloc(sizeof(struct char_entry)))==NULL)
Fatal("cannot allocate memory for TFM char entry");
tcharptr->data=NULL;
- tcharptr->tfmw=width[*position];
+ if (*position < nw) {
+ tcharptr->tfmw=width[*position];
+ } else {
+ Fatal("position out of bounds for width %u, char %u",*position,c);
+ }
DEBUG_PRINT(DEBUG_TFM,("%d [%d] %d",c,*position,tcharptr->tfmw));
tcharptr->tfmw = (dviunits)
((int64_t) tcharptr->tfmw * tfontp->s / (1 << 20));
DEBUG_PRINT(DEBUG_TFM,(" (%d)",tcharptr->tfmw));
if (c >= NFNTCHARS) /* Only positive for now */
- Fatal("tfm file %s exceeds char numbering limit",tfmname);
+ Fatal("tfm file %s exceeds char numbering limit %u",tfmname,NFNTCHARS);
tfontp->chr[c] = tcharptr;
c++;
position += 4;