From 24ca1e5cf8e5a95d31d9d08a63ed433297e7a885 Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Fri, 26 Mar 2010 00:03:59 +0000 Subject: use concat instead of sprintf for other error messages git-svn-id: svn://tug.org/texlive/trunk@17561 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipsk/ChangeLog | 4 ++++ Build/source/texk/dvipsk/virtualfont.c | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index acd0592af89..2ed06264265 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,5 +1,9 @@ 2010-03-26 Karl Berry + * virtualfont.c (badvf, virtualfont): use concat[n] instead of + sprintf for error messages. + (): #include. + * virtualfont.c (vfopen): do not sprintf too long of a name. CVE-2010-0827, found by Dan Rosenberg. diff --git a/Build/source/texk/dvipsk/virtualfont.c b/Build/source/texk/dvipsk/virtualfont.c index eb1ffc4ad3c..b38c0b16d11 100644 --- a/Build/source/texk/dvipsk/virtualfont.c +++ b/Build/source/texk/dvipsk/virtualfont.c @@ -5,6 +5,7 @@ #include "dvips.h" /* The copyright notice in that file is included too! */ #ifdef KPATHSEA #include +#include #endif /* * The external declarations: @@ -19,8 +20,8 @@ static char name[500] ; void badvf(const char *s) { - (void)sprintf(errbuf,"! Bad VF file %s: %s",name,s) ; - error(errbuf); + char *msg = concatn("! Bad VF file ", name, ":", s); + error(msg); } shalfword @@ -195,8 +196,8 @@ virtualfont(register fontdesctype *curfnt) check_checksum (k, curfnt->checksum, curfnt->name); k = (integer)(alpha * (real)vfquad()) ; if (k > curfnt->designsize + 2 || k < curfnt->designsize - 2) { - (void)sprintf(errbuf,"Design size mismatch in font %s", name) ; - error(errbuf) ; + char *msg = concat("Design size mismatch in font ", name); + error(msg); } /* * Now we look for font definitions. -- cgit v1.2.3