rpm/texlive
SHA256
1
0
Fork 0
forked from pool/texlive
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/Publishing:TeXLive/texlive?expand=0&rev=306

Browse Source
This commit is contained in:
Dr. Werner Fink 2018-09-26 11:58:51 +00:00 committed by Git OBS Bridge
parent d7b0ca997a
commit 578f2b33c3
3 changed files with 97 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
source-bsc1109673.dif Normal file
View File

@ -0,0 +1,86 @@
Extracted from svn source tree of TeXLive for CVE-2018-17407 (bsc#1109673)
------------------------------------------------------------------------
r48697 | preining | 2018-09-19 06:02:06 +0200 (Wed, 19 Sep 2018) | 1 line
writet1 protection against buffer overflow
------------------------------------------------------------------------
| Index: Build/source/texk/dvipsk/ChangeLog
| ===================================================================
| --- Build/source/texk/dvipsk/ChangeLog (revision 48696)
| +++ Build/source/texk/dvipsk/ChangeLog (revision 48697)
| @@ -1,3 +1,8 @@
| +2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
| +
| + * writet1.c (t1_check_unusual_charstring): protect against buffer
| + overflow.
| +
| 2018-04-14 Karl Berry <karl@tug.org>
|
| * Version 5.998 for TeX Live 2018 release.
Index: Build/source/texk/dvipsk/writet1.c
===================================================================
--- Build/source/texk/dvipsk/writet1.c (revision 48696)
+++ Build/source/texk/dvipsk/writet1.c (revision 48697)
@@ -1449,7 +1449,9 @@
*(strend(t1_buf_array) - 1) = ' ';
t1_getline();
+ alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcat(t1_buf_array, t1_line_array);
+ alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcpy(t1_line_array, t1_buf_array);
t1_line_ptr = eol(t1_line_array);
}
| Index: Build/source/texk/web2c/luatexdir/ChangeLog
| ===================================================================
| --- Build/source/texk/web2c/luatexdir/ChangeLog (revision 48696)
| +++ Build/source/texk/web2c/luatexdir/ChangeLog (revision 48697)
| @@ -1,3 +1,7 @@
| +2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
| + * fonts/writet1.w (t1_check_unusual_charstring): protect against
| + buffer overflow.
| +
| 2018-08-27 Luigi Scarso <luigi.scarso@gmail.com>
| * dropped dependency from gmp and mpfr
|
Index: Build/source/texk/web2c/luatexdir/font/writet1.c
===================================================================
--- Build/source/texk/web2c/luatexdir/font/writet1.w (revision 48696)
+++ Build/source/texk/web2c/luatexdir/font/writet1.w (revision 48697)
@@ -1581,7 +1581,9 @@
if (sscanf(p, "%i", &i) != 1) {
strcpy(t1_buf_array, t1_line_array);
t1_getline();
+ alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcat(t1_buf_array, t1_line_array);
+ alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcpy(t1_line_array, t1_buf_array);
t1_line_ptr = eol(t1_line_array);
}
| Index: Build/source/texk/web2c/pdftexdir/ChangeLog
| ===================================================================
| --- Build/source/texk/web2c/pdftexdir/ChangeLog (revision 48696)
| +++ Build/source/texk/web2c/pdftexdir/ChangeLog (revision 48697)
| @@ -1,3 +1,8 @@
| +2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
| +
| + * writet1.c (t1_check_unusual_charstring): protect against buffer
| + overflow.
| +
| 2018-09-09 Karl Berry <karl@tug.org>
|
| * expanded.test,
Index: Build/source/texk/web2c/pdftexdir/writet1.c
===================================================================
--- Build/source/texk/web2c/pdftexdir/writet1.c (revision 48696)
+++ Build/source/texk/web2c/pdftexdir/writet1.c (revision 48697)
@@ -1598,7 +1598,9 @@
*(strend(t1_buf_array) - 1) = ' ';
t1_getline();
+ alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcat(t1_buf_array, t1_line_array);
+ alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
strcpy(t1_line_array, t1_buf_array);
t1_line_ptr = eol(t1_line_array);
}

7
texlive.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Wed Sep 26 11:54:24 UTC 2018 - Dr. Werner Fink <werner@suse.de>
- Add patch source-bsc1109673.dif to fix bsc#1109673 for CVE-2018-17407
which is about buffer overflow in the handling of Type 1 fonts
allowing arbitrary code execution
-------------------------------------------------------------------
Thu Jul 19 12:19:08 UTC 2018 - alarrosa@suse.com

5
texlive.spec
View File

@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
@ -275,6 +275,8 @@ Patch51: freetype-use-pkg-config.patch
Patch52: source-tounicode.dif
# PATCH-FIX-TEXLIVE
Patch53: source-fix-const-poppler0.66.0.patch
# PATCH-FIX-TEXLIVE
Patch54: source-bsc1109673.dif
Prefix: %{_bindir}
Provides: pdfjam = %{version}
Obsoletes: pdfjam < %{version}
@ -3580,6 +3582,7 @@ popd
%if %{?pkg_vcmp:%{pkg_vcmp libpoppler-devel >= 0.66.0}}%{!?pkg_vcmp:0}
%patch53 -p0 -b .poppler
%endif
%patch54 -p2 -b .type1
# Correct FHS paths
paths=$(find -name cnf-to-paths.awk)