diff options
Diffstat (limited to 'Build')
-rw-r--r-- | Build/source/texk/dvipsk/ChangeLog | 3 | ||||
-rw-r--r-- | Build/source/texk/dvipsk/virtualfont.c | 6 |
2 files changed, 8 insertions, 1 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index a86425f0655..acd0592af89 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,5 +1,8 @@ 2010-03-26 Karl Berry <karl@tug.org> + * virtualfont.c (vfopen): do not sprintf too long of a name. + CVE-2010-0827, found by Dan Rosenberg. + * dospecial.c (predospecial): avoid seg fault from integer overflow. CVE-2010-0739, found by Marc Schoenefeld, patch prepared by Jindrich Novy. diff --git a/Build/source/texk/dvipsk/virtualfont.c b/Build/source/texk/dvipsk/virtualfont.c index 291b42b2bef..eb1ffc4ad3c 100644 --- a/Build/source/texk/dvipsk/virtualfont.c +++ b/Build/source/texk/dvipsk/virtualfont.c @@ -15,7 +15,7 @@ * Subroutine vfbyte returns the next byte. */ static FILE *vffile ; -static char name[50] ; +static char name[500] ; void badvf(const char *s) { @@ -72,6 +72,10 @@ vfopen(register fontdesctype *fd) if (*d==0) d = vfpath ; #endif + if (strlen(n) + 5 >= sizeof (name)) { + /* 5 for vf() + null */ + error("! VF file name too long in vfopen") ; + } #ifdef MVSXA /* IBM: MVS/XA */ (void)sprintf(name, "vf(%s)", n) ; #else |