From ce78fe6084c04d173c8da96c95146633c129ea8d Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Fri, 29 Mar 2019 18:02:17 +0000 Subject: dvips buffer overflows reported by Andy Nguyen git-svn-id: svn://tug.org/texlive/trunk@50641 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipsk/color.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) (limited to 'Build/source/texk/dvipsk/color.c') diff --git a/Build/source/texk/dvipsk/color.c b/Build/source/texk/dvipsk/color.c index f78d52630b3..3db791f528c 100644 --- a/Build/source/texk/dvipsk/color.c +++ b/Build/source/texk/dvipsk/color.c @@ -1,4 +1,4 @@ -/* +/* $Id$ * This is a set of routines for dvips that are used to process color * commands in the TeX file (passed by \special commands). This was * orignally written by J. Hafner, E. Blanz and M. Flickner of IBM @@ -27,6 +27,7 @@ #define COLORHASH (89) #define MAXCOLORLEN (120) /* maximum color length for background */ #define INITCOLORLEN (10000) /* initial stack size in chars */ +#define OUTBUFSIZ (100) /* base limit on special length */ /* * This is where we store the color information for a particular page. * If we free all of these, we free all of the allocated color @@ -51,7 +52,8 @@ static void colorcmdout(char *s) { char *p; - char tempword[100]; + char tempword[OUTBUFSIZ]; + integer templen; while (*s && *s <= ' ') s++; @@ -66,7 +68,17 @@ colorcmdout(char *s) return; } cmdout(p); + strcpy(tempword, "TeXcolor"); + templen = strlen("TeXcolor") + strlen(s) + 2; /* 2 is slop, just in case */ + if (templen >= OUTBUFSIZ) { + /* PostScript names get truncated to around 128 characters anyway, + so there's no reason to allow longer here. */ + sprintf(errbuf, "! TeXcolor special name longer than %d characters", + OUTBUFSIZ); + error (errbuf); + } + for (p=tempword + strlen(tempword); *s && *s > ' '; p++, s++) *p = *s; *p = 0; -- cgit v1.2.3