texlive[55999] Build/source/texk/dvipdfm-x: More fix to the previous
commits+kakuto at tug.org
commits+kakuto at tug.org
Fri Jul 31 00:47:03 CEST 2020
Revision: 55999
http://tug.org/svn/texlive?view=revision&revision=55999
Author: kakuto
Date: 2020-07-31 00:47:03 +0200 (Fri, 31 Jul 2020)
Log Message:
-----------
More fix to the previous fix for tt_cmap.c. Fix for a possible problem in cid.c. (S. Hirara)
Modified Paths:
--------------
trunk/Build/source/texk/dvipdfm-x/ChangeLog
trunk/Build/source/texk/dvipdfm-x/cid.c
trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c
trunk/Build/source/texk/dvipdfm-x/tt_cmap.c
Modified: trunk/Build/source/texk/dvipdfm-x/ChangeLog
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/ChangeLog 2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/ChangeLog 2020-07-30 22:47:03 UTC (rev 55999)
@@ -1,3 +1,9 @@
+2020-07-31 Shunsaku Hirata <shunsaku.hirata74 at gmail.com>
+
+ * cid.c: Avoid accessing array elements exceeding max array index.
+ * spc_pdfm.c: Check array elements also for to-unicode conversion.
+ * tt_cmap.c: Additional changes are required for the previous CMap name fix.
+
2020-07-29 Shunsaku Hirata <shunsaku.hirata74 at gmail.com>
* spc_pdfm.c: Improve codes in unicode conversion and
Modified: trunk/Build/source/texk/dvipdfm-x/cid.c
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/cid.c 2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/cid.c 2020-07-30 22:47:03 UTC (rev 55999)
@@ -1,6 +1,6 @@
/* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks.
- Copyright (C) 2002-2018 by Jin-Hwan Cho and Shunsaku Hirata,
+ Copyright (C) 2002-2020 by Jin-Hwan Cho and Shunsaku Hirata,
the dvipdfmx project team.
This program is free software; you can redistribute it and/or modify
@@ -80,6 +80,7 @@
{NULL, NULL, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0}}
};
+#define SUP_IDX_MAX 20
#define UCS_CC 0
#define ACC_START 1
#define ACC_END 4
@@ -709,6 +710,7 @@
int i, csi_idx = -1, n, m;
sup_idx = pdf_get_version() - 10;
+ sup_idx = (sup_idx > SUP_IDX_MAX) ? SUP_IDX_MAX : sup_idx;
if (!fmap_opt || !fmap_opt->charcoll)
return NULL;
Modified: trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c 2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c 2020-07-30 22:47:03 UTC (rev 55999)
@@ -590,7 +590,7 @@
}
static int
-modstrings (pdf_obj *kp, pdf_obj *vp, void *dp)
+modify_strings (pdf_obj *kp, pdf_obj *vp, void *dp)
{
int r = 0; /* continue */
struct tounicode *cd = dp;
@@ -598,7 +598,7 @@
ASSERT( pdf_obj_typeof(kp) == PDF_NAME );
switch (pdf_obj_typeof(vp)) {
- case PDF_STRING:
+ case PDF_STRING:
if (cd && cd->cmap_id >= 0 && cd->taintkeys) {
CMap *cmap = CMap_cache_get(cd->cmap_id);
if (need_reencode(kp, vp, cd))
@@ -610,12 +610,25 @@
if (r < 0) /* error occured... */
WARN("Input string conversion (to UTF16BE) failed for %s...", pdf_name_value(kp));
break;
- case PDF_DICT:
- r = pdf_foreach_dict(vp, modstrings, dp);
+ /* Array elements are also checked. */
+ case PDF_ARRAY:
+ {
+ int i;
+ for (i = 0; i < pdf_array_length(vp); i++) {
+ pdf_obj *obj;
+ obj = pdf_get_array(vp, i);
+ r = modify_strings(kp, obj, dp);
+ if (r < 0)
+ break;
+ }
+ }
break;
- case PDF_STREAM:
- r = pdf_foreach_dict(pdf_stream_dict(vp), modstrings, dp);
+ case PDF_DICT:
+ r = pdf_foreach_dict(vp, modify_strings, dp);
break;
+ case PDF_STREAM:
+ r = pdf_foreach_dict(pdf_stream_dict(vp), modify_strings, dp);
+ break;
}
return r;
@@ -647,7 +660,7 @@
pdf_release_obj(dict);
dict = NULL;
} else {
- pdf_foreach_dict(dict, modstrings, cd);
+ pdf_foreach_dict(dict, modify_strings, cd);
}
}
}
Modified: trunk/Build/source/texk/dvipdfm-x/tt_cmap.c
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/tt_cmap.c 2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/tt_cmap.c 2020-07-30 22:47:03 UTC (rev 55999)
@@ -1605,17 +1605,20 @@
ULONG offset = 0;
char *cmap_name = NULL;
FILE *fp = NULL;
+ int len;
if (!map_name)
return -1;
- if (ttc_index > 999 || ttc_index < 0) {
- return -1; /* Sorry for this... */
+ if (ttc_index > 0xFFFFFFFFu || ttc_index < 0) {
+ return -1;
}
/* Check if already loaded */
- cmap_name = NEW(strlen(map_name)+strlen("-GID")+5, char);
- sprintf(cmap_name, "%s:%d-%d-GID", map_name, ttc_index, wmode);
+ len = strlen(map_name) + 32;
+ cmap_name = NEW(len, char);
+ snprintf(cmap_name, len, "%s:%d-%1d-GID", map_name, ttc_index, wmode);
+ cmap_name[len-1] = '\0';
cmap_id = CMap_cache_find(cmap_name);
if (cmap_id >= 0) {
RELEASE(cmap_name);
More information about the tex-live-commits
mailing list.