diff options
Diffstat (limited to 'Build/source')
| -rw-r--r-- | Build/source/texk/kpathsea/ChangeLog | 6 | ||||
| -rw-r--r-- | Build/source/texk/kpathsea/expand.c | 22 |
2 files changed, 21 insertions, 7 deletions
diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index 35f13c6f909..a14b6d3ffe1 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,9 @@ +2017-10-25 Karl Berry <karl@tug.org> + + * expand.c (brace_expand): do not look past the terminating + null with bad input like "a{\0whatever". + From Doug McKenna, personal mail, 23oct17. + 2017-09-22 Akira Kakuto <kakuto@fuk.kindai.ac.jp> * tex-file.c: Use a standard API function GetLongPathName() diff --git a/Build/source/texk/kpathsea/expand.c b/Build/source/texk/kpathsea/expand.c index be01fda9ba9..ecf9f26711f 100644 --- a/Build/source/texk/kpathsea/expand.c +++ b/Build/source/texk/kpathsea/expand.c @@ -335,6 +335,8 @@ brace_expand (kpathsea kpse, const_string *text) /* Check for missing closing brace. */ if (*p != '}') { WARNING1 ("kpathsea: %s: Unmatched {", *text); + --p; /* undo ++p above for the next iteration, + to avoid potential buffer overrun */ } *text = p+1; } else if (*p == '$') { @@ -373,30 +375,36 @@ report_error (format, arg1, arg2) fprintf (stderr, "\n"); } +int main (int argc, char **argv) { char example[256]; + char *result; + kpse_set_program_name(argv[0], NULL); + result = kpse_brace_expand ("a{\0exebad"); + printf ("%s\n", result); +#if 0 /* if you want an interactive loop */ for (;;) { - char *result; int i; fprintf (stderr, "brace_expand> "); - if ((!fgets (example, 256, stdin)) || - (strncmp (example, "quit", 4) == 0)) + if ((!fgets (example, 256, stdin)) + || strncmp (example, "quit", 4) == 0) break; if (strlen (example)) example[strlen (example) - 1] = 0; result = kpse_brace_expand (example); - - printf ("%s\n", result); - + printf ("%s\n", result); } +#endif + return 0; + } @@ -404,6 +412,6 @@ main (int argc, char **argv) /* Local variables: -standalone-compile-command: "gcc -g -I. -I.. -DTEST expand.c kpathsea.a" +standalone-compile-command: "gcc -g -DMAKE_KPSE_DLL -I. -I.. -I$kp -I$kp/.. -DTEST $kp/expand.c .libs/libkpathsea.a" end: */ |