From 5faea90cb442dfe14a2c4e12687aa765a796e9f8 Mon Sep 17 00:00:00 2001 From: Norbert Preining Date: Mon, 17 Sep 2018 23:55:58 +0000 Subject: writet1.(c,w) of dvips, pdftex, luatex: protect against buffer overflow git-svn-id: svn://tug.org/texlive/branches/branch2018@48688 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipsk/ChangeLog | 5 +++++ Build/source/texk/dvipsk/writet1.c | 2 ++ Build/source/texk/web2c/luatexdir/ChangeLog | 5 +++++ Build/source/texk/web2c/luatexdir/font/writet1.w | 2 ++ Build/source/texk/web2c/pdftexdir/ChangeLog | 5 +++++ Build/source/texk/web2c/pdftexdir/writet1.c | 2 ++ 6 files changed, 21 insertions(+) diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 88faea44775..4560c4b1906 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,8 @@ +2018-09-18 Norbert Preining + + * writet1.c (t1_check_unusual_charstring): protect against buffer + overflow. + 2018-04-14 Karl Berry * Version 5.998 for TeX Live 2018 release. diff --git a/Build/source/texk/dvipsk/writet1.c b/Build/source/texk/dvipsk/writet1.c index 0fcf269070b..3b478b90084 100644 --- a/Build/source/texk/dvipsk/writet1.c +++ b/Build/source/texk/dvipsk/writet1.c @@ -1449,7 +1449,9 @@ static void t1_check_unusual_charstring(void) *(strend(t1_buf_array) - 1) = ' '; t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } diff --git a/Build/source/texk/web2c/luatexdir/ChangeLog b/Build/source/texk/web2c/luatexdir/ChangeLog index 94cbfc3e6d5..2948f1cb75f 100644 --- a/Build/source/texk/web2c/luatexdir/ChangeLog +++ b/Build/source/texk/web2c/luatexdir/ChangeLog @@ -1,3 +1,8 @@ +2018-09-18 Norbert Preining + + * fonts/writet1.w (t1_check_unusual_charstring): protect against + buffer overflow. + 2017-11-02 Luigi Scarso LuaFilesystem 1.7.0 diff --git a/Build/source/texk/web2c/luatexdir/font/writet1.w b/Build/source/texk/web2c/luatexdir/font/writet1.w index fc1a89cd547..02786286585 100644 --- a/Build/source/texk/web2c/luatexdir/font/writet1.w +++ b/Build/source/texk/web2c/luatexdir/font/writet1.w @@ -1625,7 +1625,9 @@ static void t1_check_unusual_charstring(void) if (sscanf(p, "%i", &i) != 1) { strcpy(t1_buf_array, t1_line_array); t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } diff --git a/Build/source/texk/web2c/pdftexdir/ChangeLog b/Build/source/texk/web2c/pdftexdir/ChangeLog index c022bc2523d..596b943f543 100644 --- a/Build/source/texk/web2c/pdftexdir/ChangeLog +++ b/Build/source/texk/web2c/pdftexdir/ChangeLog @@ -1,3 +1,8 @@ +2018-09-18 Norbert Preining + + * writet1.c (t1_check_unusual_charstring): protect against buffer + overflow. + 2018-04-14 Karl Berry * TeX Live 2018 release, pdftex 1.40.19. diff --git a/Build/source/texk/web2c/pdftexdir/writet1.c b/Build/source/texk/web2c/pdftexdir/writet1.c index d191b77ee5f..8cfc2616ca3 100644 --- a/Build/source/texk/web2c/pdftexdir/writet1.c +++ b/Build/source/texk/web2c/pdftexdir/writet1.c @@ -1598,7 +1598,9 @@ static void t1_check_unusual_charstring(void) *(strend(t1_buf_array) - 1) = ' '; t1_getline(); + alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcat(t1_buf_array, t1_line_array); + alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE); strcpy(t1_line_array, t1_buf_array); t1_line_ptr = eol(t1_line_array); } -- cgit v1.2.3