transfig/0015-CVE-2020-21532.patch

From ae23821f5959ee7c6d10cf0219fad013d3469a6f Mon Sep 17 00:00:00 2001
From: Ondrej Dubaj <odubaj@redhat.com>
Date: Tue, 21 Sep 2021 10:35:53 +0200
Subject: [PATCH] Accept -1 as default TeX font, fixes ticket #81

The default for PostScript fonts is -1, for TeX fonts 0. Accepting -1 for TeX
fonts lead to out-of-bound read. Now, -1 for TeX fonts is converted to 0.

Accept -1 TeX font in more places, fixes #71, #75

Continue the work started in commit [00cded]. Fix the fundamental issue of
tickets #71 and #75, which was hidden by commit [d70e4b].
---
 fig2dev/dev/genpict2e.c |  9 +++++----
 fig2dev/dev/gentikz.c   |  9 +++++----
 fig2dev/dev/texfonts.h  | 14 +++++++++-----
 fig2dev/tests/read.at   | 14 +++++++++++++-
 4 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/fig2dev/dev/genpict2e.c b/fig2dev/dev/genpict2e.c
index 9f828f0..22daedd 100644
--- a/fig2dev/dev/genpict2e.c
+++ b/fig2dev/dev/genpict2e.c
@@ -2222,11 +2222,12 @@ put_font(F_text *t)
 	}
 
 	if (psfont_text(t))
-	    fprintf(tfp, "\\usefont%s",
-		    texpsfonts[t->font <= MAX_PSFONT ? t->font + 1 : 0]);
+	    fprintf(tfp, "\\usefont%s", texpsfonts[t->font <= MAX_PSFONT ?
+				t->font + 1 : 0]);
 	else
-	    fprintf(tfp, "\\normalfont%s ",
-		    texfonts[t->font <= MAX_FONT ? t->font : MAX_FONT - 1]);
+	    /* Default psfont is -1, default texfont 0, also accept -1. */
+		fprintf(tfp, "\\normalfont%s ", texfonts[t->font <= MAX_FONT ?
+				(t->font >= 0 ? t->font : 0) : MAX_FONT - 1]);
 }
 
 void
diff --git a/fig2dev/dev/gentikz.c b/fig2dev/dev/gentikz.c
index 96ee41c..6d8aff4 100644
--- a/fig2dev/dev/gentikz.c
+++ b/fig2dev/dev/gentikz.c
@@ -1771,11 +1771,12 @@ put_font(F_text *t)
 	}
 
 	if (psfont_text(t))
-	    fprintf(tfp, "\\usefont%s",
-		    texpsfonts[t->font <= MAX_PSFONT ? t->font + 1 : 0]);
+	    fprintf(tfp, "\\usefont%s", texpsfonts[t->font <= MAX_PSFONT ?
+				t->font + 1 : 0]);
 	else
-	    fprintf(tfp, "\\normalfont%s ",
-		    texfonts[t->font <= MAX_FONT ? t->font : MAX_FONT - 1]);
+	    /* Default psfont is -1, default texfont 0, also accept -1. */
+		fprintf(tfp, "\\normalfont%s ", texfonts[t->font <= MAX_FONT ?
+			    (t->font >= 0 ? t->font : 0) : MAX_FONT - 1]);
 }
 
 /*
diff --git a/fig2dev/dev/texfonts.h b/fig2dev/dev/texfonts.h
index 89097f2..e5254b6 100644
--- a/fig2dev/dev/texfonts.h
+++ b/fig2dev/dev/texfonts.h
@@ -35,17 +35,21 @@ extern char		texfontsizes[];
 #define MAXFONTSIZE	42
 
 #ifdef NFSS
-#define TEXFAMILY(F)	(texfontfamily[((F) <= MAX_FONT) ? (F) : (MAX_FONT-1)])
-#define TEXSERIES(F)	(texfontseries[((F) <= MAX_FONT) ? (F) : (MAX_FONT-1)])
-#define TEXSHAPE(F)	(texfontshape[((F) <= MAX_FONT) ? (F) : (MAX_FONT-1)])
+#define TEXFAMILY(F)	texfontfamily[(F) <= MAX_FONT ? ((F) >= 0 ? (F) : 0) \
+						: MAX_FONT-1]
+#define TEXSERIES(F)	texfontseries[(F) <= MAX_FONT ? ((F) >= 0 ? (F) : 0) \
+						: MAX_FONT-1]
+#define TEXSHAPE(F)	texfontshape[(F) <= MAX_FONT ? ((F) >= 0 ? (F) : 0) \
+						: MAX_FONT-1]
 #endif
-#define TEXFONT(F)	(texfontnames[((F) <= MAX_FONT) ? (F) : (MAX_FONT-1)])
+#define TEXFONT(F)	texfontnames[(F) <= MAX_FONT ? ((F) >= 0 ? (F) : 0) \
+						: MAX_FONT-1]
 
 /*
 #define TEXFONTSIZE(S)	(texfontsizes[((S) <= MAXFONTSIZE) ? (int)(round(S))\
 							: (MAXFONTSIZE-1)])
 */
-#define TEXFONTSIZE(S)	(((S) <= MAXFONTSIZE) ? texfontsizes[(int)(round(S))] : (S))
+#define TEXFONTSIZE(S)	((S) <= MAXFONTSIZE ? texfontsizes[(int)round(S)] : (S))
 #define TEXFONTMAG(T)	TEXFONTSIZE(T->size*(rigid_text(T) ? 1.0 : fontmag))
 
 void setfigfont(F_text *text);		/* genepic.c */
diff --git a/fig2dev/tests/read.at b/fig2dev/tests/read.at
index c53fbb9..d85356b 100644
--- a/fig2dev/tests/read.at
+++ b/fig2dev/tests/read.at
@@ -406,7 +406,7 @@ EOF
 ])
 AT_CLEANUP
 
-AT_SETUP([allow tex font -1, ticket #81])
+AT_SETUP([allow tex font -1, tickets #71, #75, #81])
 AT_KEYWORDS([pict2e tikz])
 AT_DATA([text.fig], [FIG_FILE_TOP
 4 0 0 50 -1 -1 12 0.0 0 150 405 0 0 Text\001
@@ -415,6 +415,8 @@ AT_CHECK([fig2dev -L pict2e text.fig
 ], 0, ignore)
 AT_CHECK([fig2dev -L tikz text.fig
 ], 0, ignore)
+AT_CHECK([fig2dev -L mp text.fig
+], 0, ignore)
 AT_CLEANUP
 
 AT_SETUP([reject ASCII NUL ('\0') in input, ticket #80])
@@ -430,6 +432,16 @@ EOF
 ], 1, ignore, ignore)
 AT_CLEANUP
 
+AT_SETUP([allow tex font -1, ticket #81])
+AT_DATA([text.fig], [FIG_FILE_TOP
+4 0 0 50 -1 -1 12 0.0 0 150 405 0 0 Text\001
+])
+AT_CHECK([fig2dev -L pict2e text.fig
+], 0, ignore)
+AT_CHECK([fig2dev -L tikz text.fig
+], 0, ignore)
+AT_CLEANUP
+
 AT_BANNER([Dynamically allocate picture file name.])
 
 AT_SETUP([prepend fig file path to picture file name])
-- 
2.31.1