From d26a25bf0e44eaad0cad5ddbcc71d69de823eb3f Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Sat, 30 Mar 2019 01:30:26 +0000 Subject: further buffer size corrections git-svn-id: svn://tug.org/texlive/trunk@50649 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/dvipsk/ChangeLog | 8 +++- Build/source/texk/dvipsk/dospecial.c | 44 +++++++++++++++------ .../source/texk/dvipsk/test-overflow-buffers.test | 9 ++++- .../texk/dvipsk/testdata/overflow-epsfile.dvi | Bin 1120 -> 1120 bytes .../texk/dvipsk/testdata/overflow-ifffile.dvi | Bin 0 -> 1168 bytes .../texk/dvipsk/testdata/overflow-ifffile.tex | 12 ++++++ .../texk/dvipsk/testdata/overflow-keyword.dvi | Bin 0 -> 1160 bytes .../texk/dvipsk/testdata/overflow-keyword.tex | 12 ++++++ .../source/texk/dvipsk/testdata/overflow-psbox.dvi | Bin 780 -> 1140 bytes .../source/texk/dvipsk/testdata/overflow-psbox.tex | 4 +- 10 files changed, 72 insertions(+), 17 deletions(-) create mode 100644 Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi create mode 100755 Build/source/texk/dvipsk/testdata/overflow-ifffile.tex create mode 100644 Build/source/texk/dvipsk/testdata/overflow-keyword.dvi create mode 100755 Build/source/texk/dvipsk/testdata/overflow-keyword.tex (limited to 'Build') diff --git a/Build/source/texk/dvipsk/ChangeLog b/Build/source/texk/dvipsk/ChangeLog index 559ba09b741..4b8c0a3a6e5 100644 --- a/Build/source/texk/dvipsk/ChangeLog +++ b/Build/source/texk/dvipsk/ChangeLog @@ -1,8 +1,12 @@ 2019-03-29 Karl Berry + * dospecial.c (dospecial) : reverse sense of maccess + test, as intended; check for buffer overflow. + (maccess): add doc. + * color.c (colorcmdout), - * dospecial.c (dospecial) , : check for - buffer overflows. + * dospecial.c (dospecial) , , : + check for buffer overflows. * test-overflow-buffers.test, * testdata/color.pro, * testdata/overflow-color-push.dvi, diff --git a/Build/source/texk/dvipsk/dospecial.c b/Build/source/texk/dvipsk/dospecial.c index e44efae4502..1e34c54a35f 100644 --- a/Build/source/texk/dvipsk/dospecial.c +++ b/Build/source/texk/dvipsk/dospecial.c @@ -574,13 +574,15 @@ default: scanfontcomments(ValStr); } +/* Return 1 if S is readable along figpath, 0 if not. */ static int maccess(char *s) { FILE *f = search(figpath, s, "r"); - if (f) + int found = (f != 0); + if (found) (*close_file) (f); - return (f != 0); + return found; } const char *tasks[] = { 0, "iff2ps", "tek2ps" }; @@ -651,16 +653,22 @@ case 'e': unsigned psfilelen = 0; p += 8; - while (!isspace((unsigned char)*p)) { + while (*p && !isspace((unsigned char)*p)) { if (psfilelen < PSFILESIZ) { psfile[psfilelen] = *p; psfilelen++; + p++; } else { - sprintf(errbuf, "! epsfile= argument longer than %d characters", - PSFILESIZ); + psfile[psfilelen] = 0; /* should not strictly be necessary */ + sprintf(errbuf, + "! epsfile=%.20s... argument longer than %d characters", + psfile, PSFILESIZ); error(errbuf); } } + if (psfilelen == 0) { + error ("! epsfile= argument empty"); + } psfile[psfilelen] = 0; p += strlen(psfile); fgetboundingbox(psfile, &llx, &lly, &urx, &ury); @@ -936,18 +944,23 @@ default: while( (p=GetKeyVal(p,&j)) != NULL ) switch (j) { - case -1: /* for compatability with old conventions, we allow a file name + case -1: /* for compatibility with old conventions, we allow a file name * to be given without the 'psfile=' keyword */ - if (!psfile[0] && maccess(KeyStr)==0) /* yes we can read it */ + if (!psfile[0] && maccess(KeyStr)==1) { /* yes we can read it */ + if (strlen(KeyStr) >= PSFILESIZ) { + sprintf(errbuf, + "! Bare filename (%.20s...) in \\special longer than %d characters", + KeyStr, PSFILESIZ); + } strcpy(psfile,KeyStr); - else { + } else { if (strlen(KeyStr) < 40) { sprintf(errbuf, "Unknown keyword (%s) in \\special will be ignored", KeyStr); } else { sprintf(errbuf, - "Unknown keyword (%.40s...) in \\special will be ignored", + "Unknown keyword (%.40s...) in \\special will be ignored", KeyStr); } specerror(errbuf); @@ -955,11 +968,18 @@ default: break; case 0: case 1: case 2: /* psfile */ if (psfile[0]) { - sprintf(errbuf, "More than one \\special %s given; %s ignored", - "psfile", ValStr); + sprintf(errbuf, "More than one \\special %s given; %.40s ignored", + "psfile", ValStr); specerror(errbuf); + } else { + if (strlen(ValStr) >= PSFILESIZ) { + sprintf(errbuf, + "! PS filename (%.20s...) in \\special longer than %d characters", + ValStr, PSFILESIZ); + error(errbuf); + } + strcpy(psfile, ValStr); } - else strcpy(psfile,ValStr); task = tasks[j]; break; default: /* most keywords are output as PostScript procedure calls */ diff --git a/Build/source/texk/dvipsk/test-overflow-buffers.test b/Build/source/texk/dvipsk/test-overflow-buffers.test index 4c2794826b9..28e314ef0ad 100755 --- a/Build/source/texk/dvipsk/test-overflow-buffers.test +++ b/Build/source/texk/dvipsk/test-overflow-buffers.test @@ -3,7 +3,8 @@ # Public domain. Various buffer overflows, reported by # Andy Nguyen of ETH Zurich. The program should detect and abort. -for tst in overflow-color-push overflow-epsfile overflow-psbox; do +for tst in overflow-color-push overflow-epsfile \ + overflow-ifffile overflow-psbox; do : if ./dvips $srcdir/testdata/$tst.dvi -o; then echo "$0: test $tst should have failed." >&2 @@ -11,4 +12,10 @@ for tst in overflow-color-push overflow-epsfile overflow-psbox; do fi done +# overflow-keyword succeeds, because the special is ignored, +# because the file (named with 999 a's) does not exist. +tst=overflow-keyword +./dvips $srcdir/testdata/$tst.dvi -o || exit 1 +grep ' @setspecial' $tst.ps || exit 1 + exit 0 diff --git a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi index b2b3a44f3f4..0d7e5429aef 100644 Binary files a/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi and b/Build/source/texk/dvipsk/testdata/overflow-epsfile.dvi differ diff --git a/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi b/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi new file mode 100644 index 00000000000..00859cfedc2 Binary files /dev/null and b/Build/source/texk/dvipsk/testdata/overflow-ifffile.dvi differ diff --git a/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex b/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex new file mode 100755 index 00000000000..aa6d95f7b55 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-ifffile.tex @@ -0,0 +1,12 @@ +\documentclass{article} + +\begin{document} +\thispagestyle{empty} + +\begin{figure}[p] + +\special{ifffile=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa} + +\end{figure} + +\end{document} diff --git a/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi b/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi new file mode 100644 index 00000000000..0df5740c803 Binary files /dev/null and b/Build/source/texk/dvipsk/testdata/overflow-keyword.dvi differ diff --git a/Build/source/texk/dvipsk/testdata/overflow-keyword.tex b/Build/source/texk/dvipsk/testdata/overflow-keyword.tex new file mode 100755 index 00000000000..f3f6f31d280 --- /dev/null +++ b/Build/source/texk/dvipsk/testdata/overflow-keyword.tex @@ -0,0 +1,12 @@ +\documentclass{article} + +\begin{document} +\thispagestyle{empty} + +\begin{figure}[p] + +\special{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa} + +\end{figure} + +\end{document} diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi index f890d469006..56ddd5e5b23 100644 Binary files a/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi and b/Build/source/texk/dvipsk/testdata/overflow-psbox.dvi differ diff --git a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex index a0431a70168..f7628e27e3b 100644 --- a/Build/source/texk/dvipsk/testdata/overflow-psbox.tex +++ b/Build/source/texk/dvipsk/testdata/overflow-psbox.tex @@ -1,5 +1,5 @@ % Andy Nguyen of ETH Zurich. Public domain. -% tlsecurity mail of 28 Mar 2019 18:20:48. +% tlsecurity mail of 29 Mar 2019 22:41:20. % File "dvipsk/dospecial.c", subroutine "dospecial": "psfile" is parsed using % "sscanf(p+13, "{%fpt}{%fpt}{%[^}]}", &w, &h, psfile)", which has no length % limitation. @@ -11,7 +11,7 @@ \begin{figure}[p] -\special{postscriptbox{}{}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}} +\special{postscriptbox{42pt}{1337pt}{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa}} \end{figure} -- cgit v1.2.3