diff options
Diffstat (limited to 'Build/source/texk/web2c/luatexdir')
-rw-r--r-- | Build/source/texk/web2c/luatexdir/ChangeLog | 5 | ||||
-rw-r--r-- | Build/source/texk/web2c/luatexdir/font/writet1.w | 2 |
2 files changed, 7 insertions, 0 deletions
diff --git a/Build/source/texk/web2c/luatexdir/ChangeLog b/Build/source/texk/web2c/luatexdir/ChangeLog index 94cbfc3e6d5..2948f1cb75f 100644 --- a/Build/source/texk/web2c/luatexdir/ChangeLog +++ b/Build/source/texk/web2c/luatexdir/ChangeLog @@ -1,3 +1,8 @@ +2018-09-18 Norbert Preining <preining@logic.at> + + * fonts/writet1.w (t1_check_unusual_charstring): protect against + buffer overflow. + 2017-11-02 Luigi Scarso <luigi.scarso@gmail.com> LuaFilesystem 1.7.0 diff --git a/Build/source/texk/web2c/luatexdir/font/writet1.w b/Build/source/texk/web2c/luatexdir/font/writet1.w index fc1a89cd547..02786286585 100644 --- a/Build/source/texk/web2c/luatexdir/font/writet1.w +++ b/Build/source/texk/web2c/luatexdir/font/writet1.w @@ -1625,7 +1625,9 @@ static void t1_check_unusual_charstring(void) if (sscanf(p, "%i", &i) != 1) { strcpy(t1_buf_array, t1_line_array); t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } |