July 2007 - ntg-pdftex - NTG Mailing Lists

[ pdftex-Bugs-830 ] 'pdftex %' causes segmentation fault (1.50.0-alpha-20070709)
by noreply＠sarovar.org 13 Jul '07

13 Jul '07

Bugs item #830, was opened at 2007-07-13 20:51 You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=830&group_id=106 Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: Robin Houston (robinhouston) Assigned to: Nobody (None) Summary: 'pdftex %' causes segmentation fault (1.50.0-alpha-20070709) Initial Comment: Run 'pdftex %' and then press return at the prompt. This causes a segmentation fault on my machine. I will recompile with debugging, and try to locate the source of the fault. ---------------------------------------------------------------------- >Comment By: Robin Houston (robinhouston) Date: 2007-07-13 21:59 Message: Logged In: YES user_id=4579 Is it possible that this bug is actually present in honest-to-goodness TeX? The end_name procedure does not seem to have been changed by pdfTeX, and: [robin pdftex]$ tex % This is TeX, Version 3.141592 (Web2C 7.5.6) * Segmentation fault On the other hand, I cannot reproduce it with either pdfeTeX, Version 3.14159-1.10b-2.1 (Web2C 7.4.5) or TeX, Version 3.14159 (Web2C 7.4.5) on Linux, so perhaps Web2C is actually to blame. I am hoping that one of you understands this better than I do! Robin ---------------------------------------------------------------------- Comment By: Robin Houston (robinhouston) Date: 2007-07-13 21:27 Message: Logged In: YES user_id=4579 I was thwarted for a while by the fact that build.sh strips the executables! Anyway, here is the backtrace: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x01737000 0x0004f1a4 in endname () at pdftex1.c:4441 4441 mustquote = strpool [j ]== 32 ; (gdb) bt #0 0x0004f1a4 in endname () at pdftex1.c:4441 #1 0x000502e8 in scanfilename () at pdftex1.c:4722 #2 0x00050f30 in startinput () at pdftex1.c:4941 #3 0x0002043c in mainbody () at pdftexini.c:5750 #4 0x000bbe1c in main (ac=2, av=0xbffff900) at pdftexextra.c:353 ---------------------------------------------------------------------- You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=830&group_id=106

1 0

[ pdftex-Bugs-830 ] 'pdftex %' causes segmentation fault (1.50.0-alpha-20070709)
by noreply＠sarovar.org 13 Jul '07

13 Jul '07

Bugs item #830, was opened at 2007-07-13 20:51 You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=830&group_id=106 Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: Robin Houston (robinhouston) Assigned to: Nobody (None) Summary: 'pdftex %' causes segmentation fault (1.50.0-alpha-20070709) Initial Comment: Run 'pdftex %' and then press return at the prompt. This causes a segmentation fault on my machine. I will recompile with debugging, and try to locate the source of the fault. ---------------------------------------------------------------------- >Comment By: Robin Houston (robinhouston) Date: 2007-07-13 21:27 Message: Logged In: YES user_id=4579 I was thwarted for a while by the fact that build.sh strips the executables! Anyway, here is the backtrace: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_INVALID_ADDRESS at address: 0x01737000 0x0004f1a4 in endname () at pdftex1.c:4441 4441 mustquote = strpool [j ]== 32 ; (gdb) bt #0 0x0004f1a4 in endname () at pdftex1.c:4441 #1 0x000502e8 in scanfilename () at pdftex1.c:4722 #2 0x00050f30 in startinput () at pdftex1.c:4941 #3 0x0002043c in mainbody () at pdftexini.c:5750 #4 0x000bbe1c in main (ac=2, av=0xbffff900) at pdftexextra.c:353 ---------------------------------------------------------------------- You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=830&group_id=106

1 0

[ pdftex-Bugs-830 ] 'pdftex %' causes segmentation fault (1.50.0-alpha-20070709)
by noreply＠sarovar.org 13 Jul '07

13 Jul '07

Bugs item #830, was opened at 2007-07-13 20:51 You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=830&group_id=106 Category: None Group: None Status: Open Resolution: None Priority: 5 Submitted By: Robin Houston (robinhouston) Assigned to: Nobody (None) Summary: 'pdftex %' causes segmentation fault (1.50.0-alpha-20070709) Initial Comment: Run 'pdftex %' and then press return at the prompt. This causes a segmentation fault on my machine. I will recompile with debugging, and try to locate the source of the fault. ---------------------------------------------------------------------- You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=830&group_id=106

1 0

Re: [NTG-pdftex] Xpdf 3.02 security hole (fwd)
by Thanh Han The 13 Jul '07

13 Jul '07

----- Forwarded message from Ludwig Nussel <ludwig.nussel(a)suse.de> ----- > From: Ludwig Nussel <ludwig.nussel(a)suse.de> > Date: Fri, 13 Jul 2007 14:24:06 +0200 > To: "Derek B. Noonburg" <derekn(a)foolabs.com> > Cc: than(a)redhat.com, var(a)sgi.com, mike(a)easysw.com, secalert(a)redhat.com, > security(a)gentoo.org, security(a)kde.org, hanthethanh(a)gmail.com, > Fabrice.Popineau(a)supelec.fr, security(a)suse.de > Subject: Re: Xpdf 3.02 security hole > > Josh Bressers wrote: > > > A security hole in Xpdf 3.02 has been reported. I'm attaching the patch > > > file. I'm currently expecting this to be disclosed early next week. > > > > > > > Hi Derek, > > > > Please use CVE-2007-3387 for this flaw. Am I right in assuming that the > > flaw here is an integer overflow? > > IMO the crucial part is the changed check for nComps > gfxColorMaxComps as > nComps is used later as upper bound for an offset into > Guchar upLeftBuf[gfxColorMaxComps * 2 + 1]; > The patch removes the check width >= INT_MAX / nComps / nBits though which > should be kept nevertheless IMO: > > --- xpdf-3.02.orig/xpdf/Stream.cc > +++ xpdf-3.02/xpdf/Stream.cc > @@ -410,15 +410,15 @@ StreamPredictor::StreamPredictor(Stream > ok = gFalse; > > nVals = width * nComps; > - if (width <= 0 || nComps <= 0 || nBits <= 0 || > - nComps >= INT_MAX / nBits || > - width >= INT_MAX / nComps / nBits || > - nVals * nBits + 7 < 0) { > - return; > - } > pixBytes = (nComps * nBits + 7) >> 3; > rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; > - if (rowBytes <= 0) { > + if (width <= 0 || nComps <= 0 || nBits <= 0 || > + nComps > gfxColorMaxComps || > + width >= INT_MAX / nComps / nBits || > + nBits > 16 || > + nVals <= 0 || > + nVals * nBits + 7 <= 0 || > + rowBytes <= 0) { > return; > } > predLine = (Guchar *)gmalloc(rowBytes); > > cu > Ludwig > > -- > (o_ Ludwig Nussel > //\ > V_/_ http://www.suse.de/ > SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) > ----- End forwarded message -----

1 0

Xpdf 3.02 security hole (fwd)
by Thanh Han The 13 Jul '07

13 Jul '07

----- Forwarded message from "Derek B. Noonburg" <derekn(a)foolabs.com> ----- > From: "Derek B. Noonburg" <derekn(a)foolabs.com> > Date: Thu, 12 Jul 2007 16:19:10 -0700 (PDT) > To: than(a)redhat.com, var(a)sgi.com, mike(a)easysw.com, secalert(a)redhat.com, > security(a)gentoo.org, security(a)kde.org, ludwig.nussel(a)suse.de, > hanthethanh(a)gmail.com, Fabrice.Popineau(a)supelec.fr > cc: derekn(a)foolabs.com > Subject: Xpdf 3.02 security hole > > A security hole in Xpdf 3.02 has been reported. I'm attaching the patch > file. I'm currently expecting this to be disclosed early next week. > > - Derek > *** xpdf-3.02-orig/xpdf/Stream.cc Tue Feb 27 14:05:52 2007 > --- xpdf-3.02/xpdf/Stream.cc Thu Jul 12 15:55:49 2007 > *************** > *** 410,424 **** > ok = gFalse; > > nVals = width * nComps; > - if (width <= 0 || nComps <= 0 || nBits <= 0 || > - nComps >= INT_MAX / nBits || > - width >= INT_MAX / nComps / nBits || > - nVals * nBits + 7 < 0) { > - return; > - } > pixBytes = (nComps * nBits + 7) >> 3; > rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; > ! if (rowBytes <= 0) { > return; > } > predLine = (Guchar *)gmalloc(rowBytes); > --- 410,423 ---- > ok = gFalse; > > nVals = width * nComps; > pixBytes = (nComps * nBits + 7) >> 3; > rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; > ! if (width <= 0 || nComps <= 0 || nBits <= 0 || > ! nComps > gfxColorMaxComps || > ! nBits > 16 || > ! nVals <= 0 || > ! nVals * nBits + 7 <= 0 || > ! rowBytes <= 0) { > return; > } > predLine = (Guchar *)gmalloc(rowBytes); ----- End forwarded message -----

1 0

1.40.4 incoming
by Martin Schröder 10 Jul '07

10 Jul '07

Hi, I want to leave for TUG2007 with a released 1.40.4. The svn has in branches/stable the current version of 1.40.4. Please test and tell me what I've forgotten. :-) Best Martin

3 5

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 10 Jul '07

10 Jul '07

> 2007/7/10, Taco Hoekwater <taco(a)elvenkind.com>: > > I vote for Phil's approach. I suspect most of the people that do > > not know how to generate an EOF in the console will not understand > > the key press reference either. > > > > Besides, tricks like dummy strings tend to lead to bugs in the years > > to come. (said as the person who just spend a whole day figuring out > > that the weird "file_name_size=maxint" statement in tex.ch is part > > of a trick to simplify openclose.c as it forces the "namelength" var > > to be of the correct allocation size). > > Agreed. KISS :-) luaTeX does not use tex.ch. For Taco's convenience, I've tried to make a patch: Best regards, Akira --- luatex.ch.orig Mon Jul 09 20:34:16 2007 +++ luatex.ch Tue Jul 10 23:13:12 2007 @@ -1404,12 +1404,20 @@ @y var k:0..buf_size; {index into |buffer|} @!saved_cur_name:str_number; {to catch empty terminal input} +@!saved_cur_ext:str_number; {to catch empty terminal input} +@!saved_cur_area:str_number; {to catch empty terminal input} @z @x if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; +print_ln; print("(Enter the null string to re-try, or <eof> to exit"); +if (e<>"") then + begin + print(" Default file extension is `"); print(e); print("'"); + end; +print(")"); print_ln; @z @x @@ -1417,9 +1425,17 @@ if cur_ext="" then cur_ext:=e; @y saved_cur_name:=cur_name; +saved_cur_ext:=cur_ext; +saved_cur_area:=cur_area; clear_terminal; prompt_input(": "); @<Scan file name in the buffer@>; -if cur_ext="" then cur_ext:=e; -if length(cur_name)=0 then cur_name:=saved_cur_name; +if (length(cur_name)=0) and (cur_ext="") and (cur_area="") then + begin + cur_name:=saved_cur_name; + cur_ext:=saved_cur_ext; + cur_area:=saved_cur_area; + end +else + if cur_ext="" then cur_ext:=e; @z @x

1 0

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 10 Jul '07

10 Jul '07

> > Uh, isn't EOF operating-system dependent? Like C-z on Microsoft > > Systems? > > I'll apply the following ctrld-ctrlz.ch for Windows: > > @x > print_ln; print("(Retry if file name is empty or CTRL-D to exit."); > @y > print_ln; print("(Retry if file name is empty or CTRL-Z + Enter to exit."); > @z In this case, we may not be able to use the common pool files. Is EOF by Philip Taylor better? Best regards, Akira

6 7

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 09 Jul '07

09 Jul '07

Hi David, > > --- tex.ch.orig Mon Jul 09 19:43:46 2007 > > +++ tex.ch Mon Jul 09 22:56:15 2007 > > @@ -2218,7 +2218,7 @@ > > if e=".tex" then show_context; > > @y > > if (e=".tex") or (e="") then show_context; > > -print_ln; print("(Retry if file name is empty."); > > +print_ln; print("(Retry if file name is empty or CTRL-D to exit."); > > if (e<>"") then > > begin > > print(" Default file extension is `"); print(e); print("'"); > > Uh, isn't EOF operating-system dependent? Like C-z on Microsoft > Systems? I'll apply the following ctrld-ctrlz.ch for Windows: @x print_ln; print("(Retry if file name is empty or CTRL-D to exit."); @y print_ln; print("(Retry if file name is empty or CTRL-Z + Enter to exit."); @z Thanks, Akira

1 0

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 09 Jul '07

09 Jul '07

Hi Martin, > > The latest version of 746 (retry), changed by Heiko himself, is the > > following. > > I've applied it. Thanks very much. However you have applied the original one. Heiko had updated, according to the opinion by Karl, as follows (patch to the one in the pdftex svn): Best regards, Akira --- tex.ch.orig Mon Jul 09 19:43:46 2007 +++ tex.ch Mon Jul 09 22:56:15 2007 @@ -2218,7 +2218,7 @@ if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; -print_ln; print("(Retry if file name is empty."); +print_ln; print("(Retry if file name is empty or CTRL-D to exit."); if (e<>"") then begin print(" Default file extension is `"); print(e); print("'");

4 3