texlive[55999] Build/source/texk/dvipdfm-x: More fix to the previous

[commits+kakuto at tug.org]

Revision: 55999
          http://tug.org/svn/texlive?view=revision&revision=55999
Author:   kakuto
Date:     2020-07-31 00:47:03 +0200 (Fri, 31 Jul 2020)
Log Message:
-----------
More fix to the previous fix for tt_cmap.c. Fix for a possible problem in cid.c. (S. Hirara)

Modified Paths:
--------------
    trunk/Build/source/texk/dvipdfm-x/ChangeLog
    trunk/Build/source/texk/dvipdfm-x/cid.c
    trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c
    trunk/Build/source/texk/dvipdfm-x/tt_cmap.c

Modified: trunk/Build/source/texk/dvipdfm-x/ChangeLog
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/ChangeLog	2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/ChangeLog	2020-07-30 22:47:03 UTC (rev 55999)
@@ -1,3 +1,9 @@
+2020-07-31  Shunsaku Hirata  <shunsaku.hirata74 at gmail.com>
+
+	* cid.c: Avoid accessing array elements exceeding max array index.
+	* spc_pdfm.c: Check array elements also for to-unicode conversion.
+	* tt_cmap.c: Additional changes are required for the previous CMap name fix.
+
 2020-07-29  Shunsaku Hirata  <shunsaku.hirata74 at gmail.com>
 
 	* spc_pdfm.c: Improve codes in unicode conversion and

Modified: trunk/Build/source/texk/dvipdfm-x/cid.c
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/cid.c	2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/cid.c	2020-07-30 22:47:03 UTC (rev 55999)
@@ -1,6 +1,6 @@
 /* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks.
 
-    Copyright (C) 2002-2018 by Jin-Hwan Cho and Shunsaku Hirata,
+    Copyright (C) 2002-2020 by Jin-Hwan Cho and Shunsaku Hirata,
     the dvipdfmx project team.
     
     This program is free software; you can redistribute it and/or modify
@@ -80,6 +80,7 @@
   {NULL,    NULL,       { 0,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0}}
 };
+#define SUP_IDX_MAX 20
 #define UCS_CC    0
 #define ACC_START 1
 #define ACC_END   4
@@ -709,6 +710,7 @@
   int i, csi_idx = -1, n, m;
 
   sup_idx = pdf_get_version() - 10;
+  sup_idx = (sup_idx > SUP_IDX_MAX) ? SUP_IDX_MAX : sup_idx;
 
   if (!fmap_opt || !fmap_opt->charcoll)
     return NULL;

Modified: trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c	2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/spc_pdfm.c	2020-07-30 22:47:03 UTC (rev 55999)
@@ -590,7 +590,7 @@
 }
 
 static int
-modstrings (pdf_obj *kp, pdf_obj *vp, void *dp)
+modify_strings (pdf_obj *kp, pdf_obj *vp, void *dp)
 {
   int               r = 0; /* continue */
   struct tounicode *cd = dp;
@@ -598,7 +598,7 @@
   ASSERT( pdf_obj_typeof(kp) == PDF_NAME );
 
   switch (pdf_obj_typeof(vp)) {
-  case  PDF_STRING:
+  case PDF_STRING:
     if (cd && cd->cmap_id >= 0 && cd->taintkeys) {
       CMap *cmap = CMap_cache_get(cd->cmap_id);
       if (need_reencode(kp, vp, cd))
@@ -610,12 +610,25 @@
     if (r < 0) /* error occured... */
       WARN("Input string conversion (to UTF16BE) failed for %s...", pdf_name_value(kp));
     break;
-  case  PDF_DICT:
-    r = pdf_foreach_dict(vp, modstrings, dp);
+  /* Array elements are also checked. */
+  case PDF_ARRAY:
+    {
+      int i;
+      for (i = 0; i < pdf_array_length(vp); i++) {
+        pdf_obj *obj;
+        obj = pdf_get_array(vp, i);
+        r   = modify_strings(kp, obj, dp);
+        if (r < 0)
+          break;
+      }
+    }
     break;
-  case  PDF_STREAM:
-    r = pdf_foreach_dict(pdf_stream_dict(vp), modstrings, dp);
+  case PDF_DICT:
+    r = pdf_foreach_dict(vp, modify_strings, dp);
     break;
+  case PDF_STREAM:
+    r = pdf_foreach_dict(pdf_stream_dict(vp), modify_strings, dp);
+    break;
   }
 
   return  r;
@@ -647,7 +660,7 @@
         pdf_release_obj(dict);
         dict = NULL;
       } else {
-        pdf_foreach_dict(dict, modstrings, cd);
+        pdf_foreach_dict(dict, modify_strings, cd);
       }
     }
   }

Modified: trunk/Build/source/texk/dvipdfm-x/tt_cmap.c
===================================================================
--- trunk/Build/source/texk/dvipdfm-x/tt_cmap.c	2020-07-30 21:16:39 UTC (rev 55998)
+++ trunk/Build/source/texk/dvipdfm-x/tt_cmap.c	2020-07-30 22:47:03 UTC (rev 55999)
@@ -1605,17 +1605,20 @@
   ULONG       offset      = 0;
   char       *cmap_name   = NULL;
   FILE       *fp          = NULL;
+  int         len;
 
   if (!map_name)
     return -1;
 
-  if (ttc_index > 999 || ttc_index < 0) {
-    return -1; /* Sorry for this... */
+  if (ttc_index > 0xFFFFFFFFu || ttc_index < 0) {
+    return -1;
   }
 
   /* Check if already loaded */
-  cmap_name = NEW(strlen(map_name)+strlen("-GID")+5, char);
-  sprintf(cmap_name, "%s:%d-%d-GID", map_name, ttc_index, wmode);
+  len = strlen(map_name) + 32;
+  cmap_name = NEW(len, char);
+  snprintf(cmap_name, len, "%s:%d-%1d-GID", map_name, ttc_index, wmode);
+  cmap_name[len-1] = '\0';
   cmap_id = CMap_cache_find(cmap_name);
   if (cmap_id >= 0) {
     RELEASE(cmap_name);