From 311869640590373b97552dd2570111528ae4ba15 Mon Sep 17 00:00:00 2001 From: Akira Kakuto Date: Thu, 24 Mar 2016 05:37:10 +0000 Subject: dvipsk/writet1.c, pdftexdir/writet1.c: Fix 1-byte buffer overflow bug git-svn-id: svn://tug.org/texlive/trunk@40113 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipsk/ChangeLog | 5 +++++ Build/source/texk/dvipsk/writet1.c | 6 +++--- Build/source/texk/web2c/pdftexdir/ChangeLog | 5 +++++ Build/source/texk/web2c/pdftexdir/writet1.c | 6 +++--- 4 files changed, 16 insertions(+), 6 deletions(-) diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index cde2f492927..3d06bf0435c 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,8 @@ +2016-03-24 Akira Kakuto + + * writet1.c: Fix one-byte buffer overflow bug reported by Hanno Boeck: + http://tug.org/pipermail/tex-live/2016-January/037686.html. + 2016-02-01 Karl Berry * dvips.1, diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c index 460c477c5f5..0fcf269070b 100644 --- a/Build/source/texk/dvipsk/writet1.c +++ b/Build/source/texk/dvipsk/writet1.c @@ -699,8 +699,8 @@ static char **t1_builtin_enc(void) for (i = 0; i < 256; i++) glyph_names[i] = notdef; if (t1_suffix("def")) { /* predefined encoding */ - sscanf(t1_line_array + strlen("/Encoding"), "%256s", t1_buf_array); - if (strcmp(t1_buf_array, "StandardEncoding") == 0) { + if (sscanf(t1_line_array + strlen("/Encoding"), "%255s", t1_buf_array) == 1 + && strcmp(t1_buf_array, "StandardEncoding") == 0) { t1_encoding = ENC_STANDARD; for (i = 0; i < 256; i++) { if (standard_glyph_names[i] != notdef) @@ -765,7 +765,7 @@ static char **t1_builtin_enc(void) /* check for `dup put' */ - if (sscanf(p, "dup %i%256s put", &i, t1_buf_array) == 2 && + if (sscanf(p, "dup %i%255s put", &i, t1_buf_array) == 2 && *t1_buf_array == '/' && valid_code(i)) { if (strcmp(t1_buf_array + 1, notdef) != 0) glyph_names[i] = xstrdup(t1_buf_array + 1); diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog index 6f703efbcab..5c3a40c0337 100644 --- a/Build/source/texk/web2c/pdftexdir/ChangeLog +++ b/Build/source/texk/web2c/pdftexdir/ChangeLog @@ -1,3 +1,8 @@ +2016-03-24 Akira Kakuto + + * writet1.c: Fix one-byte buffer overflow bug reported by Hanno Boeck: + http://tug.org/pipermail/tex-live/2016-January/037686.html. + 2016-03-21 Karl Berry * NEWS, diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c index 363853bf38a..d191b77ee5f 100644 --- a/Build/source/texk/web2c/pdftexdir/writet1.c +++ b/Build/source/texk/web2c/pdftexdir/writet1.c @@ -771,8 +771,8 @@ static char **t1_builtin_enc(void) for (i = 0; i < 256; i++) glyph_names[i] = notdef; if (t1_suffix("def")) { /* predefined encoding */ - sscanf(t1_line_array + strlen("/Encoding"), "%256s", t1_buf_array); - if (strcmp(t1_buf_array, "StandardEncoding") == 0) { + if (sscanf(t1_line_array + strlen("/Encoding"), "%255s", t1_buf_array) == 1 + && strcmp(t1_buf_array, "StandardEncoding") == 0) { t1_encoding = ENC_STANDARD; for (i = 0; i < 256; i++) { if (standard_glyph_names[i] != notdef) @@ -837,7 +837,7 @@ static char **t1_builtin_enc(void) /* check for `dup put' */ - if (sscanf(p, "dup %i%256s put", &i, t1_buf_array) == 2 && + if (sscanf(p, "dup %i%255s put", &i, t1_buf_array) == 2 && *t1_buf_array == '/' && valid_code(i)) { if (strcmp(t1_buf_array + 1, notdef) != 0) glyph_names[i] = xstrdup(t1_buf_array + 1); -- cgit v1.2.3