From 953400636440b9766a2771d046ead7faad09671f Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Sun, 19 Nov 2023 16:03:33 +0000 Subject: improve fmt/base corruption checks, from DRF git-svn-id: svn://tug.org/texlive/trunk@68900 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/web2c/ChangeLog | 6 ++++++ Build/source/texk/web2c/mf.ch | 11 +++++++++-- Build/source/texk/web2c/tex.ch | 11 +++++++++-- 3 files changed, 24 insertions(+), 4 deletions(-) (limited to 'Build/source') diff --git a/Build/source/texk/web2c/ChangeLog b/Build/source/texk/web2c/ChangeLog index d8b8c81d16c..06b9647abec 100644 --- a/Build/source/texk/web2c/ChangeLog +++ b/Build/source/texk/web2c/ChangeLog @@ -1,3 +1,9 @@ +2023-11-19 Karl Berry + + * tex.ch, + * mf.ch (Undump the dynamic memory): improve fmt/base corruption + tests, from DRF. + 2023-11-19 Andreas Scherer * ctangleboot.cin, diff --git a/Build/source/texk/web2c/mf.ch b/Build/source/texk/web2c/mf.ch index 4b13cacb441..af7a1ca1e9f 100644 --- a/Build/source/texk/web2c/mf.ch +++ b/Build/source/texk/web2c/mf.ch @@ -1854,12 +1854,19 @@ mem:=xmalloc_array (memory_word, mem_max - mem_min + 1); @z @x [48.1195] l.22714 - Check that p did not become corrupt. +p:=q+node_size(q); if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base; @y {If the base file is messed up, that addition to |p| might cause it to become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023. - Found with a fuzz tester similar to AFL-fuzz. Also changed in \TeX.} -if (plo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto off_base; + Also changed in \MF. Fix from DRF, who explains: we test before doing the + addition to avoid assuming silent wrap-around overflow, and also to to + catch cases where |node_size| was, say, bogusly the equivalent of $-1$ + and thus |p+node_size| would still look valid.} +if (node_size(q)>lo_mem_max-q) or (rlink(q)>lo_mem_max) + or ((q>=rlink(q))and(rlink(q)<>rover)) +then goto off_base; +p:=q+node_size(q); @z @x [48.1199] l.22750 - Allow command line to override dumped value. diff --git a/Build/source/texk/web2c/tex.ch b/Build/source/texk/web2c/tex.ch index 51307bf7c7b..3243105730a 100644 --- a/Build/source/texk/web2c/tex.ch +++ b/Build/source/texk/web2c/tex.ch @@ -3654,12 +3654,19 @@ repeat undump_things(mem[p], q+2-p); @z @x [50.1312] l.23955 - Check that p did not become corrupt. +p:=q+node_size(q); if (p>lo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt; @y {If the format file is messed up, that addition to |p| might cause it to become garbage. Report from Gregory James DUCK to Karl, 14 Sep 2023. - Found with a fuzz tester similar to AFL-fuzz. Also changed in \MF.} -if (plo_mem_max)or((q>=rlink(q))and(rlink(q)<>rover)) then goto bad_fmt; + Also changed in \MF. Fix from DRF, who explains: we test before doing the + addition to avoid assuming silent wrap-around overflow, and also to to + catch cases where |node_size| was, say, bogusly the equivalent of $-1$ + and thus |p+node_size| would still look valid.} +if (node_size(q)>lo_mem_max-q) or (rlink(q)>lo_mem_max) + or ((q>=rlink(q))and(rlink(q)<>rover)) +then goto bad_fmt; +p:=q+node_size(q); @z @x [50.1312] l.23878 - Make dumping/undumping more efficient. -- cgit v1.2.3