From 103102eecab04099acc1e76d824477331b29c01f Mon Sep 17 00:00:00 2001 From: Luigi Scarso Date: Fri, 12 Mar 2021 22:55:21 +0000 Subject: Luatex: when restricted system commands is enabled os.setenv has no effect. Patched Decompress to avoid execution of arbitrary commands. git-svn-id: svn://tug.org/texlive/trunk@58292 c570f23f-e606-0410-a88d-b1316a301751 --- .../luatexdir/luafontloader/fontforge/fontforge/splinefont.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c') diff --git a/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c b/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c index 84e062c013e..e26666636c9 100644 --- a/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c +++ b/Build/source/texk/web2c/luatexdir/luafontloader/fontforge/fontforge/splinefont.c @@ -246,6 +246,12 @@ char *Decompress(char *name, int compression) { char buf[1500]; char *tmpfile; + if ( strchr(name,'$') || strchr(name,'!') || strchr(name,'*') || strchr(name,'?') + || strchr(name,'[') || strchr(name,'[') || strchr(name,']') || strchr(name,']') + || strchr(name,';') || strchr(name,'&') || strchr(name,'>') || strchr(name,'<') + || strchr(name,'`') || strchr(name,'"') || strchr(name,'|') || strchr(name,'\'') + || strchr(name,'\\')) +return( NULL ); if ( dir==NULL ) dir = P_tmpdir; tmpfile = galloc(strlen(dir)+strlen(GFileNameTail(name))+2); strcpy(tmpfile,dir); @@ -253,9 +259,9 @@ char *Decompress(char *name, int compression) { strcat(tmpfile,GFileNameTail(name)); *strrchr(tmpfile,'.') = '\0'; #if defined( _NO_SNPRINTF ) || defined( __VMS ) - sprintf( buf, "%s < %s > %s", compressors[compression].decomp, name, tmpfile ); + sprintf( buf, "%s < \"%s\" > \"%s\"", compressors[compression].decomp, name, tmpfile ); #else - snprintf( buf, sizeof(buf), "%s < %s > %s", compressors[compression].decomp, name, tmpfile ); + snprintf( buf, sizeof(buf), "%s < \"%s\" > \"%s\"", compressors[compression].decomp, name, tmpfile ); #endif if ( system(buf)==0 ) return( tmpfile ); -- cgit v1.2.3