From f18e0204ee35c67b4999e527e6e1db2328a6776c Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Fri, 5 Apr 2019 14:13:24 +0000 Subject: pk parsing check, again from Andy Nguyen of ETH Zurich git-svn-id: svn://tug.org/texlive/trunk@50775 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipng/dvipng-src/ChangeLog | 5 +++++ Build/source/texk/dvipng/dvipng-src/pk.c | 9 +++++++++ 2 files changed, 14 insertions(+) diff --git a/Build/source/texk/dvipng/dvipng-src/ChangeLog b/Build/source/texk/dvipng/dvipng-src/ChangeLog index 55954f623ed..c0bce84764f 100644 --- a/Build/source/texk/dvipng/dvipng-src/ChangeLog +++ b/Build/source/texk/dvipng/dvipng-src/ChangeLog @@ -1,3 +1,8 @@ +2019-04-05 Karl Berry + + * pk.c (InitPK): check for packet_length reading outside file bounds. + Report from Andy Nguyen of ETH Zurich. + 2019-04-04 Karl Berry * tfm.c (ReadTFM): check for reading outside file bounds. diff --git a/Build/source/texk/dvipng/dvipng-src/pk.c b/Build/source/texk/dvipng/dvipng-src/pk.c index e814513c7e4..37be10fe32b 100644 --- a/Build/source/texk/dvipng/dvipng-src/pk.c +++ b/Build/source/texk/dvipng/dvipng-src/pk.c @@ -354,15 +354,24 @@ void InitPK(struct font_entry * tfontp) tcharptr->data = NULL; tcharptr->tfmw = 0; if ((*position & 7) == 7) { + if (tfontp->fmmap.size < (char *)position-tfontp->fmmap.data + 9) { + Fatal("file too short (%u) for 9-byte packet_length",tfontp->fmmap.size); + } packet_length = UNumRead(position+1,4); c = UNumRead(position+5, 4); position += 9; } else if (*position & 4) { + if (tfontp->fmmap.size < (char *)position-tfontp->fmmap.data + 4) { + Fatal("file too short (%u) for 4-byte packet_length",tfontp->fmmap.size); + } packet_length = (*position & 3) * 65536l + UNumRead(position+1, 2); c = UNumRead(position+3, 1); position += 4; } else { + if (tfontp->fmmap.size < (char *)position-tfontp->fmmap.data + 3) { + Fatal("file too short (%u) for 3-byte packet_length",tfontp->fmmap.size); + } packet_length = (*position & 3) * 256 + UNumRead(position+1, 1); c = UNumRead(position+2, 1); -- cgit v1.2.3