Attachment #135310 for bug #198238




2007-07-02  Joachim Schrod  <jschrod@acm.org>

	* dvi2xx.c (DoSpecial): Security issue: usage of tmpnam() caused
	tempfile race condition. I use mkdtemp() if it's available and
	fall back to tmpnam.

	Special parsing of include files was inconsistent, unify it. The
	current parsing code still allows lots of non-sensical special
	commands, but at least it doesn't access unrelated variables any
	more.

2007-06-28  Joachim Schrod  <jschrod@acm.org>

	* dvi2xx.c: Fixed a whole bunch of buffer overflows: The program
	did not check memory bounds for any string operation. All places
	where strings are copied with strcpy are replaced by dynamically
	allocated strings (with xstrdup from kpathsea) or bounded string
	operations. Fixed also manual string copy operations on special
	strings. Fixed array buffer overflow in defpoint and fill special
	operations.
	(DoSpecial): Call of ghostscript for psfile special had also a
	potential buffer overflow caused by unchecked usage of sprintf.
	Fix core dump: Check if all required parameters of psfile special
	are passed.

	Bumped version number up to 2.6p3.

	* dvi2xx.h: Some fixed sized string arrays are pointers now, they
	get dynamically allocated.
	(GetBytes): Another buffer overflow: Check that the buffer size is
	sufficient to store the read bytes. That relies on the invariant
	that the GetBytes macro is always called with an array as argument
	and not with a pointer.

	* config.h: Throw an error if kpathsea is not used. dvi2xx.c
	had previously already kpathsea dependencies without protecting
	them with #if KPATHSEA. We go that road further since upstream
	does not exist any more.

Tue Mar  3 10:17:03 1998  Sebastian Rahtz  <s.rahtz@elsevier.co.uk>

	* config.h: Markus Gyger <mgyger@osf1.gmu.edu> fix of config

	Olaf Weber
Sat Jan 17 15:09:59 1998  Sebastian Rahtz  <s.rahtz@elsevier.co.uk>

	* assorted patches from Peter Breitenlohner, Olaf Weber,
 	Eli Zaretskii, Fabrice Popineau etc. Hope it all still works.



Mon Dec  9 00:53:30 1996  Ulrik Vieth  <vieth@thphy.uni-duesseldorf.de>

	* dvihp: Use `basename $0` in usage and version messages for
 	consistency with other programs and scripts.
	Also accept -help, -version in addition to --help, --version.

Sat Dec  7 17:15:54 1996  Karl Berry  <karl@cs.umb.edu>

Fri Dec 30 15:25:54 1994  Karl Berry  <karl@cs.umb.edu>

        * Makefile.in (install-exec): Don't depend on default, so dvilj4
        doesn't get made if the user didn't want it.
        (install-data): mkdirchain on texinputdir and fontdir.
        From Joachim.


        * config.h (RESOLUTION, MFMODE) [LJ4L]: Set to 300/cx for this new
        symbol.

        * dvi2xx.c (DecodeArgs): Always scale pgsiz_dots.
        (main) [LJ4]: Don't hardwire 600dpi.
        These fixes from ajp@eng.cam.ac.uk.


Lines 14-18 dnl These tests prevent reliable cross-c Link Here

(-)tetex-src-3.0/texk/dviljk/configure.in (+2 lines)
14	AC_C_CHAR_UNSIGNED	14	AC_C_CHAR_UNSIGNED
15	AC_CHECK_SIZEOF(long)	15	AC_CHECK_SIZEOF(long)
16		16
		17	AC_CHECK_FUNCS(rmdir unlink mkdtemp)
		18
17	KPSE_CONFIG_FILES([Makefile])	19	KPSE_CONFIG_FILES([Makefile])
18	AC_OUTPUT	20	AC_OUTPUT




/* $Id: dvi2xx.c,v 2.5 1997/12/08 20:52:20 neumann Exp $ */
#define VERSION "dviljk (version 2.6p3)"
/*
#define DEBUGGS 1
*/

# endif
#endif

  /* Initialize pixel_files */
  for (i = 0; i <= MAXOPEN; i++)
    pixel_files[i].pixel_file_id = FPNULL;


  y_origin = YDEFAULTOFF; /* y-origin in dots                    */

  setbuf(ERR_STREAM, NULL);
  G_progname = argv[0];
#ifdef KPATHSEA
  kpse_set_progname(argv[0]);
  kpse_set_program_enabled (kpse_pk_format, MAKE_TEX_PK_BY_DEFAULT, kpse_src_compile);

  EMIT1("@PJL SET PAGEPROTECT=OFF\012");
  EMIT1("@PJL ENTER LANGUAGE=PCL\012");
  if (econoMode && LJ6)
      EMIT1("@PJL SET ECONOMODE=ON\012");
  EMIT3("\033&u%dD\033*t%dR",RESOLUTION,RESOLUTION);
  if (econoMode && !LJ6)
    EMIT1("\033*v1T");

          /*
            fprintf(ERR_STREAM,"FirstPart\n count %d, mod %d, pp %d\n",(int)count[0],(int)count[0]%2,PageParity);
            */
          SkipMode =
            (bool)(PageParity != (short)((count[0]<0 ?
                                          labs(count[0])+1 : count[0])%2));
          if (count[0] == 0) SkipMode = (bool)!SkipMode;
        }

   is not buffered. */

/* read a buffered byte */
char
#if NeedFunctionPrototypes
b_read(FILEPTR spfp)
#else

}

#ifdef RISC_BUFFER
void
#if NeedFunctionPrototypes
b_write(FILEPTR spfp, char c) /* write a buffered byte */
#else

  buffout[boact++] = c;
}

void
#if NeedFunctionPrototypes
b_wrtmult(FILEPTR spfp, char *buf, int len) /* write a sequence of bytes to the output buffer */
#else

    write_multi(buffout,1,boact,spfp);
    /* Copy only small blocks; large ones are written directly */
    if (len < (BUFFSIZE/4)) {
      for (i = 0; i<len; i++)
        buffout[i] = buf[i];
      boact = len;
    } else {
      write_multi(buf,1,len,spfp);
      boact = 0;
    }
  }
  else {
    for (i = 0; i<len; i++)
      buffout[boact++] = buf[i];
  }
}

/* flush the output buffer */
void
#if NeedFunctionPrototypes
b_oflush(FILEPTR spfp)
#else

/***************************** CopyHPFile ******************************/
/*********************************************************************/
#if NeedFunctionPrototypes
int getnum(FILEPTR spfp, char *t, char *numstr)
#else
int getnum(spfp, t, numstr)
FILEPTR spfp;
char *t, *numstr;
#endif

}

#if NeedFunctionPrototypes
void setOffset(char dir, char sign, int pos)
#else
void setOffset(dir, sign, pos, first)
char dir, sign;
int pos;
#endif
{
  if ((sign == '+' || sign == '-') && pos > 0 ) {
    EMIT4("\033*p%c%d%c",sign,pos,dir);
#ifdef DEBUGGS
    fprintf(stderr, "relative: *p%c%d%c\n", sign, pos, dir);
#endif
  } else if (pos>0) {
    EMIT3("\033*p%d%c",pos,dir);
#ifdef DEBUGGS
    fprintf(stderr, "absolute: *p%d%c\n", pos, dir);
#endif
    if (dir == 'X')
      last_rx = pos;
    else
      last_ry = pos;
  } else {
    /*EMIT3("\033*p%d%c",pos,dir);*/
#ifdef DEBUGGS
    fprintf(stderr, "Relative: *p%d%c\n", pos, dir);
#endif
  }

     unwanted commands from the input file and outputs the rest */

  /* reset the input buffer */
  binumber = 0;
  biact = 0;

  qfprintf(ERR_STREAM," [%s", str);

          /* of the commands (x first, y first) */

          if (t=='Y' || t=='y') {
            if (numstr[0]!='+' && numstr[0]!='-' && num<miny)
              miny = num;
            if (t=='y') {
              num = getnum(spfp, &t, numstr);
              if (numstr[0]!='+' && numstr[0]!='-' && num<minx)
                minx = num;
            }
          }
          if (t=='X' || t=='x') {
            if (numstr[0]!='+' && numstr[0]!='-' && num<minx)
              minx = num;

            if (t=='x') {

  }
  qfprintf(ERR_STREAM," [%s", str);
  /* reset input buffer again */
  binumber = 0;
  biact = 0;


  /* Pass through the input file again but this time output the */
  /* retained PCL commands */
#ifdef DEBUGGS
  fprintf(stderr,"\nminx=%d, miny=%d, xg=%d, yg=%d\n",
          minx, miny, x_goffset, y_goffset);
#endif
  do {
    t = (char)b_read(spfp);
    if (t==0x1B) {

            } else {
              setOffset('Y',numstr[0], num);
            }

            if (t == 'y') {
              num = getnum(spfp, &t,numstr);
              if (numstr[0]!='+' && numstr[0]!='-') {

              }
            }
          }

          if (t=='X' || t=='x') {
            if (numstr[0]!='+' && numstr[0]!='-') {
              /*Add in the correct horizontal offset*/
              setOffset('X',numstr[0],
                        num - minx + (int)PIXROUND(h,hconv) + x_goffset);
            } else {
              setOffset('X',numstr[0], num);
            }

            if (t=='x') {
              num = getnum(spfp, &t,numstr);
              if (numstr[0]!='+' && numstr[0]!='-') {

        case(0x63):
          /* Rectangular draw commands */
          EMIT1("\033*c");
          for (t = (char)b_read(spfp); t<0x40 || t>0x60;
               t = (char)b_read(spfp))
            EMITC(t);
          EMITC(t);

  long4 x = 0;      /* number being constructed */
  unsigned char h;
  while (n--) {
    x <<= 8;
    read_byte(fp,h);
    x |= h;
  }

#ifdef SIGN_DEBUG
  long4    x0;      /* copy of x  */
#endif
  read_byte(fp,h);
  x = h; /* get first (high-order) byte */
  n1 = n--;
  while (n--) {

                                        /* ---> result in DX       */

  if (  (regs.h.dl & 0x80)              /* file handle points to a device */
        && !(regs.h.dl & 0x07) ) {      /* neither console i/o or null    */

    regs.h.dl  |= 0x20;                 /* set BINARY bit in device info  */
    regs.h.ah = (unsigned char) 0x44;   /* IOCTL                  */

    /* For COMPRESSED CHARS */
    if (PrevSize < nbpl) {
      PrevSize = nbpl;
      if (PrevLine != NULL)
        free(PrevLine);
      if ((PrevLine = (unsigned char*)malloc(PrevSize*sizeof(char)))
          == NULL) {
        PrevSize = 0;
        Fatal("EmitChar: Out of memory error!\n");
      }
    }
    /* Clear seed line */
    for (i = 0; i<nbpl; i++)
      PrevLine[i] = 0;
    CChar_Off = 0;
    CChar_Last = -1;

    /* This bit copied from below... */
#  ifdef USEPXL
    if (fontptr->id == pk89)

        CompressedCharLine(ce,nbpl,sl);
      }
#  else
    for (i = num_rows; i > 0; i--)
      CompressedCharLine(ce,nbpl,(bits + (i-1)*nbpl));
#  endif /* USEPXL */
  }
  else
    CChar_Off = -1;
# endif /* LJ4 */


# ifdef LJ4
  /* printf("raw: %d (%d * %d), comp: %d\n",
     total,ce->width,ce->height,CChar_Off); */
  /* Characters that don't compress well are usually rather small so
     reading them again and writing them uncompressed won't take
     much time anyway. */
  if (CChar_Off > total)
    CChar_Off = -1;
  if (CChar_Off >= 0) {
    EMIT4("\033*c%sd%dE\033(s%ldW", cnv_buffer,

      }
#endif
    }

#ifdef IBM3812
#ifdef USEPXL
  used_fontstorage += (long4)ce->height * ((ce->width + 15) >> 4) * 2 + 14;

int     repeatcount;

void             /* <Read and translate raster description@>*/
#if NeedFunctionPrototypes
PkRaster(struct char_entry *ce, int raster)
#else
PkRaster(ce, raster)

      if (wordweight < 31) {
#ifdef COMMENT
# ifdef DRAWGLYPH
        {
          int k;
          for (k = 15; k>=0; k--) {
            if ((power[k] & word)!=0) printf("Z");

        for (j = 3; j >= (wordwidth * 4 - (long4)nbpl); j--) {
          OUTCHAR(((word >> (j << 3)) & 0xff));
#ifdef DRAWGLYPH
          {
            int k;
            for (k = 7; k>=0; k--) {
              if ((power[k] & ((word >> (j << 3)) & 0xff))!=0) printf("M");

        }

      }

      switch (raster) {
      case 1:
        RasterLine(ce, nbpl, current_line, raster_line_buf);
        current_line++;
        break;

            OUTCHAR((tl       & 0xFF));

#ifdef DRAWGLYPH
            {
              int k;
              for (k = 31; k>=0; k--) {
                if ((power[k] & row[ii])!=0) printf("M");

          for (j = 3; j >= (wordwidth *4 - (long4)nbpl); j--) {
            OUTCHAR(((tl >> (j << 3)) & 0xff));
#ifdef DRAWGLYPH
            {
              int k;
              for (k = 7; k>=0; k--) {
                if ((power[k] & ((tl >> (j << 3)) & 0xff))!=0) printf("M");

          }

          switch (raster) {
          case 1:
            RasterLine(ce, (unsigned int)nbpl, current_line, raster_line_buf);
            current_line++;
            break;


#ifdef LJ4
/* Compress a raster line in compression mode 2 */
int
#if NeedFunctionPrototypes
CompressLine2(unsigned char *buffer, unsigned char *buffout, int emitbytes)
#else

  char last,c;

  /* trap empty lines (otherwise problems with Packbits) */
  if (emitbytes == 0)
    return(0);
  /* Use Packbits compression (mode 2) on raster line */
  pos = buffer;
  litpos = buffer;
  pack = 1;
  ppos = buffout;
  last = *pos++;
  upper = buffer + emitbytes;
  while (pos < upper) {

      /* At least three equal bytes ==> write out preceding literal sequence */
      if ((pack == 3) && ((lit = (int)(pos - litpos - 3)) != 0)) {
        while (lit >= 128) {
          *ppos++ = 127;
          for (i = 1; i<=128; i++)
            *ppos++ = *litpos++;
          lit -= 128;
        }
        if (lit != 0) {
          *ppos++ = lit-1;
          while ((lit--) > 0)
            *ppos++ = *litpos++;
          /* litpos is now pos-3 (i.e. first of the sequence) */
        }

    }
    else {
      while (pack >= 128) {
        *ppos++ = 129;
        *ppos++ = last;
        litpos += 128;
        pack -= 128;
      }
      /* At least 3 equal bytes or 2 that don't break a literal sequence
         ==> write out packed sequence */
      if ((pack >= 3) || ((pack == 2) && (litpos == pos-3))) {
        *ppos++ = 257 - pack;
        *ppos++ = last;
        litpos += pack;
      }
      pack = 1;
      last = c;
    }
    if (ppos > (buffout + BUFFSIZE/2 - 129)) {

      return(0);
    }
  }

  while (pack >= 128) {
    *ppos++ = 129;
    *ppos++ = last;
    litpos += 128;
    pack -= 128;
  }
  if ((pack >= 3) || ((pack == 2) && (litpos == pos-3))) {
    *ppos++ = 257 - pack;
    *ppos++ = last;
    litpos += pack;
  }
  else if ((lit = (int)(pos - litpos)) != 0) {
    while (lit >= 128) {
      *ppos++ = 127;
      for (i = 1; i<=128; i++)
        *ppos++ = *litpos++;
      lit -= 128;
    }
    if (lit != 0) {
      *ppos++ = lit-1;
      while ((lit--) > 0)
        *ppos++ = *litpos++;
    }
  }

  int lit,i,pack;

  /* Use compression mode 3 */
  pos = buffer;
  ppos = buffout;
  upper = buffer + emitbytes;
  prev = PrevLine;
  while(pos < upper) {
    litpos = pos;
    while ((*prev == *pos) && (pos < upper)) {
      prev++;
      pos++;
    }
    if (pos < upper) {
      pack = (int)(pos - litpos);
      litpos = pos;
      i = upper - pos;
      if (i > 8)
        i = 8;
      while ((*pos != *prev) && (i > 0)) {
        *prev++ = *pos++;
        i--;
      }
      i = (int)(pos - litpos - 1);

        *ppos++ = lit + pack;
      }
      else {
        *ppos++ = lit + 31;
        pack -= 31;
        while (pack >= 255) {
          *ppos++ = 255;
          pack -= 255;
        }
        *ppos++ = pack;
      }
      while (i >= 0) {
        *ppos++ = *litpos++;
        i--;
      }
    }

/**********************************************************************/
void
#if NeedFunctionPrototypes
RasterLine(struct char_entry *ce, unsigned int nbpl,
           unsigned int current_line, unsigned char *buffer)
#else
RasterLine(ce, nbpl, current_line, buffer)

    EMIT2("\033*b%dW", emitbytes);
    EMITL(emitbytes, buffer);
    break;

  case 2:
    i = CompressLine2(buffer,buffin,emitbytes);
    EMIT2("\033*b%dW", i);
    EMITL(i,buffin);
    break;

  case 3:
    i = CompressLine3(buffer,buffin + BUFFSIZE/2,(int)nbpl);
    EMIT2("\033*b%dW", i);
    EMITL(i,buffin + BUFFSIZE/2);
    break;

  default:
    fprintf(ERR_STREAM,"Unsupported compression mode!\n");
  }
# else
  EMIT2("\033*b%dW", emitbytes);

  if (CompressCharMode == 3) {
    /* Check if PrevLine big enough; claim more space if not */
    if (((int)nbpl) > PrevSize) {
      if (PrevLine != NULL)
        free(PrevLine);
      if ((PrevLine = (unsigned char *)malloc(nbpl*sizeof(char))) == NULL) {
        PrevSize = 0;
        Fatal("RasterChar: out of memory!\n");
      }
      PrevSize = (int)nbpl;

  if (bytes > 0) {
    /* do NOT load Huge characters */
    if ((bytes > HUGE_CHAR_PATTERN) && (fontptr->id != pk89)) {
      qfprintf(ERR_STREAM,"Huge Character <%c> (%ld Bytes)\n",
               (char)c, bytes);
      ptr->charsize = HUGE_SIZE;
      ptr->where.isloaded = _FALSE;

    SetPosn(h, v);
  }

  /*
    fprintf(ERR_STREAM,
            "(%d) hh=%ld (+%ld/+%ld), h=%ld, xh=%ld,xhh=%ld, [%ld|%ld] ->%d\n",
            (int)do_posn,hh,(long4)ptr->cw,(long4)ptr->cw*(long4)hconv,h,

      int     tmp;
      char    sign;

      if (!do_posn)
        SetPosn(h, v);

#ifdef USEPXL

#endif
      if (tmp != 0) {
        if (tmp < 0) {
          sign = '-';
          tmp = -tmp;
        } else
          sign = '+';

#endif
      if (tmp != 0) {
        if (tmp < 0) {
          sign = '-';
          tmp = -tmp;
        } else
          sign = '+';

    fprintf(stderr,"--> hh(%ld) += cw(%ld) * hconv(%ld)",
            (long)hh, (long)ptr->cw, (long) hconv);
            */
#ifdef LJ
    /* the guessed position must be a multiple of pixels */
    if (RESOLUTION == 300)
      hh += (long4) ((ptr->cw)/4)*4*hconv;

  if (command <= SET4)
    h += ptr->tfmw;

  if (pos_after)
    SetPosn(h, v);
  else
    last_rx = (int)PIXROUND(h, hconv) + x_goffset;

  }
  fonts_used_on_this_page = 0;
#endif
  for (p = hfontptr; p; p = p->next)
    p->used_on_this_page = _FALSE;
}


  rx = (int)PIXROUND(x, hconv) + x_goffset;
  ry = (int)PIXROUND(y, vconv) + y_goffset;

  /*
  fprintf(ERR_STREAM,
	  "setposn to %ld/%ld, %d/%d, last: %d/%d\n",
	  (long)x,(long)y,

   offset in the buffer, CChar_Last is the first byte of the last
   compacted row (line repeat count).  Updates the previous line
   (PrevLine) if necessary. */
void
#if NeedFunctionPrototypes
CompressedCharLine(struct char_entry *ce, int nbpl, unsigned char *buffer)
#else
CompressedCharLine(ce, nbpl, buffer)
struct char_entry *ce;
int nbpl;
unsigned char *buffer;
#endif
{

    int t,mode,max;
    register int x,y,i;

    prev = PrevLine;
    obuf = buffer;
    end = buffer + nbpl;
    x = 0;
    while (obuf < end) {
      if (*obuf != *prev) {
        *prev = *obuf;
        x = 1;
      }
      obuf++;
      prev++;
    }
    if (x == 0 && CChar_Last >= 0) {
      (buffin[CChar_Last])++;
      return; /* line repeat count +1 */
    }

    end = buffin + BUFFSIZE - 16;
    obuf = buffin + CChar_Off;
    buff = buffer;
    *obuf++ = 0; /* Line repeat count = 0 */
    t = 0;
    CChar_Last = CChar_Off; /* Next line */
    mode = 0;
    y = *buff++;
    i = 7; /* i = current bit */
    while ((t < ce->width) && (obuf < end)) {
      max = ce->width - t; /* maximum pixels left to do */

      if (mode == 0) {
        /* white run */
        while ((y & (1<<i)) == 0 && x < max) {
          x++;
          i--;
          if (i < 0) {
            i = 7;
            y = *buff++;
            while (y == 0 && x < max) {
              x += 8;
              y = *buff++;
            }
          }

      else {
        /* black run */
        while ((y & (1<<i)) != 0 && x < max) {
          x++;
          i--;
          if (i < 0) {
            i = 7;
            y = *buff++;
            while (y == 0xff && x < max) {
              x += 8;
              y = *buff++;
            }
          }
        }
        mode = 0;
      }
      if (x > max)
        x = max;
      t += x;
      /* make precautions for very long runs */
      while (x > 0xff) {
        *obuf++ = 0xff;
        *obuf++ = 0;
        x -= 0xff;
      }
      *obuf++ = x;

#endif
{
  int     argind;            /* argument index for flags      */
  char    *curarea;	     /* current file area             */
  char    *curname;   	     /* current file name             */
  char    *tcp, *tcp1;       /* temporary character pointers  */
  char    *this_arg;
  double  x_offset = 0.0, y_offset = 0.0;

#endif
#endif

  if (argc == 2 && EQ(argv[1], "--version")) {
    extern KPSEDLL char *kpathsea_version_string;
    puts (VERSION);
    puts (kpathsea_version_string);
    puts ("Copyright (C) 1997 Gustaf Neumann.\n\
There is NO warranty.  You may redistribute this software\n\

For more information about these matters, see the files\n\
named COPYING and dvi2xx.c.\n\
Primary author of Dvi2xx: Gustaf Neumann; -k maintainer: K. Berry.");
    exit (0);
  }

#ifdef LJ4

#ifdef LJ2P
      case 'd':       /* d selects DUPLEX mode  */
        tcp++;
        if (*tcp == '1' )
          DuplexMode = 1;
        else if (*tcp == '2')
          DuplexMode = 2;
        else {
          Warning("Invalid DUPLEX mode, assuming DUPLEX=1, Long-Edge Binding");

        DoublePage = _TRUE;
        tcp++;
        if (*tcp == '1' || *tcp == '2') {
          if (*tcp == '2')
            PrintFirstPart = _FALSE;
          else
            PrintSecondPart = _FALSE;
          tcp++;
        }
        if (*tcp == '-')
          PrintEmptyPages = _FALSE;
        break;
#ifdef LJ4

#ifdef LJ
      case 'V':   /* bugfixes for various vendor's PCL emulations */
        tcp++;
        if (*tcp == 'K' || *tcp == 'k')
          kyocera_mode = _TRUE;
        else
          if (*tcp == 'B' || *tcp == 'b')
            brother_mode = _TRUE;
# ifdef LJ4
	else
        if (*tcp == '6' || *tcp == '6')
	    LJ6 = _TRUE;
# endif
        break;

#endif
#ifdef __riscos
      case 'i': /* name of directory to store diagrams in */
        tcp++;
        ddi = 0;
        while (*tcp != ' ' && *tcp != '\0' && ddi < DIAGDIRSIZE-1) {
          diagdir[ddi++] = *tcp++;

      }
    } else {

      filename = tcp;
      if (EQ(filename, "-")) {
        EmitFileName = "-";
#ifdef RISC_USE_OSL
        dvifp = BINOPEN("Kbd:");

	  AssureBinary(fileno(dvifp));
#endif
      } else {
	/* Since this code is used only once during startup, we don't care
	   about free()ing the allocated strings that represent filenames.
	   It will be more work to realize proper deallocation handling than
	   it's worth in terms of saving a few bytes. We consider these
	   bytes actually static memory where we don't know the size in
	   advance and don't add them to the allocated_storage count.
	   [27 Jun 07 -js] */
#ifdef KPATHSEA
        /* split into directory + file name */
	int tcplen, argvlen;
	tcp = (char *)xbasename(argv[argind]);/* this knows about any kind of slashes */
	tcplen = strlen(tcp);
	if ( tcplen == 0 ) {
	  /* This happens when the DVI file name has a trailing slash; this
	     is not a valid name. Then we terminate the argument parsing
	     loop, a usage message will be output below. */
	  break;
	}
	argvlen = strlen(argv[argind]);
	if (tcplen == argvlen)
	  curarea = "";
	else {
	  curarea = xstrdup(argv[argind]);
	  curarea[argvlen-tcplen] = '\0';
	}
#else
        tcp = strrchr(argv[argind], '/');
        /* split into directory + file name */
        if (tcp == NULL) {
          curarea[0] = "";
          tcp = argv[argind];
        } else {
	  curarea = xstrdup(argv[argind]);
          curarea[tcp-argv[argind]+1] = '\0';
          tcp += 1;
        }
#endif

        curname = (char *) xmalloc(strlen(tcp)+5);  /* + space for ".dvi" */
	(void) strcpy(curname, tcp);
        /* split into file name + extension */
        tcp1 = strrchr(curname, '.');
        if (tcp1 == NULL) {
          rootname = xstrdup(curname);
          strcat(curname, ".dvi");
        } else {
          *tcp1 = '\0';
          rootname = xstrdup(curname);
          *tcp1 = '.';
        }

	filename = (char *) xmalloc(strlen(curarea)+strlen(curname)+1);
        (void) strcpy(filename, curarea);
        (void) strcat(filename, curname);

        if ((dvifp = BINOPEN(filename)) == FPNULL) {
          /* do not insist on .dvi */
          if (tcp1 == NULL) {
	    filename[strlen(filename) - 4] = '\0';
	    dvifp = BINOPEN(filename);
              curname[l - 4] = '\0';
            l = strlen(filename);
            if (l > 4)
              filename[l - 4] = '\0';
          }
          if (dvifp == FPNULL) {
#ifdef MSC5
            Fatal("%s: can't find DVI file \"%s\"\n\n",
                  G_progname, filename);

  y_goffset = (short) MM_TO_PXL(y_offset) + y_origin;

  if (dvifp == FPNULL) {
    fprintf(ERR_STREAM,"\nThis is the DVI to %s converter %s",
            PRINTER, VERSION);
#ifdef SEVENBIT
    fprintf(ERR_STREAM,", 7bit");

    exit(1);
  }
  if (EQ(EmitFileName, "")) {
    EmitFileName = (char *) xmalloc(strlen(rootname)+sizeof(EMITFILE_EXTENSION));
    (void) strcpy(EmitFileName, rootname);
    else
      Fatal("Can't allocate storage of %d bytes\n",STRSIZE);
    (void) strcpy(EmitFileName, curname);
    if ((tcp1 = strrchr(EmitFileName, '.')))
      *tcp1 = '\0';
    strcat(EmitFileName, EMITFILE_EXTENSION);
  }
  if (G_quiet)

  if (PrintTestPage) EMIT1("\033z");
#ifdef vms
  /* last record is not flushed to file, unless it is completely filled */
  for (kk = (int)((*outfp)->_cnt); kk > 0; --kk)
    putc('\0',outfp);
  fflush(outfp);
#endif

#endif
  }
  CloseFiles();
  if ( tmp_dir[0] != '\0' )
    rmdir (tmp_dir);			/* ignore errors */
  exit(G_errenc);
}


#endif
{
  char *a,*b;

  a = s1;
  b = s2;
  while (*a != '\0') {
    if (tolower(*a) != tolower(*b)) return(_FALSE);
    a++;
    b++;
  }
  *end = b;
  return(_TRUE);
}


{
  char *s;
  int count = 0;

  s = str;
  while ((*s != '\0') && (count < number)) {
    while ((*s == ' ') || (*s == ',') || (*s == '='))
      s++;
    if (*s != '\0') {
      result[count++] = strtod(s,&s);
    }
  }
  while ((*s == ' ') || (*s == ',') || (*s == '='))
    s++;
  *end = s;
  return(count);
}


  int results[4],no;

  s = str;
  while (*s == ' ')
    s++;
  if ((StrCompare("drawfile",s,&s)) || (StrCompare("DVIview_diagram",s,&s))) {

    if (printdiag == _FALSE)
      return(_TRUE); /* it's a diagram, but don't print */

    while ((*s == ' ') || (*s == '='))
      s++; /* space or '=' separates keyword/keyval */

    if (*s == '\0') {
      fprintf(ERR_STREAM,"No filename given for \\special-diagram!\n");
      return(_TRUE);
    }
    sh = diagname;
    while ((*s != ' ') && (*s != ',') && (*s != '\0'))
      *sh++ = *s++;
    *sh = '\0';


    dt.scalex = dt.scaley = 100;
    dt.cropl = dt.cropb = dt.cropr = dt.cropt = 0;
    while (*s != '\0') {
      while ((*s == ' ') || (*s == ','))
        s++;
      if (*s != '\0') {
        if (StrCompare("scale",s,&s)) {

            fprintf(ERR_STREAM,
                   "Too few arguments (%d) given for <scale> - ignored.\n",no);
          }
          dt.scalex = results[0];
          dt.scaley = results[1];
        }
        else if (StrCompare("crop",s,&s)) {

            fprintf(ERR_STREAM,
                   "Too few arguments (%d) given for <crop> - ignored.\n",no);
          }
          dt.cropl = results[0];
          dt.cropr = results[1];
          dt.cropt = results[2];
          dt.cropb = results[3];
        }
        else {
          fprintf(ERR_STREAM,"Bad \\special keyword - <%s> ignored\n",s);
          /* skip over this word */
          while ((*s != ' ') && (*s != ',') && (*s != '=') && (*s != '\0'))
            s++;
        }
      }

    diagram(diagname,&dt);
    return(_TRUE);
  }
  else
    return(_FALSE);
}
# endif /* LJ */

int  n;
#endif
{
  char    xs[STRSIZE], ys[STRSIZE];
  char    *include_file = NULL;
  enum    { VerbFile, HPFile, PSFile } file_type;
  float   x,y;
  long4   x_pos, y_pos;
  KeyWord k;
  int     i, j, j1;
  static  int   GrayScale = 10, Pattern = 1;
  static  bool  GrayFill = _TRUE;
  static  long4 p_x[MAX_SPECIAL_DEFPOINTS], p_y[MAX_SPECIAL_DEFPOINTS];
  int llx=0, lly=0, urx=0, ury=0, rwi=0;
#ifdef WIN32
  char    *gs_path;
#endif

  str[n] = '\0';
  for ( i=0 ; i<MAX_SPECIAL_DEFPOINTS ; i++ )
    p_x[i] = p_y[i] = -1;

  SetPosn(h, v);
#ifdef __riscos
#ifdef LJ
  if (ParseDiagram(str))
    return;
#endif
#endif

  while ( (str = GetKeyStr(str, &k)) != NULL ) {
    /* get all keyword-value pairs */
    /* for compatibility, single words are taken as file names */
    if ( k.vt == None && access(k.Key, 0) == 0) {
      if ( include_file && !kpse_tex_hush ("special") ) {
        Warning("More than one \\special file name given. %s ignored", include_file);
	free (include_file);
      }
      include_file = xstrdup(k.Key);
      file_type = VerbFile;
    } else if ( GetKeyVal( &k, KeyTab, NKEYS, &i ) && i != -1 ) {
      sf = spbuf;
      /*
        for (j = 1; ((sf[j]=='/' ? sf[j]='\\':sf[j]) != '\0'); j++);
        */
    } else if ( GetKeyVal( &k, KeyTab, NKEYS, &i ) && i != -1 )
      switch (i) {
      case PSFILE:
        if ( include_file ) {
	  Warning("More than one \\special file name given. %s ignored", include_file);
	  free(include_file);
	}
        include_file = xstrdup(k.Val);
	file_type = PSFile;
        (void) strcpy(spbuf, k.Val);
        psfile = spbuf;
        /*
          for (j=1; ((sf[j]=='/' ? sf[j]='\\':sf[j]) != '\0'); j++);
          */
        break;

      case HPFILE:
        if ( include_file && !kpse_tex_hush ("special") ) {
	  Warning("More than one \\special file name given. %s ignored", include_file);
	  free(include_file);
	}
        include_file = xstrdup(k.Val);
	file_type = HPFile;
          */
        break;

      case ORIENTATION:

          EMIT2("\033&l%dO\033*rF", (unsigned char)k.v.i);
        }
#endif
        else {
	  Warning( "Invalid orientation (%d) given; ignored.", k.v.i);
	}
#endif
          Warning( "Invalid orientation (%d)given; ignored.", k.v.i);
        break;

      case RESETPOINTS:
	for ( i=0 ; i<MAX_SPECIAL_DEFPOINTS ; i++ )
	  p_x[i] = p_y[i] = -1;
        sf = NULL;
        break;

      case DEFPOINT:
	/* 254 is STRSIZE-1. cpp should be used to construct that number. */
        i = sscanf(k.Val,"%d(%254[^,],%254s)",&j,xs,ys);
        if (i>0) {
	  if ( j < 0  ||  j >= MAX_SPECIAL_DEFPOINTS ) {
	    Warning ("defpoint %d ignored, must be between 0 and %d",
		     j, MAX_SPECIAL_DEFPOINTS);
	    break;
	  }
          x_pos = h;
          y_pos = v;
          if (i>1) {
            if (sscanf(xs,"%fpt",&x)>0) {

          }
          p_x[j]=x_pos;
          p_y[j]=y_pos;
        } else {
	  Warning("invalid point definition");
	}
#endif
          Warning("invalid point definition\n");

        sf = NULL;
        break;

      case FILL:
	/* 254 is STRSIZE-1. cpp should be used to construct that number. */
        i = sscanf(k.Val,"%d/%d %254s",&j,&j1,xs);
        if (i>1) {
#ifdef LJ
	  if ( j < 0 || j >= MAX_SPECIAL_DEFPOINTS ) {
	    Warning ("fill ignored, point %d must be between 0 and %d",
		     j, MAX_SPECIAL_DEFPOINTS);
	    break;
	  }
	  if ( p_x[j] == -1 ) {
	    Warning ("fill ignored, point %d is undefined\n", j);
	    break;
	  }
	  if ( j1 < 0 || j1 >= MAX_SPECIAL_DEFPOINTS ) {
	    Warning ("fill ignored, point %d must be between 0 and %d",
		     j1, MAX_SPECIAL_DEFPOINTS);
	    break;
	  }
	  if ( p_x[j1] == -1 ) {
	    Warning ("fill ignored, point %d is undefined\n", j1);
	    break;
	  }
          SetPosn(p_x[j], p_y[j]);
          x_pos = (long4)PIXROUND(p_x[j1]-p_x[j], hconv);
          y_pos = (long4)PIXROUND(p_y[j1]-p_y[j], vconv);

        if ((k.v.i >= 0) && (k.v.i < 101)) {
          GrayScale = k.v.i;
          GrayFill = _TRUE;
        } else {
#ifdef KPATHSEA
           if (!kpse_tex_hush ("special"))
#endif
          Warning( "Invalid gray scale (%d) given; ignored.", k.v.i);
	}
        break;

      case PATTERN:
        if ((k.v.i >= 0) && (k.v.i < 7)) {
          Pattern = k.v.i;
          GrayFill = _FALSE;
        } else {
#ifdef KPATHSEA
           if (!kpse_tex_hush ("special"))
#endif
          Warning( "Invalid pattern (%d) given; ignored.", k.v.i);
	}
        break;

      case LLX: llx = k.v.i; break;

      case URX: urx = k.v.i; break;
      case URY: ury = k.v.i; break;
      case RWI: rwi = k.v.i; break;
      case RHI:
	if (!kpse_tex_hush ("special"))
	  Warning("Whatever rhi was good for once, it is ignored now.");
	break;

      default:
	if ( !kpse_tex_hush ("special") )
	  Warning("Can't handle %s=%s command; ignored.", k.Key, k.Val);
#endif
        Warning("Can't handle %s=%s command; ignored.", k.Key, k.Val);
        break;
      }

    } else if (!kpse_tex_hush ("special")) {
#ifdef KPATHSEA
           if (!kpse_tex_hush ("special"))
#endif
      Warning("Invalid keyword or value in \\special - <%s> ignored", k.Key);
    }

    free (k.Key);
    if ( k.Val != NULL )  free(k.Val);
  }

  if ( include_file ) {
    last_rx = last_ry = UNKNOWN;
#ifdef IBM3812
    PMPflush;
#endif

      if (i == HPFILE) 
        CopyHPFile( sf );
      else 
        CopyFile( sf );
    }
    else
#ifdef LJ
    if ( file_type == PSFile) {
      /* int height = rwi * (urx - llx) / (ury - lly);*/
      int width  = urx - llx;
      int height = ury - lly;
      char cmd[255];
      char *cmd_format = "%s -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit";
      char *gs_cmd;
      int scale_factor, adjusted_height, adjusted_llx;
      char *printer = "ljetplus"; /* use the most stupid one */

      char pcl_file[STRSIZE];
      char scale_file[STRSIZE];
      FILEPTR scalef;

      if ( urx == 0 || ury == 0 || rwi == 0 ) {
	/* Since dvips' psfile special has a different syntax, this might
	   well be one of those specials, i.e., a non-dviljk special. Then
	   the Warning should be suppressable. */
	if ( !kpse_tex_hush ("special") )
	  Warning ("Ignoring psfile special without urx, ury and rwi attributes");
	free (include_file);
	return;
      }
      scale_factor    = 3000 * width / rwi;
      adjusted_height = height * 300/scale_factor;
      adjusted_llx    = llx    * 300/scale_factor;

      /* We cannot use mkstemp, as we cannot pass two open file descriptors
	 portably to Ghostscript. We don't want to use tmpnam() or tempnam()
	 either, as they have tempfile creation race conditions. Instead we
	 create a temporary directory with mkdtemp() -- if that's available.
	 If not, we are thrown back to tempnam(), to get our functionality
	 at all. We need to create the temporary directory only once per
	 run; it will be deleted in AllDone(). */
      if ( tmp_dir[0] == '\0' ) {
	char * base_dir;
	if ( (base_dir = getenv("TMPDIR")) == NULL ) {
	  base_dir = "/tmp";
	} else if ( strlen(base_dir) > STRSIZE - sizeof("/dviljkXXXXXX/include.pcl") ) {
	  Warning ("TMPDIR %s is too long, using /tmp instead", base_dir);
	  base_dir = "/tmp";
	}
	if ( base_dir[0] == '/'  && base_dir[1] == '\0' ) {
	  Warning ("Feeling naughty, do we? / is no temporary directory, dude");
	  base_dir = "/tmp";
	}
	strcpy (tmp_dir, base_dir);
	strcat (tmp_dir, "/dviljkXXXXXX");
	if ( mkdtemp(tmp_dir) == NULL ) {
	  Warning ("Could not create temporary directory %s, errno = %d; ignoring include file special",
		   tmp_dir, errno);
	  return;
	}
      }
      strcpy(pcl_file, tmp_dir);
      strcat(pcl_file, "/include.pcl");
      strcpy(scale_file, tmp_dir);
      strcat(scale_file, "/scale.ps");

      if ( (scalef = BOUTOPEN(scale_file)) == FPNULL ) {
	Warning("Unable to open file %s for writing", scale_file );
	free (include_file);
	unlink(scale_file);		/* ignore error */
	return;
      }
      fprintf(scalef, "%.2f %.2f scale\n%d %d translate\n",
	      300.0/scale_factor, 300.0/scale_factor,
	      0, adjusted_height == height ? 0 : ury);
      BCLOSE( scalef );

#ifdef WIN32
      if ( (gs_cmd = getenv("GS_PATH")) == NULL )
	gs_cmd = "gswin32c.exe";
#else
      gs_cmd = "gs";
		gs_path, printer, pcl_file, scale_file, psfile);
#else
        sprintf(cmd,"gs -q -dSIMPLE -dSAFER -dNOPAUSE -sDEVICE=%s -sOutputFile=%s %s %s showpage.ps -c quit",
                printer, pcl_file, scale_file, psfile);
#endif
#ifdef DEBUGGS   
        fprintf(stderr,
          "PS-file '%s' w=%d, h=%d, urx=%d, ury=%d, llx=%d, lly=%d, rwi=%d\n",
                psfile, urx - llx, height, urx,ury,llx,lly, rwi);
        fprintf(stderr,"%s\n",cmd);
#endif
      if ( strlen(cmd_format)-10 + strlen(gs_cmd) + strlen(printer) +
	       strlen(pcl_file) + strlen(scale_file) + strlen(include_file) +1 >
	   sizeof(cmd) ) {
	Warning ("Ghostscript command for %s would be too long, skipping special", include_file);
	free (include_file);
	unlink(scale_file);		/* ignore errors */
	unlink(pcl_file);
	return;
      }
      sprintf(cmd, cmd_format,
	      gs_cmd, printer, pcl_file, scale_file, include_file);
#ifdef DEBUGGS
      fprintf(stderr,
	"PS-file '%s' w=%d, h=%d, urx=%d, ury=%d, llx=%d, lly=%d, rwi=%d\n",
	      include_file, urx - llx, height, urx,ury,llx,lly, rwi);
      fprintf(stderr,"%s\n",cmd);
#endif
      if (system(cmd)) {
	Warning("execution of '%s' returned an error", cmd);
      } else {
#ifdef DEBUGGS
	fprintf(stderr, "o=%d, h=%d, so=%d, sh=%d\n",
		llx, height, adjusted_llx, adjusted_height);

	fprintf(stderr, "OLD x=%d, y=%d\n",
		(int)PIXROUND(h, hconv) + x_goffset,
		(int)PIXROUND(v, vconv) + y_goffset);
#endif
	v -= 65536l*adjusted_height; /**300/scale_factor;*/
	h -= 65536l*adjusted_llx; /* *300/scale_factor;*/
	SetPosn(h, v);
#ifdef DEBUGGS
	fprintf(stderr, "NEW x=%d, y=%d\n",
		(int)PIXROUND(h, hconv) + x_goffset,
		(int)PIXROUND(v, vconv) + y_goffset);
#endif

	CopyHPFile( pcl_file );
      }
      unlink(scale_file);		/* ignore errors */
      unlink(pcl_file);
    }
    else
#endif /* LJ */

    if ( file_type == HPFile )
      CopyHPFile( include_file );
    else if ( file_type == VerbFile )
      CopyFile( include_file );
    else
      Warning ("This can't happen: unknown file_type value %d", file_type);

    if ( include_file != NULL )  free(include_file);
  }
}


/**********************************************************************/
/*****************************  GetKeyStr  ****************************/
/**********************************************************************/
/* Extract first keyword-value pair from string (value part may be null),
 * keyword and value are allocated and must be free by caller.
 * Return pointer to remainder of string,
 * return NULL if none found.
 */
char    KeyStr[STRSIZE];
char    ValStr[STRSIZE];
#if NeedFunctionPrototypes
char *GetKeyStr(char *str, KeyWord *kw )
#else

KeyWord *kw;
#endif
{
  char *s, *start;
  char save_char, quote_char;
  if ( !str )
    return( NULL );
  for (s = str; *s == ' '; s++)
    ;          /* skip over blanks */
  if (*s == '\0')
    return( NULL );
  start = s++;				/* start of keyword */
  while ( *s != ' ' && *s != '\0' && *s != '=' )  /* locate end */
    s++;
  save_char = *s;
  *s = '\0';
  kw->Key = xstrdup(start);
  kw->Val = NULL;
  kw->vt = None;
  if ( save_char == '\0' )		/* shortcut when we're at the end */
    return (s);
  *s = save_char;			/* restore keyword end char */
  while ( *s == ' ' ) s++ ;		/* skip over blanks */
  if ( *s != '=' )			/* no "=" means no value */
    return( s );
  for (s++; *s == ' '; s++)
    ;					/* skip over blanks */
  if ( *s == '\'' || *s == '\"' )	/* get string delimiter */
    quote_char = *s++;
  else
    quote_char = ' ';
  start = s;				/* no increment, might be "" as value */
  while ( *s != quote_char && *s != '\0' )
    s++;			  /* locate end of value portion */
  save_char = *s;
  *s = '\0';
  kw->Val = xstrdup(start);
  *v = '\0';
  kw->Val = ValStr;
  kw->vt = String;
  if ( save_char != '\0' ) {		/* save_char is now quote_char */
    *s = save_char;
    if ( quote_char != ' ' )		/* we had real quote chars */
      s++;
  }
  return( s );
}


#endif
{
  char *x, *y;

  for (x = a, y = b; *a; a++, b++)
    if ( tolower(*a) != tolower(*b) )
      return( _FALSE );

       *   process for simplicity always horizontally
       */

      /*
         fprintf(ERR_STREAM,"large box: w=%d,x=%d,y=%d\n",(int)yy,(int)xx,0);
         */

      hor_offset  = HOR_HALF(30);
      MoveHor(hor_offset);
      vert_offset = VERT_HALF(30);

      yy += (long4)pgsiz_dots - (long4)last_ry;

    if ((yy>0) && (xx>0))
      EMIT4("\033*p-%ldY\033*c%lda%ldbP",
            (long)yy - 1, (long)xx, (long)yy);
#endif
    last_rx = last_ry = UNKNOWN;       /* next time full positioning */

      if ((fid = pixel_files[least_used].pixel_file_id) != NO_FILE) {
        /* mark file as being closed in the entry */
        fp = hfontptr;
        while (fp != NULL && fp->font_file_id != fid)
          fp = fp->next;
        if (fp == NULL)
          Fatal("Open file %x not found in font entry list.\n", fid);

      while ((fp != NULL) && (fp->font_file_id != f))
        fp = fp->next;

      if (fp == NULL)
        Fatal("Open file %x not found in font entry list.\n",f);
      else
        fp->font_file_id = FPNULL;
    }
    BCLOSE(f);

     the resident fonts.  */
  if (tfm_read_info(fontptr->n, &tfm_info)
      && tfm_info.family[0]
      && EQ((char *)tfm_info.family, "HPAUTOTFM")) {
    unsigned i;
    double factor = fontptr->s / (double)0x100000;

    resident_count++;
    fontptr->resident_p = _TRUE;
    strncpy(fontptr->symbol_set, (char *)tfm_info.coding_scheme, 39);
    fontptr->symbol_set[39] = '\0';
    fontptr->resid = tfm_info.typeface_id;
    fontptr->spacing = tfm_info.spacing;
    fontptr->style = tfm_info.style;

    fontptr->resident_p = _FALSE;

    if (tfm_info.family[0]
        && EQ((char *)tfm_info.family, "UNSPECIFIED")) {
      Warning("font family for %s is UNSPECIFIED; need to run dvicopy?",
              fontptr->n);
      fontptr->font_file_id = NO_FILE;

  GetBytes(dvifp, tfontptr->n, tfontptr->a + tfontptr->l);
  tfontptr->n[tfontptr->a+tfontptr->l] = '\0';

  tfontptr->font_mag =
    (long4)((ActualFactor((long4)(1000.0*tfontptr->s/(double)tfontptr->d+0.5))
             * ActualFactor(mag)
#ifdef USEPXL

  if (tfontptr->resident_p)
    return;

  if (!(resident_font_located))
#endif

#ifdef KPATHSEA
    {
      kpse_glyph_file_type font_ret;
      char *name;

        = kpse_magstep_fix ((unsigned) (tfontptr->font_mag / 5.0 + .5),
                            RESOLUTION, NULL);
      tfontptr->font_mag = dpi * 5; /* save correct dpi */

      name = kpse_find_pk (tfontptr->n, dpi, &font_ret);
      if (name)
        {
          font_found = _TRUE;
          tfontptr->name = name;
          allocated_storage += strlen(name)+1;

          if (!FILESTRCASEEQ (tfontptr->n, font_ret.name)) {
              fprintf (stderr,
                       "dvilj: Font %s not found, using %s at %d instead.\n",

            tfontptr->n, dpi);
        }
    }
#else /* not KPATHSEA */
    if (!(findfile(PXLpath,
                   tfontptr->n,
                   tfontptr->font_mag,
                   tfontptr->name,
                   _FALSE,
                   0))) {
      Warning(tfontptr->name); /* contains error messsage */
      tfontptr->font_file_id = NO_FILE;
#ifdef __riscos
      MakeMetafontFile(PXLpath, tfontptr->n, tfontptr->font_mag);
#endif
    }
    else {
      font_found = _TRUE;
      if (G_verbose)
        fprintf(ERR_STREAM,"%d: using font <%s>\n", plusid, tfontptr->name);
    }
#endif /* not KPATHSEA */

#ifdef LJ_RESIDENT_FONTS
  }
#endif

  tfontptr->plusid = plusid;
  plusid++;

          HANDLE_MAX_FONTS);
#endif
  if (tfontptr != pfontptr) {
    if (font_found)
      OpenFontFile();
    else
      pxlfp = NO_FILE;

    if (t == PK_PRE) {
      unsigned char   temp_byte;
      temp_byte = (unsigned char) NoSignExtend(pxlfp, 1);
      if (temp_byte != PK_ID)
        Fatal( "Wrong Version of pk file!  (%d should be 89)\n",
               (int)temp_byte);
      else


    tfontptr->magnification = NoSignExtend(pxlfp, 4);
    tfontptr->designsize    = NoSignExtend(pxlfp, 4);

    if (tfontptr->id == id1001)
      FSEEK(pxlfp, (long)(NoSignExtend(pxlfp, 4) * 4), SEEK_SET);
    else

    hppp = NoSignExtend(pxlfp, 4);
    vppp = NoSignExtend(pxlfp, 4);
    if (hppp != vppp)
      Warning("aspect ratio is %ld:%ld (should be 1:1)!",
              (long)hppp, (long)vppp);
    tfontptr->magnification = (long4)(hppp * 72.27 * 5 / 65536l + 0.5);


{
  int     a, l;
  char    n[STRSIZE];

  (void) NoSignExtend(dvifp, 4);
  (void) NoSignExtend(dvifp, 4);
  (void) NoSignExtend(dvifp, 4);

  GetBytes(dvifp, n, a + l);
}



/*------------------------ end dvifont.c -------------------------------*/


#endif
  if ( G_nowarn || G_quiet )
    return;

  fprintf(ERR_STREAM, "%s: warning: ", G_progname);
  vfprintf(ERR_STREAM, fmt, args);
  fprintf(ERR_STREAM, "\n");





#ifdef KPATHSEA
#include <kpathsea/config.h>
#include <kpathsea/c-std.h>
#include <kpathsea/c-limits.h>
#include <kpathsea/c-memstr.h>
#include <kpathsea/magstep.h>
#include <kpathsea/proginit.h>
#include <kpathsea/progname.h>

#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#ifdef  unix
#include <limits.h>
#endif

#ifdef MSC5
#include <dos.h>     /* only for binaryopen on device  */
#endif
#if defined (unix) && !defined (KPATHSEA)
#include <limits.h>
#endif


#include "config.h"

#define  HUGE_SIZE  (unsigned char) 2
#define  HUGE_CHAR_PATTERN 32767l
#define  BYTES_PER_PIXEL_LINE 500    /* max number of bytes per pixel line */
#define  MAX_SPECIAL_DEFPOINTS 80    /* max number of defpoint specials */


#define PK_POST 245

#define VisChar(c) (unsigned char)(c)
#endif

/* Used to be a function. buf is always an array, never a pointer.
   Without that invariant, we would have to introduce full dynamic
   memory management in this driver -- probably it would be easier to
   write a new one. [27 Jun 07 -js] */
#define GetBytes(fp,buf,n) \
    ( sizeof(buf) != sizeof(void *) && sizeof(buf) > n ? \
        read_multi(buf, 1, n, fp) \
      : Fatal("Try to read %d bytes in an array of size %d", n, sizeof(buf)) )


/**********************************************************************/

int     sscanf();
int     strcmp();
char   *strcpy();
char   *strncpy();
#   ifdef MSC5
unsigned int strlen();
#   endif

    char n[STRSIZE];          /* FNT_DEF command parameters                */
    long4    font_mag;         /* computed from FNT_DEF s and d parameters  */
    /*char psname[STRSIZE];*/ /* PostScript name of the font               */
    char    *name;	       /* full name of PXL file                     */
    FILEPTR font_file_id;      /* file identifier (NO_FILE if none)         */
#ifdef USEPXL
    long4    magnification;    /* magnification read from PXL file          */

long4   NoSignExtend DVIPROTO((FILEPTR, int));
void    OpenFontFile DVIPROTO((void));
long4   PixRound DVIPROTO((long4, long4));
void    PkRaster DVIPROTO((struct char_entry *, int));
void    RasterLine DVIPROTO((struct char_entry *, unsigned int,
			     unsigned int, unsigned char *));
void    RasterChar DVIPROTO((struct char_entry *));
void    ReadFontDef DVIPROTO((long4));

#ifndef KPATHSEA
char   *PXLpath = FONTAREA;
#endif
char   *G_progname;		 /* program name                        */
char   *filename;	         /* DVI file name                       */
char   *rootname;		 /* DVI filename without extension      */
char   *HeaderFileName = "";     /* file name & path of Headerfile      */
char   *EmitFileName = "";       /* file name & path for output         */
char    tmp_dir[STRSIZE] = "";	 /* temporary directory for auxilliary files */
#ifdef IBM3812
bool    FirstAlternate = _FALSE; /* first page from alternate casette ?   */
#endif

Return to bug 198238

Lines 1-3 Link Here

(-)tetex-src-3.0/texk/dviljk/ChangeLog (-4 / +43 lines)
		1	2007-07-02 Joachim Schrod <jschrod@acm.org>
		2
		3	* dvi2xx.c (DoSpecial): Security issue: usage of tmpnam() caused
		4	tempfile race condition. I use mkdtemp() if it's available and
		5	fall back to tmpnam.
		6
		7	Special parsing of include files was inconsistent, unify it. The
		8	current parsing code still allows lots of non-sensical special
		9	commands, but at least it doesn't access unrelated variables any
		10	more.
		11
		12	2007-06-28 Joachim Schrod <jschrod@acm.org>
		13
		14	* dvi2xx.c: Fixed a whole bunch of buffer overflows: The program
		15	did not check memory bounds for any string operation. All places
		16	where strings are copied with strcpy are replaced by dynamically
		17	allocated strings (with xstrdup from kpathsea) or bounded string
		18	operations. Fixed also manual string copy operations on special
		19	strings. Fixed array buffer overflow in defpoint and fill special
		20	operations.
		21	(DoSpecial): Call of ghostscript for psfile special had also a
		22	potential buffer overflow caused by unchecked usage of sprintf.
		23	Fix core dump: Check if all required parameters of psfile special
		24	are passed.
		25
		26	Bumped version number up to 2.6p3.
		27
		28	* dvi2xx.h: Some fixed sized string arrays are pointers now, they
		29	get dynamically allocated.
		30	(GetBytes): Another buffer overflow: Check that the buffer size is
		31	sufficient to store the read bytes. That relies on the invariant
		32	that the GetBytes macro is always called with an array as argument
		33	and not with a pointer.
		34
		35	* config.h: Throw an error if kpathsea is not used. dvi2xx.c
		36	had previously already kpathsea dependencies without protecting
		37	them with #if KPATHSEA. We go that road further since upstream
		38	does not exist any more.
		39
1	Tue Mar 3 10:17:03 1998 Sebastian Rahtz <s.rahtz@elsevier.co.uk>	40	Tue Mar 3 10:17:03 1998 Sebastian Rahtz <s.rahtz@elsevier.co.uk>
2		41
3	* config.h: Markus Gyger <mgyger@osf1.gmu.edu> fix of config	42	* config.h: Markus Gyger <mgyger@osf1.gmu.edu> fix of config
Lines 12-18 Tue Jan 27 14:32:25 1998 Sebastian Raht Link Here
12	Olaf Weber	51	Olaf Weber
13	Sat Jan 17 15:09:59 1998 Sebastian Rahtz <s.rahtz@elsevier.co.uk>	52	Sat Jan 17 15:09:59 1998 Sebastian Rahtz <s.rahtz@elsevier.co.uk>
14		53
15	* assorted patches from Peter Breitenlohner, Olaf Weber,	54	* assorted patches from Peter Breitenlohner, Olaf Weber,
16	Eli Zaretskii, Fabrice Popineau etc. Hope it all still works.	55	Eli Zaretskii, Fabrice Popineau etc. Hope it all still works.
17		56
18		57
Lines 49-55 Sun Jan 5 16:12:06 1997 Karl Berry <k Link Here
49	Mon Dec 9 00:53:30 1996 Ulrik Vieth <vieth@thphy.uni-duesseldorf.de>	88	Mon Dec 9 00:53:30 1996 Ulrik Vieth <vieth@thphy.uni-duesseldorf.de>
50		89
51	* dvihp: Use `basename $0` in usage and version messages for	90	* dvihp: Use `basename $0` in usage and version messages for
52	consistency with other programs and scripts.	91	consistency with other programs and scripts.
53	Also accept -help, -version in addition to --help, --version.	92	Also accept -help, -version in addition to --help, --version.
54		93
55	Sat Dec 7 17:15:54 1996 Karl Berry <karl@cs.umb.edu>	94	Sat Dec 7 17:15:54 1996 Karl Berry <karl@cs.umb.edu>
Lines 213-219 Sat Dec 31 17:30:58 1994 Karl Berry <k Link Here
213	Fri Dec 30 15:25:54 1994 Karl Berry <karl@cs.umb.edu>	252	Fri Dec 30 15:25:54 1994 Karl Berry <karl@cs.umb.edu>
214		253
215	* Makefile.in (install-exec): Don't depend on default, so dvilj4	254	* Makefile.in (install-exec): Don't depend on default, so dvilj4
216	doesn't get made if the user didn't want it.	255	doesn't get made if the user didn't want it.
217	(install-data): mkdirchain on texinputdir and fontdir.	256	(install-data): mkdirchain on texinputdir and fontdir.
218	From Joachim.	257	From Joachim.
219		258
Lines 320-326 Fri Jul 29 13:26:49 1994 Karl Berry (k Link Here
320	* config.h (RESOLUTION, MFMODE) [LJ4L]: Set to 300/cx for this new	359	* config.h (RESOLUTION, MFMODE) [LJ4L]: Set to 300/cx for this new
321	symbol.	360	symbol.
322		361
323	* dvi2xx.c (DecodeArgs): Always scale pgsiz_dots.	362	* dvi2xx.c (DecodeArgs): Always scale pgsiz_dots.
324	(main) [LJ4]: Don't hardwire 600dpi.	363	(main) [LJ4]: Don't hardwire 600dpi.
325	These fixes from ajp@eng.cam.ac.uk.	364	These fixes from ajp@eng.cam.ac.uk.
326		365

Lines 10-17 Link Here

(-)tetex-src-3.0/texk/dviljk/dvi2xx.h (-11 / +19 lines)
10		10
11	#ifdef KPATHSEA	11	#ifdef KPATHSEA
12	#include <kpathsea/config.h>	12	#include <kpathsea/config.h>
		13	#include <kpathsea/c-std.h>
13	#include <kpathsea/c-limits.h>	14	#include <kpathsea/c-limits.h>
14	#include <kpathsea/c-memstr.h>
15	#include <kpathsea/magstep.h>	15	#include <kpathsea/magstep.h>
16	#include <kpathsea/proginit.h>	16	#include <kpathsea/proginit.h>
17	#include <kpathsea/progname.h>	17	#include <kpathsea/progname.h>
Lines 24-29 Link Here
24	#include <string.h>	24	#include <string.h>
25	#include <stdio.h>	25	#include <stdio.h>
26	#include <stdlib.h>	26	#include <stdlib.h>
		27	#include <unistd.h>
27	#ifdef unix	28	#ifdef unix
28	#include <limits.h>	29	#include <limits.h>
29	#endif	30	#endif
Lines 41-49 Link Here
41	#ifdef MSC5	42	#ifdef MSC5
42	#include <dos.h> /* only for binaryopen on device */	43	#include <dos.h> /* only for binaryopen on device */
43	#endif	44	#endif
44	#if defined (unix) && !defined (KPATHSEA)
45	#include <limits.h>
46	#endif
47		45
48		46
49	#include "config.h"	47	#include "config.h"
Lines 116-121 Link Here
116	#define HUGE_SIZE (unsigned char) 2	114	#define HUGE_SIZE (unsigned char) 2
117	#define HUGE_CHAR_PATTERN 32767l	115	#define HUGE_CHAR_PATTERN 32767l
118	#define BYTES_PER_PIXEL_LINE 500 /* max number of bytes per pixel line */	116	#define BYTES_PER_PIXEL_LINE 500 /* max number of bytes per pixel line */
		117	#define MAX_SPECIAL_DEFPOINTS 80 /* max number of defpoint specials */
119		118
120		119
121	#define PK_POST 245	120	#define PK_POST 245
Lines 281-287 char *MFMODE = MFMODE600; Link Here
281	#define VisChar(c) (unsigned char)(c)	280	#define VisChar(c) (unsigned char)(c)
282	#endif	281	#endif
283		282
284	#define GetBytes(fp,buf,n) read_multi(buf,1,n,fp) /* used to be a function */	283	/* Used to be a function. buf is always an array, never a pointer.
		284	Without that invariant, we would have to introduce full dynamic
		285	memory management in this driver -- probably it would be easier to
		286	write a new one. [27 Jun 07 -js] */
		287	#define GetBytes(fp,buf,n) \
		288	( sizeof(buf) != sizeof(void *) && sizeof(buf) > n ? \
		289	read_multi(buf, 1, n, fp) \
		290	: Fatal("Try to read %d bytes in an array of size %d", n, sizeof(buf)) )
285		291
286		292
287	/**********************************************************************/	293	/**********************************************************************/
Lines 307-312 int printf(); Link Here
307	int sscanf();	313	int sscanf();
308	int strcmp();	314	int strcmp();
309	char *strcpy();	315	char *strcpy();
		316	char *strncpy();
310	# ifdef MSC5	317	# ifdef MSC5
311	unsigned int strlen();	318	unsigned int strlen();
312	# endif	319	# endif
Lines 393-399 struct font_entry { /* font entry */ Link Here
393	char n[STRSIZE]; /* FNT_DEF command parameters */	400	char n[STRSIZE]; /* FNT_DEF command parameters */
394	long4 font_mag; /* computed from FNT_DEF s and d parameters */	401	long4 font_mag; /* computed from FNT_DEF s and d parameters */
395	/char psname[STRSIZE];/ /* PostScript name of the font */	402	/char psname[STRSIZE];/ /* PostScript name of the font */
396	char name[STRSIZE]; /* full name of PXL file */	403	char name; / full name of PXL file */
397	FILEPTR font_file_id; /* file identifier (NO_FILE if none) */	404	FILEPTR font_file_id; /* file identifier (NO_FILE if none) */
398	#ifdef USEPXL	405	#ifdef USEPXL
399	long4 magnification; /* magnification read from PXL file */	406	long4 magnification; /* magnification read from PXL file */
Lines 487-494 void LoadAChar DVIPROTO((long4, regis Link Here
487	long4 NoSignExtend DVIPROTO((FILEPTR, int));	494	long4 NoSignExtend DVIPROTO((FILEPTR, int));
488	void OpenFontFile DVIPROTO((void));	495	void OpenFontFile DVIPROTO((void));
489	long4 PixRound DVIPROTO((long4, long4));	496	long4 PixRound DVIPROTO((long4, long4));
490	void PkRaster DVIPROTO((struct char_entry *, int));	497	void PkRaster DVIPROTO((struct char_entry *, int));
491	void RasterLine DVIPROTO((struct char_entry *, unsigned int,	498	void RasterLine DVIPROTO((struct char_entry *, unsigned int,
492	unsigned int, unsigned char *));	499	unsigned int, unsigned char *));
493	void RasterChar DVIPROTO((struct char_entry *));	500	void RasterChar DVIPROTO((struct char_entry *));
494	void ReadFontDef DVIPROTO((long4));	501	void ReadFontDef DVIPROTO((long4));
Lines 534-544 bool LastPageSpecified = _FALSE; Link Here
534	#ifndef KPATHSEA	541	#ifndef KPATHSEA
535	char *PXLpath = FONTAREA;	542	char *PXLpath = FONTAREA;
536	#endif	543	#endif
537	char G_progname[STRSIZE]; /* program name */	544	char G_progname; / program name */
538	char filename[STRSIZE]; /* DVI file name */	545	char filename; / DVI file name */
539	char rootname[STRSIZE]; /* DVI filename without extension */	546	char rootname; / DVI filename without extension */
540	char HeaderFileName = ""; / file name & path of Headerfile */	547	char HeaderFileName = ""; / file name & path of Headerfile */
541	char EmitFileName = ""; / file name & path for output */	548	char EmitFileName = ""; / file name & path for output */
		549	char tmp_dir[STRSIZE] = ""; /* temporary directory for auxilliary files */
542	#ifdef IBM3812	550	#ifdef IBM3812
543	bool FirstAlternate = _FALSE; /* first page from alternate casette ? */	551	bool FirstAlternate = _FALSE; /* first page from alternate casette ? */
544	#endif	552	#endif