From e3231938212423e5e71506e58022397ff69cd34b Mon Sep 17 00:00:00 2001 From: Akira Kakuto Date: Thu, 30 Jul 2020 22:47:03 +0000 Subject: More fix to the previous fix for tt_cmap.c. Fix for a possible problem in cid.c. (S. Hirara) git-svn-id: svn://tug.org/texlive/trunk@55999 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipdfm-x/ChangeLog | 6 ++++++ Build/source/texk/dvipdfm-x/cid.c | 4 +++- Build/source/texk/dvipdfm-x/spc_pdfm.c | 27 ++++++++++++++++++++------- Build/source/texk/dvipdfm-x/tt_cmap.c | 11 +++++++---- 4 files changed, 36 insertions(+), 12 deletions(-) (limited to 'Build/source') diff --git a/Build/source/texk/dvipdfm-x/ChangeLog b/Build/source/texk/dvipdfm-x/ChangeLog index c1d1176e8db..1a3acabefee 100644 --- a/Build/source/texk/dvipdfm-x/ChangeLog +++ b/Build/source/texk/dvipdfm-x/ChangeLog @@ -1,3 +1,9 @@ +2020-07-31 Shunsaku Hirata + + * cid.c: Avoid accessing array elements exceeding max array index. + * spc_pdfm.c: Check array elements also for to-unicode conversion. + * tt_cmap.c: Additional changes are required for the previous CMap name fix. + 2020-07-29 Shunsaku Hirata * spc_pdfm.c: Improve codes in unicode conversion and diff --git a/Build/source/texk/dvipdfm-x/cid.c b/Build/source/texk/dvipdfm-x/cid.c index 517b21d22b6..42554ad3123 100644 --- a/Build/source/texk/dvipdfm-x/cid.c +++ b/Build/source/texk/dvipdfm-x/cid.c @@ -1,6 +1,6 @@ /* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks. - Copyright (C) 2002-2018 by Jin-Hwan Cho and Shunsaku Hirata, + Copyright (C) 2002-2020 by Jin-Hwan Cho and Shunsaku Hirata, the dvipdfmx project team. This program is free software; you can redistribute it and/or modify @@ -80,6 +80,7 @@ static struct { {NULL, NULL, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}} }; +#define SUP_IDX_MAX 20 #define UCS_CC 0 #define ACC_START 1 #define ACC_END 4 @@ -709,6 +710,7 @@ get_cidsysinfo (const char *map_name, fontmap_opt *fmap_opt) int i, csi_idx = -1, n, m; sup_idx = pdf_get_version() - 10; + sup_idx = (sup_idx > SUP_IDX_MAX) ? SUP_IDX_MAX : sup_idx; if (!fmap_opt || !fmap_opt->charcoll) return NULL; diff --git a/Build/source/texk/dvipdfm-x/spc_pdfm.c b/Build/source/texk/dvipdfm-x/spc_pdfm.c index f13aaef9d04..d6a72fe2c33 100644 --- a/Build/source/texk/dvipdfm-x/spc_pdfm.c +++ b/Build/source/texk/dvipdfm-x/spc_pdfm.c @@ -590,7 +590,7 @@ need_reencode (pdf_obj *kp, pdf_obj *vp, struct tounicode *cd) } static int -modstrings (pdf_obj *kp, pdf_obj *vp, void *dp) +modify_strings (pdf_obj *kp, pdf_obj *vp, void *dp) { int r = 0; /* continue */ struct tounicode *cd = dp; @@ -598,7 +598,7 @@ modstrings (pdf_obj *kp, pdf_obj *vp, void *dp) ASSERT( pdf_obj_typeof(kp) == PDF_NAME ); switch (pdf_obj_typeof(vp)) { - case PDF_STRING: + case PDF_STRING: if (cd && cd->cmap_id >= 0 && cd->taintkeys) { CMap *cmap = CMap_cache_get(cd->cmap_id); if (need_reencode(kp, vp, cd)) @@ -610,11 +610,24 @@ modstrings (pdf_obj *kp, pdf_obj *vp, void *dp) if (r < 0) /* error occured... */ WARN("Input string conversion (to UTF16BE) failed for %s...", pdf_name_value(kp)); break; - case PDF_DICT: - r = pdf_foreach_dict(vp, modstrings, dp); + /* Array elements are also checked. */ + case PDF_ARRAY: + { + int i; + for (i = 0; i < pdf_array_length(vp); i++) { + pdf_obj *obj; + obj = pdf_get_array(vp, i); + r = modify_strings(kp, obj, dp); + if (r < 0) + break; + } + } break; - case PDF_STREAM: - r = pdf_foreach_dict(pdf_stream_dict(vp), modstrings, dp); + case PDF_DICT: + r = pdf_foreach_dict(vp, modify_strings, dp); + break; + case PDF_STREAM: + r = pdf_foreach_dict(pdf_stream_dict(vp), modify_strings, dp); break; } @@ -647,7 +660,7 @@ parse_pdf_dict_with_tounicode (const char **pp, const char *endptr, struct touni pdf_release_obj(dict); dict = NULL; } else { - pdf_foreach_dict(dict, modstrings, cd); + pdf_foreach_dict(dict, modify_strings, cd); } } } diff --git a/Build/source/texk/dvipdfm-x/tt_cmap.c b/Build/source/texk/dvipdfm-x/tt_cmap.c index 3e9fea7274d..113d11699a5 100644 --- a/Build/source/texk/dvipdfm-x/tt_cmap.c +++ b/Build/source/texk/dvipdfm-x/tt_cmap.c @@ -1605,17 +1605,20 @@ otf_try_load_GID_to_CID_map (const char *map_name, int ttc_index, int wmode) ULONG offset = 0; char *cmap_name = NULL; FILE *fp = NULL; + int len; if (!map_name) return -1; - if (ttc_index > 999 || ttc_index < 0) { - return -1; /* Sorry for this... */ + if (ttc_index > 0xFFFFFFFFu || ttc_index < 0) { + return -1; } /* Check if already loaded */ - cmap_name = NEW(strlen(map_name)+strlen("-GID")+5, char); - sprintf(cmap_name, "%s:%d-%d-GID", map_name, ttc_index, wmode); + len = strlen(map_name) + 32; + cmap_name = NEW(len, char); + snprintf(cmap_name, len, "%s:%d-%1d-GID", map_name, ttc_index, wmode); + cmap_name[len-1] = '\0'; cmap_id = CMap_cache_find(cmap_name); if (cmap_id >= 0) { RELEASE(cmap_name); -- cgit v1.2.3