diff options
| -rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 6 | ||||
| -rw-r--r-- | Build/source/texk/dvipsk/dospecial.c | 6 |
2 files changed, 12 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 8fb408fca49..a86425f0655 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,9 @@ +2010-03-26 Karl Berry <karl@tug.org> + + * dospecial.c (predospecial): avoid seg fault from integer overflow. + CVE-2010-0739, found by Marc Schoenefeld, patch prepared + by Jindrich Novy. + 2010-02-26 Karl Berry <karl@tug.org> * search.c (selfautoloc_prog, quote_name): remove kpse_ prefix for diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c index 8f0a352d407..63fefbf4ac8 100644 --- a/Build/source/texk/dvipsk/dospecial.c +++ b/Build/source/texk/dvipsk/dospecial.c @@ -297,6 +297,12 @@ predospecial(integer numbytes, Boolean scanning) static int omega_specials = 0; if (nextstring + numbytes > maxstring) { + if (numbytes < 0 + || (numbytes > 0 && 2 > INT_MAX / numbytes) + || 2 * numbytes > 1000 + 2 * numbytes) { + error("! Integer overflow in predospecial"); + exit(1); + } p = nextstring = mymalloc(1000 + 2 * numbytes) ; maxstring = nextstring + 2 * numbytes + 700 ; } |