t1lib/trunk/format-security.diff

   1 --- a/lib/type1/objects.c
   2 +++ b/lib/type1/objects.c
   3 @@ -957,7 +957,7 @@
   4
   5         sprintf(typemsg, "Wrong object type in %s; expected %s, found %s.\n",
   6                    name, TypeFmt(expect), TypeFmt(obj->type));
   7 -       IfTrace0(TRUE,typemsg);
   8 +       IfTrace1(TRUE, "%s", typemsg);
   9
  10         ObjectPostMortem(obj);
  11
  12 --- a/lib/t1lib/t1subset.c
  13 +++ b/lib/t1lib/t1subset.c
  14 @@ -759,7 +759,7 @@
  15              tr_len);
  16      T1_PrintLog( "T1_SubsetFont()", err_warn_msg_buf,
  17                  T1LOG_DEBUG);
  18 -    l+=sprintf( &(trailerbuf[l]), linebuf); /* contains the PostScript trailer */
  19 +    l+=sprintf( &(trailerbuf[l]), "%s", linebuf); /* contains the PostScript trailer */
  20    }
  21
  22    /* compute size of output file */
  23 --- a/lib/type1/objects.h
  24 +++ b/lib/type1/objects.h
  25 @@ -214,7 +214,7 @@
  26  /*SHARED*/
  27  /* NDW: personally, I want to see status and error messages! */
  28  #define IfTrace0(condition,model)                                 \
  29 -        {if (condition) printf(model);}
  30 +        {if (condition) fputs(model,stdout);}
  31  #define IfTrace1(condition,model,arg0)                            \
  32          {if (condition) printf(model,arg0);}
  33  #define IfTrace2(condition,model,arg0,arg1)                       \