texlive[68069] Build/source/texk/web2c/pdftexdir: guard against

[commits+karl at tug.org]

Revision: 68069
          http://tug.org/svn/texlive?view=revision&revision=68069
Author:   karl
Date:     2023-08-26 19:50:10 +0200 (Sat, 26 Aug 2023)
Log Message:
-----------
guard against corrupt pfb in dup tests, pdftex r910

Revision Links:
--------------
    http://tug.org/svn/texlive?view=revision&revision=910

Modified Paths:
--------------
    trunk/Build/source/texk/web2c/pdftexdir/ChangeLog
    trunk/Build/source/texk/web2c/pdftexdir/writet1.c

Modified: trunk/Build/source/texk/web2c/pdftexdir/ChangeLog
===================================================================
--- trunk/Build/source/texk/web2c/pdftexdir/ChangeLog	2023-08-26 14:31:51 UTC (rev 68068)
+++ trunk/Build/source/texk/web2c/pdftexdir/ChangeLog	2023-08-26 17:50:10 UTC (rev 68069)
@@ -1,3 +1,9 @@
+2023-08-26  Karl Berry  <karl at freefriends.org>
+
+	* writet1.c (t1_builtin_enc): guard somewhat against corrupt pfbs,
+	in the dup and dup dup checking. Report from Gregory DUCK,
+	https://tug.org/pipermail/tex-live/2023-August/049400.html.
+
 2023-08-20  TANAKA Takuji  <ttk at t-lab.opal.ne.jp>
 
 	* {expanded,pdfimage,pdftex,pdftosrc,ttf2afm,wcfname,

Modified: trunk/Build/source/texk/web2c/pdftexdir/writet1.c
===================================================================
--- trunk/Build/source/texk/web2c/pdftexdir/writet1.c	2023-08-26 14:31:51 UTC (rev 68068)
+++ trunk/Build/source/texk/web2c/pdftexdir/writet1.c	2023-08-26 17:50:10 UTC (rev 68069)
@@ -841,7 +841,10 @@
                 *t1_buf_array == '/' && valid_code(i)) {
                 if (strcmp(t1_buf_array + 1, notdef) != 0)
                     glyph_names[i] = xstrdup(t1_buf_array + 1);
-                p = strstr(p, " put") + strlen(" put");
+                p = strstr(p, " put");
+                if (!p)
+                    pdftex_fail("invalid pfb, no put found in dup");
+                p += strlen(" put");
                 skip(p, ' ');
             }
             /*
@@ -850,7 +853,10 @@
             else if (sscanf(p, "dup dup %i exch %i get put", &b, &a) == 2
                      && valid_code(a) && valid_code(b)) {
                 copy_glyph_names(glyph_names, a, b);
-                p = strstr(p, " get put") + strlen(" get put");
+                p = strstr(p, " get put");
+                if (!p)
+                    pdftex_fail("invalid pfb, no get put found in dup dup");
+                p += strlen(" get put");
                 skip(p, ' ');
             }
             /*
@@ -861,7 +867,10 @@
                      && valid_code(a) && valid_code(b) && valid_code(c)) {
                 for (i = 0; i < c; i++)
                     copy_glyph_names(glyph_names, a + i, b + i);
-                p = strstr(p, " putinterval") + strlen(" putinterval");
+                p = strstr(p, " putinterval");
+                if (!p)
+                   pdftex_fail("invalid pfb, no putinterval found in dup dup");
+                p += strlen(" putinterval");
                 skip(p, ' ');
             }
             /*