diff options
Diffstat (limited to 'Build')
| -rw-r--r-- | Build/source/texk/dvipdfm-x/ChangeLog | 11 | ||||
| -rw-r--r-- | Build/source/texk/dvipdfm-x/spc_pdfm.c | 11 | ||||
| -rw-r--r-- | Build/source/texk/dvipdfm-x/spc_xtx.c | 13 | ||||
| -rw-r--r-- | Build/source/texk/dvipdfm-x/specials.c | 7 |
4 files changed, 34 insertions, 8 deletions
diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog index 5bbc511cf52..709472bedae 100644 --- a/Build/source/texk/dvipdfm-x/ChangeLog +++ b/Build/source/texk/dvipdfm-x/ChangeLog @@ -1,3 +1,14 @@ +2019-03-30 Akira Kakuto <kakuto@w32tex.org> + + * spc_xtx.c: "ap->curptr" was copied to "buffer" without + length validation. Fix this security problem. + * spc_pdfm.c: "ap->curptr" was copied to "buffer" without + length validation. Fix this security problem. + * specials.c: Error message was written using vsprintf(), + which has no length limitation. Use vsnprintf() instead. + + Report from Andy Nguyen of ETH Zurich. + 2019-03-05 Clerk Ma <maqiyuan130324@vip.qq.com> * tt_table.c: Fix 'null character(s)' warning caused by diff --git a/Build/source/texk/dvipdfm-x/spc_pdfm.c b/Build/source/texk/dvipdfm-x/spc_pdfm.c index 71386613a50..a5e8d10b928 100644 --- a/Build/source/texk/dvipdfm-x/spc_pdfm.c +++ b/Build/source/texk/dvipdfm-x/spc_pdfm.c @@ -1764,15 +1764,17 @@ spc_handler_pdfm_bgcolor (struct spc_env *spe, struct spc_arg *args) return error; } +#define THEBUFFLENGTH 1024 static int spc_handler_pdfm_mapline (struct spc_env *spe, struct spc_arg *ap) { fontmap_rec *mrec; char *map_name, opchr; int error = 0; - static char buffer[1024]; + static char buffer[THEBUFFLENGTH]; const char *p; char *q; + int count; skip_white(&ap->curptr, ap->endptr); if (ap->curptr >= ap->endptr) { @@ -1800,8 +1802,13 @@ spc_handler_pdfm_mapline (struct spc_env *spe, struct spc_arg *ap) default: p = ap->curptr; q = buffer; - while (p < ap->endptr) + count = 0; + while (p < ap->endptr && count < THEBUFFLENGTH - 1) { *q++ = *p++; + count++; + } + if (count == THEBUFFLENGTH - 1) + spc_warn(spe, "Too long a fontmap line."); *q = '\0'; mrec = NEW(1, fontmap_rec); pdf_init_fontmap_record(mrec); diff --git a/Build/source/texk/dvipdfm-x/spc_xtx.c b/Build/source/texk/dvipdfm-x/spc_xtx.c index e66889ef81b..33d43d60743 100644 --- a/Build/source/texk/dvipdfm-x/spc_xtx.c +++ b/Build/source/texk/dvipdfm-x/spc_xtx.c @@ -1,7 +1,7 @@ /* This is xdvipdfmx, an extended version of dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks. - Copyright (C) 2013-2016 by the dvipdfmx project team. + Copyright (C) 2013-2019 by the dvipdfmx project team. Copyright (c) 2006 SIL International Originally written by Jonathan Kew @@ -195,15 +195,17 @@ spc_handler_xtx_backgroundcolor (struct spc_env *spe, struct spc_arg *args) } /* FIXME: xdv2pdf's x:fontmapline and x:fontmapfile may have slightly different syntax/semantics */ +#define THEBUFFLENGTH 1024 static int spc_handler_xtx_fontmapline (struct spc_env *spe, struct spc_arg *ap) { fontmap_rec *mrec; char *map_name, opchr; int error = 0; - static char buffer[1024]; + static char buffer[THEBUFFLENGTH]; const char *p; char *q; + int count; skip_white(&ap->curptr, ap->endptr); if (ap->curptr >= ap->endptr) { @@ -231,8 +233,13 @@ spc_handler_xtx_fontmapline (struct spc_env *spe, struct spc_arg *ap) default: p = ap->curptr; q = buffer; - while (p < ap->endptr) + count = 0; + while (p < ap->endptr && count < THEBUFFLENGTH - 1) { *q++ = *p++; + count++; + } + if (count == THEBUFFLENGTH - 1) + spc_warn(spe, "Too long a fontmap line."); *q = '\0'; mrec = NEW(1, fontmap_rec); pdf_init_fontmap_record(mrec); diff --git a/Build/source/texk/dvipdfm-x/specials.c b/Build/source/texk/dvipdfm-x/specials.c index 9d396ac5aeb..794938f57fd 100644 --- a/Build/source/texk/dvipdfm-x/specials.c +++ b/Build/source/texk/dvipdfm-x/specials.c @@ -1,6 +1,6 @@ /* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks. - Copyright (C) 2002-2018 by Jin-Hwan Cho and Shunsaku Hirata, + Copyright (C) 2002-2019 by Jin-Hwan Cho and Shunsaku Hirata, the dvipdfmx project team. Copyright (C) 1998, 1999 by Mark A. Wicks <mwicks@kettering.edu> @@ -53,15 +53,16 @@ #include "specials.h" +#define THEBUFFLENGTH 1024 void spc_warn (struct spc_env *spe, const char *fmt, ...) { va_list ap; - static char buf[1024]; + static char buf[THEBUFFLENGTH]; va_start(ap, fmt); - vsprintf(buf, fmt, ap); + vsnprintf(buf, THEBUFFLENGTH, fmt, ap); WARN(buf); va_end(ap); |