From 5c71f7dcce52cab382d58624cc13df5caf788723 Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Thu, 25 Mar 2010 23:55:25 +0000 Subject: avoid integer overflow, CVE-2010-0739 git-svn-id: svn://tug.org/texlive/trunk@17559 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipsk/ChangeLog | 6 ++++++ Build/source/texk/dvipsk/dospecial.c | 6 ++++++ 2 files changed, 12 insertions(+) (limited to 'Build') diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 8fb408fca49..a86425f0655 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,3 +1,9 @@ +2010-03-26 Karl Berry + + * dospecial.c (predospecial): avoid seg fault from integer overflow. + CVE-2010-0739, found by Marc Schoenefeld, patch prepared + by Jindrich Novy. + 2010-02-26 Karl Berry * search.c (selfautoloc_prog, quote_name): remove kpse_ prefix for diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c index 8f0a352d407..63fefbf4ac8 100644 --- a/Build/source/texk/dvipsk/dospecial.c +++ b/Build/source/texk/dvipsk/dospecial.c @@ -297,6 +297,12 @@ predospecial(integer numbytes, Boolean scanning) static int omega_specials = 0; if (nextstring + numbytes > maxstring) { + if (numbytes < 0 + || (numbytes > 0 && 2 > INT_MAX / numbytes) + || 2 * numbytes > 1000 + 2 * numbytes) { + error("! Integer overflow in predospecial"); + exit(1); + } p = nextstring = mymalloc(1000 + 2 * numbytes) ; maxstring = nextstring + 2 * numbytes + 700 ; } -- cgit v1.2.3