6 files changed, 20 insertions, 0 deletions
diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog
index 88faea44775..bbce8fb3f86 100644
--- a/Build/source/texk/dvipsk/ChangeLog
+++ b/Build/source/texk/dvipsk/ChangeLog
@@ -1,3 +1,8 @@
+2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>
+
+	* writet1.c (t1_check_unusual_charstring): protect against buffer
+	overflow.
+
 2018-04-14  Karl Berry  <karl@tug.org>
 
 	* Version 5.998 for TeX Live 2018 release.
diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c
index 0fcf269070b..3b478b90084 100644
--- a/Build/source/texk/dvipsk/writet1.c
+++ b/Build/source/texk/dvipsk/writet1.c
@@ -1449,7 +1449,9 @@ static void t1_check_unusual_charstring(void)
         *(strend(t1_buf_array) - 1) = ' ';
 
         t1_getline();
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcat(t1_buf_array, t1_line_array);
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcpy(t1_line_array, t1_buf_array);
         t1_line_ptr = eol(t1_line_array);
     }
diff --git a/Build/source/texk/web2c/luatexdir/ChangeLog b/Build/source/texk/web2c/luatexdir/ChangeLog
index 62d4ab0491f..7219983d41f 100644
--- a/Build/source/texk/web2c/luatexdir/ChangeLog
+++ b/Build/source/texk/web2c/luatexdir/ChangeLog
@@ -1,3 +1,7 @@
+2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
+	* fonts/writet1.w (t1_check_unusual_charstring): protect against
+	buffer overflow.
+
 2018-08-27 Luigi Scarso <luigi.scarso@gmail.com>
 	* dropped dependency from gmp and mpfr
 
diff --git a/Build/source/texk/web2c/luatexdir/font/writet1.c b/Build/source/texk/web2c/luatexdir/font/writet1.c
index 0a0cadcfb93..d3bf29341c1 100644
--- a/Build/source/texk/web2c/luatexdir/font/writet1.c
+++ b/Build/source/texk/web2c/luatexdir/font/writet1.c
@@ -1581,7 +1581,9 @@ static void t1_check_unusual_charstring(void)
     if (sscanf(p, "%i", &i) != 1) {
         strcpy(t1_buf_array, t1_line_array);
         t1_getline();
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcat(t1_buf_array, t1_line_array);
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcpy(t1_line_array, t1_buf_array);
         t1_line_ptr = eol(t1_line_array);
     }
diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog
index 9fbb8114909..6e936a0610a 100644
--- a/Build/source/texk/web2c/pdftexdir/ChangeLog
+++ b/Build/source/texk/web2c/pdftexdir/ChangeLog
@@ -1,3 +1,8 @@
+2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>
+
+	* writet1.c (t1_check_unusual_charstring): protect against buffer
+	overflow.
+
 2018-09-09  Karl Berry  <karl@tug.org>
 
 	* expanded.test,
diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c
index d191b77ee5f..8cfc2616ca3 100644
--- a/Build/source/texk/web2c/pdftexdir/writet1.c
+++ b/Build/source/texk/web2c/pdftexdir/writet1.c
@@ -1598,7 +1598,9 @@ static void t1_check_unusual_charstring(void)
         *(strend(t1_buf_array) - 1) = ' ';
 
         t1_getline();
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcat(t1_buf_array, t1_line_array);
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcpy(t1_line_array, t1_buf_array);
         t1_line_ptr = eol(t1_line_array);
     }