Blame SOURCES/texlive-20130427_r30134-CVE-2018-17407.patch

c0528d
diff -up texlive-20130427_r30134/source/texk/dvipsk/writet1.c.orig texlive-20130427_r30134/source/texk/dvipsk/writet1.c
c0528d
--- texlive-20130427_r30134/source/texk/dvipsk/writet1.c.orig	2013-04-25 19:16:48.000000000 +0100
c0528d
+++ texlive-20130427_r30134/source/texk/dvipsk/writet1.c	2019-07-25 12:37:43.385859300 +0100
c0528d
@@ -1447,7 +1447,9 @@ static void t1_check_unusual_charstring(
c0528d
         *(strend(t1_buf_array) - 1) = ' ';
c0528d
 
c0528d
         t1_getline();
c0528d
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
c0528d
         strcat(t1_buf_array, t1_line_array);
c0528d
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
c0528d
         strcpy(t1_line_array, t1_buf_array);
c0528d
         t1_line_ptr = eol(t1_line_array);
c0528d
     }
c0528d
diff -up texlive-20130427_r30134/source/texk/web2c/pdftexdir/writet1.c.orig texlive-20130427_r30134/source/texk/web2c/pdftexdir/writet1.c
c0528d
--- texlive-20130427_r30134/source/texk/web2c/pdftexdir/writet1.c.orig	2013-04-25 19:16:47.000000000 +0100
c0528d
+++ texlive-20130427_r30134/source/texk/web2c/pdftexdir/writet1.c	2019-07-25 12:37:43.386859270 +0100
c0528d
@@ -1596,7 +1596,9 @@ static void t1_check_unusual_charstring(
c0528d
         *(strend(t1_buf_array) - 1) = ' ';
c0528d
 
c0528d
         t1_getline();
c0528d
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
c0528d
         strcat(t1_buf_array, t1_line_array);
c0528d
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
c0528d
         strcpy(t1_line_array, t1_buf_array);
c0528d
         t1_line_ptr = eol(t1_line_array);
c0528d
     }
c0528d
--- texlive-2012/source/texk/web2c/luatexdir/font/writet1.w.orig	2019-08-26 18:40:06.981813698 +0200
c0528d
+++ texlive-2012/source/texk/web2c/luatexdir/font/writet1.w	2019-08-26 18:39:31.394605507 +0200
c0528d
@@ -1638,7 +1638,9 @@
c0528d
     if (sscanf(p, "%i", &i) != 1) { 
c0528d
         strcpy(t1_buf_array, t1_line_array);
c0528d
         t1_getline();
c0528d
+        alloc_array(t1_buf, strlen(t1_line_array) + strlen(t1_buf_array) + 1, T1_BUF_SIZE);
c0528d
         strcat(t1_buf_array, t1_line_array);
c0528d
+        alloc_array(t1_line, strlen(t1_buf_array) + 1, T1_BUF_SIZE);
c0528d
         strcpy(t1_line_array, t1_buf_array);
c0528d
         t1_line_ptr = eol(t1_line_array);
c0528d
     }