CVE-2018-17407: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2018-09-23T21:29Z
Repository: https://github.com/TeX-Live/texlive-source
Language: Other
Files changed: texk/dvipsk/ChangeLog, texk/dvipsk/writet1.c, texk/web2c/luatexdir/ChangeLog, texk/web2c/luatexdir/font/writet1.c, texk/web2c/pdftexdir/ChangeLog, texk/web2c/pdftexdir/writet1.c
Commit date: 2018-09-19 04:02:06 +0000
Commit message: writet1 protection against buffer overflow

git-svn-id: svn://tug.org/texlive/trunk/Build/source@48697 c570f23f-e606-0410-a88d-b1316a301751

Diff: diff --git a/texk/dvipsk/ChangeLog b/texk/dvipsk/ChangeLog
index 88faea447..bbce8fb3f 100644
--- a/texk/dvipsk/ChangeLog
+++ b/texk/dvipsk/ChangeLog
@@ -1,5 +1,10 @@
+2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>
+
+	* writet1.c (t1_check_unusual_charstring): protect against buffer
+	overflow.
+
 2018-04-14  Karl Berry  <karl@tug.org>
 
 	* Version 5.998 for TeX Live 2018 release.
 
 2018-02-20  Akira Kakuto  <kakuto@fuk.kindai.ac.jp>
diff --git a/texk/dvipsk/writet1.c b/texk/dvipsk/writet1.c
index 0fcf26907..3b478b900 100644
--- a/texk/dvipsk/writet1.c
+++ b/texk/dvipsk/writet1.c
@@ -1447,11 +1447,13 @@ static void t1_check_unusual_charstring(void)
          * space before appending the next line
          */
         *(strend(t1_buf_array) - 1) = ' ';
 
         t1_getline();
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcat(t1_buf_array, t1_line_array);
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcpy(t1_line_array, t1_buf_array);
         t1_line_ptr = eol(t1_line_array);
     }
 }
 
diff --git a/texk/web2c/luatexdir/ChangeLog b/texk/web2c/luatexdir/ChangeLog
index 62d4ab049..7219983d4 100644
--- a/texk/web2c/luatexdir/ChangeLog
+++ b/texk/web2c/luatexdir/ChangeLog
@@ -1,5 +1,9 @@
+2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
+	* fonts/writet1.w (t1_check_unusual_charstring): protect against
+	buffer overflow.
+
 2018-08-27 Luigi Scarso <luigi.scarso@gmail.com>
 	* dropped dependency from gmp and mpfr
 
 
 2017-11-02 Luigi Scarso <luigi.scarso@gmail.com>
diff --git a/texk/web2c/luatexdir/font/writet1.c b/texk/web2c/luatexdir/font/writet1.c
index 0a0cadcfb..d3bf29341 100644
--- a/texk/web2c/luatexdir/font/writet1.c
+++ b/texk/web2c/luatexdir/font/writet1.c
@@ -1579,11 +1579,13 @@ static void t1_check_unusual_charstring(void)
     int i;
     /*tex If no number follows |/CharStrings|, let's read the next line. */
     if (sscanf(p, "%i", &i) != 1) {
         strcpy(t1_buf_array, t1_line_array);
         t1_getline();
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcat(t1_buf_array, t1_line_array);
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcpy(t1_line_array, t1_buf_array);
         t1_line_ptr = eol(t1_line_array);
     }
 }
 
diff --git a/texk/web2c/pdftexdir/ChangeLog b/texk/web2c/pdftexdir/ChangeLog
index 9fbb81149..6e936a061 100644
--- a/texk/web2c/pdftexdir/ChangeLog
+++ b/texk/web2c/pdftexdir/ChangeLog
@@ -1,5 +1,10 @@
+2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>
+
+	* writet1.c (t1_check_unusual_charstring): protect against buffer
+	overflow.
+
 2018-09-09  Karl Berry  <karl@tug.org>
 
 	* expanded.test,
 	* ttf2afm.test: LC_ALL=LANGUAGE=C.
 
diff --git a/texk/web2c/pdftexdir/writet1.c b/texk/web2c/pdftexdir/writet1.c
index d191b77ee..8cfc2616c 100644
--- a/texk/web2c/pdftexdir/writet1.c
+++ b/texk/web2c/pdftexdir/writet1.c
@@ -1596,11 +1596,13 @@ static void t1_check_unusual_charstring(void)
          * space before appending the next line
          */
         *(strend(t1_buf_array) - 1) = ' ';
 
         t1_getline();
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcat(t1_buf_array, t1_line_array);
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
         strcpy(t1_line_array, t1_buf_array);
         t1_line_ptr = eol(t1_line_array);
     }
 }
 

Fixed code: 2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>

	* writet1.c (t1_check_unusual_charstring): protect against buffer
	overflow.

        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
2018-09-18 Nick Roessler <nicholas.e.roessler@gmail.com>
	* fonts/writet1.w (t1_check_unusual_charstring): protect against
	buffer overflow.

        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
2018-09-18  Nick Roessler  <nicholas.e.roessler@gmail.com>

	* writet1.c (t1_check_unusual_charstring): protect against buffer
	overflow.

        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);