mirror of
https://git.FreeBSD.org/ports.git
synced 2024-12-25 04:43:33 +00:00
Backport xpdf vendor patch
Bump PORTREVISION Approved by: gnome (marcus) Security: http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities http://secunia.com/advisories/17897/ CVE-2005-3191, CVE-2005-3192, CVE-2005-3193
This commit is contained in:
parent
2f1bffb087
commit
4a0a398072
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=150590
@ -7,7 +7,7 @@
|
||||
|
||||
PORTNAME= gpdf
|
||||
PORTVERSION= 2.10.0
|
||||
PORTREVISION= 3
|
||||
PORTREVISION= 4
|
||||
CATEGORIES= graphics print gnome
|
||||
MASTER_SITES= ${MASTER_SITE_GNOME}
|
||||
MASTER_SITE_SUBDIR= sources/${PORTNAME}/2.10
|
||||
|
120
graphics/gpdf/files/patch-SA17897
Normal file
120
graphics/gpdf/files/patch-SA17897
Normal file
@ -0,0 +1,120 @@
|
||||
--- xpdf/JPXStream.cc.orig Mon May 17 15:11:49 2004
|
||||
+++ xpdf/JPXStream.cc Tue Dec 6 18:07:18 2005
|
||||
@@ -666,7 +666,7 @@
|
||||
int segType;
|
||||
GBool haveSIZ, haveCOD, haveQCD, haveSOT;
|
||||
Guint precinctSize, style;
|
||||
- Guint segLen, capabilities, comp, i, j, r;
|
||||
+ Guint segLen, capabilities, nTiles, comp, i, j, r;
|
||||
|
||||
//----- main header
|
||||
haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
|
||||
@@ -701,8 +701,13 @@
|
||||
/ img.xTileSize;
|
||||
img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
|
||||
/ img.yTileSize;
|
||||
- img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles *
|
||||
- sizeof(JPXTile));
|
||||
+ nTiles = img.nXTiles * img.nYTiles;
|
||||
+ // check for overflow before allocating memory
|
||||
+ if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) {
|
||||
+ error(getPos(), "Bad tile count in JPX SIZ marker segment");
|
||||
+ return gFalse;
|
||||
+ }
|
||||
+ img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile));
|
||||
for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
|
||||
img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps *
|
||||
sizeof(JPXTileComp));
|
||||
--- xpdf/Stream.cc.orig Mon May 17 16:37:57 2004
|
||||
+++ xpdf/Stream.cc Tue Dec 6 18:05:14 2005
|
||||
@@ -407,18 +407,33 @@
|
||||
|
||||
StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
|
||||
int widthA, int nCompsA, int nBitsA) {
|
||||
+ int totalBits;
|
||||
+
|
||||
str = strA;
|
||||
predictor = predictorA;
|
||||
width = widthA;
|
||||
nComps = nCompsA;
|
||||
nBits = nBitsA;
|
||||
+ predLine = NULL;
|
||||
+ ok = gFalse;
|
||||
|
||||
nVals = width * nComps;
|
||||
+ totalBits = nVals * nBits;
|
||||
+ if (totalBits == 0 ||
|
||||
+ (totalBits / nBits) / nComps != width ||
|
||||
+ totalBits + 7 < 0) {
|
||||
+ return;
|
||||
+ }
|
||||
pixBytes = (nComps * nBits + 7) >> 3;
|
||||
- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
|
||||
+ rowBytes = ((totalBits + 7) >> 3) + pixBytes;
|
||||
+ if (rowBytes < 0) {
|
||||
+ return;
|
||||
+ }
|
||||
predLine = (Guchar *)gmalloc(rowBytes);
|
||||
memset(predLine, 0, rowBytes);
|
||||
predIdx = rowBytes;
|
||||
+
|
||||
+ ok = gTrue;
|
||||
}
|
||||
|
||||
StreamPredictor::~StreamPredictor() {
|
||||
@@ -1012,6 +1027,10 @@
|
||||
FilterStream(strA) {
|
||||
if (predictor != 1) {
|
||||
pred = new StreamPredictor(this, predictor, columns, colors, bits);
|
||||
+ if (!pred->isOk()) {
|
||||
+ delete pred;
|
||||
+ pred = NULL;
|
||||
+ }
|
||||
} else {
|
||||
pred = NULL;
|
||||
}
|
||||
@@ -2897,6 +2916,14 @@
|
||||
height = read16();
|
||||
width = read16();
|
||||
numComps = str->getChar();
|
||||
+ if (numComps <= 0 || numComps > 4) {
|
||||
+ error(getPos(), "Bad number of components in DCT stream", prec);
|
||||
+ return gFalse;
|
||||
+ }
|
||||
+ if (numComps <= 0 || numComps > 4) {
|
||||
+ error(getPos(), "Bad number of components in DCT stream", prec);
|
||||
+ return gFalse;
|
||||
+ }
|
||||
if (prec != 8) {
|
||||
error(getPos(), "Bad DCT precision %d", prec);
|
||||
return gFalse;
|
||||
@@ -3255,6 +3282,10 @@
|
||||
FilterStream(strA) {
|
||||
if (predictor != 1) {
|
||||
pred = new StreamPredictor(this, predictor, columns, colors, bits);
|
||||
+ if (!pred->isOk()) {
|
||||
+ delete pred;
|
||||
+ pred = NULL;
|
||||
+ }
|
||||
} else {
|
||||
pred = NULL;
|
||||
}
|
||||
--- xpdf/Stream.h.orig Mon May 17 16:37:57 2004
|
||||
+++ xpdf/Stream.h Tue Dec 6 18:05:14 2005
|
||||
@@ -233,6 +233,8 @@
|
||||
|
||||
~StreamPredictor();
|
||||
|
||||
+ GBool isOk() { return ok; }
|
||||
+
|
||||
int lookChar();
|
||||
int getChar();
|
||||
|
||||
@@ -250,6 +252,7 @@
|
||||
int rowBytes; // bytes per line
|
||||
Guchar *predLine; // line buffer
|
||||
int predIdx; // current index in predLine
|
||||
+ GBool ok;
|
||||
};
|
||||
|
||||
//------------------------------------------------------------------------
|
@ -8,6 +8,7 @@
|
||||
|
||||
PORTNAME= poppler
|
||||
PORTVERSION= 0.4.2
|
||||
PORTREVISION= 1
|
||||
CATEGORIES= graphics print
|
||||
MASTER_SITES= http://poppler.freedesktop.org/
|
||||
|
||||
|
120
graphics/poppler/files/patch-SA17897
Normal file
120
graphics/poppler/files/patch-SA17897
Normal file
@ -0,0 +1,120 @@
|
||||
--- poppler/JPXStream.cc.orig Thu Mar 3 16:46:03 2005
|
||||
+++ poppler/JPXStream.cc Wed Dec 7 00:33:40 2005
|
||||
@@ -666,7 +666,7 @@
|
||||
int segType;
|
||||
GBool haveSIZ, haveCOD, haveQCD, haveSOT;
|
||||
Guint precinctSize, style;
|
||||
- Guint segLen, capabilities, comp, i, j, r;
|
||||
+ Guint segLen, capabilities, nTiles, comp, i, j, r;
|
||||
|
||||
//----- main header
|
||||
haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
|
||||
@@ -701,8 +701,13 @@
|
||||
/ img.xTileSize;
|
||||
img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
|
||||
/ img.yTileSize;
|
||||
- img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles *
|
||||
- sizeof(JPXTile));
|
||||
+ nTiles = img.nXTiles * img.nYTiles;
|
||||
+ // check for overflow before allocating memory
|
||||
+ if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) {
|
||||
+ error(getPos(), "Bad tile count in JPX SIZ marker segment");
|
||||
+ return gFalse;
|
||||
+ }
|
||||
+ img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile));
|
||||
for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
|
||||
img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps *
|
||||
sizeof(JPXTileComp));
|
||||
--- poppler/Stream.cc.orig Wed Apr 27 17:56:18 2005
|
||||
+++ poppler/Stream.cc Wed Dec 7 00:32:08 2005
|
||||
@@ -415,18 +415,33 @@
|
||||
|
||||
StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
|
||||
int widthA, int nCompsA, int nBitsA) {
|
||||
+ int totalBits;
|
||||
+
|
||||
str = strA;
|
||||
predictor = predictorA;
|
||||
width = widthA;
|
||||
nComps = nCompsA;
|
||||
nBits = nBitsA;
|
||||
+ predLine = NULL;
|
||||
+ ok = gFalse;
|
||||
|
||||
nVals = width * nComps;
|
||||
+ totalBits = nVals * nBits;
|
||||
+ if (totalBits == 0 ||
|
||||
+ (totalBits / nBits) / nComps != width ||
|
||||
+ totalBits + 7 < 0) {
|
||||
+ return;
|
||||
+ }
|
||||
pixBytes = (nComps * nBits + 7) >> 3;
|
||||
- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
|
||||
+ rowBytes = ((totalBits + 7) >> 3) + pixBytes;
|
||||
+ if (rowBytes < 0) {
|
||||
+ return;
|
||||
+ }
|
||||
predLine = (Guchar *)gmalloc(rowBytes);
|
||||
memset(predLine, 0, rowBytes);
|
||||
predIdx = rowBytes;
|
||||
+
|
||||
+ ok = gTrue;
|
||||
}
|
||||
|
||||
StreamPredictor::~StreamPredictor() {
|
||||
@@ -1020,6 +1035,10 @@
|
||||
FilterStream(strA) {
|
||||
if (predictor != 1) {
|
||||
pred = new StreamPredictor(this, predictor, columns, colors, bits);
|
||||
+ if (!pred->isOk()) {
|
||||
+ delete pred;
|
||||
+ pred = NULL;
|
||||
+ }
|
||||
} else {
|
||||
pred = NULL;
|
||||
}
|
||||
@@ -2907,6 +2926,14 @@
|
||||
height = read16();
|
||||
width = read16();
|
||||
numComps = str->getChar();
|
||||
+ if (numComps <= 0 || numComps > 4) {
|
||||
+ error(getPos(), "Bad number of components in DCT stream", prec);
|
||||
+ return gFalse;
|
||||
+ }
|
||||
+ if (numComps <= 0 || numComps > 4) {
|
||||
+ error(getPos(), "Bad number of components in DCT stream", prec);
|
||||
+ return gFalse;
|
||||
+ }
|
||||
if (prec != 8) {
|
||||
error(getPos(), "Bad DCT precision %d", prec);
|
||||
return gFalse;
|
||||
@@ -3268,6 +3295,10 @@
|
||||
FilterStream(strA) {
|
||||
if (predictor != 1) {
|
||||
pred = new StreamPredictor(this, predictor, columns, colors, bits);
|
||||
+ if (!pred->isOk()) {
|
||||
+ delete pred;
|
||||
+ pred = NULL;
|
||||
+ }
|
||||
} else {
|
||||
pred = NULL;
|
||||
}
|
||||
--- poppler/Stream.h.orig Wed Apr 27 17:56:18 2005
|
||||
+++ poppler/Stream.h Wed Dec 7 00:32:08 2005
|
||||
@@ -231,6 +231,8 @@
|
||||
|
||||
~StreamPredictor();
|
||||
|
||||
+ GBool isOk() { return ok; }
|
||||
+
|
||||
int lookChar();
|
||||
int getChar();
|
||||
|
||||
@@ -248,6 +250,7 @@
|
||||
int rowBytes; // bytes per line
|
||||
Guchar *predLine; // line buffer
|
||||
int predIdx; // current index in predLine
|
||||
+ GBool ok;
|
||||
};
|
||||
|
||||
//------------------------------------------------------------------------
|
Loading…
Reference in New Issue
Block a user