pkgsrc-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc/trunk]: pkgsrc/print/xpdf Apply security fix for SA18303 taken from F...
details: https://anonhg.NetBSD.org/pkgsrc/rev/7c4e24d3aee5
branches: trunk
changeset: 506852:7c4e24d3aee5
user: tron <tron%pkgsrc.org@localhost>
date: Sun Jan 22 23:13:33 2006 +0000
description:
Apply security fix for SA18303 taken from Fedora Core 4.
Bump package revision because of this fix.
diffstat:
print/xpdf/Makefile | 4 +-
print/xpdf/distinfo | 6 +-
print/xpdf/patches/patch-ao | 79 ++++++++++++++++++++++++++++++++++
print/xpdf/patches/patch-aq | 32 +++++++++++++
print/xpdf/patches/patch-at | 101 +++++++++++++++++++++++++++++++++++++------
5 files changed, 204 insertions(+), 18 deletions(-)
diffs (271 lines):
diff -r b644d6a0e5f7 -r 7c4e24d3aee5 print/xpdf/Makefile
--- a/print/xpdf/Makefile Sun Jan 22 22:27:22 2006 +0000
+++ b/print/xpdf/Makefile Sun Jan 22 23:13:33 2006 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.51 2006/01/22 22:01:11 ghen Exp $
+# $NetBSD: Makefile,v 1.52 2006/01/22 23:13:33 tron Exp $
DISTNAME= xpdf-3.01
PKGNAME= ${DISTNAME}pl1
-PKGREVISION= 3
+PKGREVISION= 4
CATEGORIES= print
MASTER_SITES= ftp://ftp.foolabs.com/pub/xpdf/ \
${MASTER_SITE_SUNSITE:=apps/graphics/viewers/X/xpdf/} \
diff -r b644d6a0e5f7 -r 7c4e24d3aee5 print/xpdf/distinfo
--- a/print/xpdf/distinfo Sun Jan 22 22:27:22 2006 +0000
+++ b/print/xpdf/distinfo Sun Jan 22 23:13:33 2006 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.24 2005/12/20 16:00:16 ghen Exp $
+$NetBSD: distinfo,v 1.25 2006/01/22 23:13:33 tron Exp $
SHA1 (xpdf-3.01.tar.gz) = 472cbf0f3df4e20a3ab7ada2e704b4e10d1d385b
RMD160 (xpdf-3.01.tar.gz) = d734065ce12db8d0c37d9d0ac0ca7c287be59442
@@ -20,6 +20,8 @@
SHA1 (patch-al) = b6e958b0592ac285b3ade90079c83da30db8a8b6
SHA1 (patch-am) = 794ff952c749c8dab6f575d55602cdc7e7157fef
SHA1 (patch-an) = 94ea208c43f4df1ac3a9bf01cc874d488ae49a9a
+SHA1 (patch-ao) = 9faff0cca36db1a8030e6cc0587e66105c9026b2
+SHA1 (patch-aq) = ab8d29fe9743711fd57fe5b0506c1dc31e65c40e
SHA1 (patch-ar) = f3d320991e189a21244acd31ca5cc6cfdb18bd96
-SHA1 (patch-at) = 8827e22d0f3e341ed45ad92637b02a3a31f3168d
+SHA1 (patch-at) = ca00e6cf293e3683bda41d03b6b140175c992884
SHA1 (patch-au) = af765089ee88369da0afef534f46ec50c5cc6d4f
diff -r b644d6a0e5f7 -r 7c4e24d3aee5 print/xpdf/patches/patch-ao
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/print/xpdf/patches/patch-ao Sun Jan 22 23:13:33 2006 +0000
@@ -0,0 +1,79 @@
+$NetBSD: patch-ao,v 1.3 2006/01/22 23:13:33 tron Exp $
+
+--- xpdf/JBIG2Stream.cc.orig 2005-08-17 06:34:31.000000000 +0100
++++ xpdf/JBIG2Stream.cc 2006-01-22 22:48:31.000000000 +0000
+@@ -7,6 +7,7 @@
+ //========================================================================
+
+ #include <aconf.h>
++#include <limits.h>
+
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,9 +682,15 @@
+ w = wA;
+ h = hA;
+ line = (wA + 7) >> 3;
+- // need to allocate one extra guard byte for use in combine()
+- data = (Guchar *)gmalloc(h * line + 1);
+- data[h * line] = 0;
++
++ if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++ data = NULL;
++ }
++ else {
++ // need to allocate one extra guard byte for use in combine()
++ data = (Guchar *)gmalloc(h * line + 1);
++ data[h * line] = 0;
++ }
+ }
+
+ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, JBIG2Bitmap *bitmap):
+@@ -692,6 +699,12 @@
+ w = bitmap->w;
+ h = bitmap->h;
+ line = bitmap->line;
++
++ if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++ data = NULL;
++ return;
++ }
++
+ // need to allocate one extra guard byte for use in combine()
+ data = (Guchar *)gmalloc(h * line + 1);
+ memcpy(data, bitmap->data, h * line);
+@@ -720,7 +733,7 @@
+ }
+
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+- if (newH <= h) {
++ if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
+ return;
+ }
+ // need to allocate one extra guard byte for use in combine()
+@@ -2305,6 +2318,15 @@
+ error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+ return;
+ }
++ if (gridH == 0 || gridW >= INT_MAX / gridH) {
++ error(getPos(), "Bad size in JBIG2 halftone segment");
++ return;
++ }
++ if (w == 0 || h >= INT_MAX / w) {
++ error(getPos(), "Bad size in JBIG2 bitmap segment");
++ return;
++ }
++
+ patternDict = (JBIG2PatternDict *)seg;
+ bpp = 0;
+ i = 1;
+@@ -2936,6 +2958,9 @@
+ JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+ int x, y, pix;
+
++ if (w < 0 || h <= 0 || w >= INT_MAX / h)
++ return NULL;
++
+ bitmap = new JBIG2Bitmap(0, w, h);
+ bitmap->clearToZero();
+
diff -r b644d6a0e5f7 -r 7c4e24d3aee5 print/xpdf/patches/patch-aq
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/print/xpdf/patches/patch-aq Sun Jan 22 23:13:33 2006 +0000
@@ -0,0 +1,32 @@
+$NetBSD: patch-aq,v 1.1 2006/01/22 23:13:33 tron Exp $
+
+--- xpdf/JPXStream.cc.orig 2006-01-22 22:52:51.000000000 +0000
++++ xpdf/JPXStream.cc 2006-01-22 22:48:31.000000000 +0000
+@@ -7,6 +7,7 @@
+ //========================================================================
+
+ #include <aconf.h>
++#include <limits.h>
+
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -818,13 +819,15 @@
+ / img.xTileSize;
+ img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
+ / img.yTileSize;
+- nTiles = img.nXTiles * img.nYTiles;
+ // check for overflow before allocating memory
+- if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) {
+- error(getPos(), "Bad tile count in JPX SIZ marker segment");
+- return gFalse;
++ if (img.nXTiles <= 0 || img.nYTiles <= 0 ||
++ img.nXTiles >= INT_MAX/img.nYTiles) {
++ error(getPos(), "Bad tile count in JPX SIZ marker segment");
++ return gFalse;
+ }
++ nTiles = img.nXTiles * img.nYTiles;
+ img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
++
+ for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
+ img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
+ sizeof(JPXTileComp));
diff -r b644d6a0e5f7 -r 7c4e24d3aee5 print/xpdf/patches/patch-at
--- a/print/xpdf/patches/patch-at Sun Jan 22 22:27:22 2006 +0000
+++ b/print/xpdf/patches/patch-at Sun Jan 22 23:13:33 2006 +0000
@@ -1,28 +1,101 @@
-$NetBSD: patch-at,v 1.1 2005/12/18 20:05:32 dillo Exp $
+$NetBSD: patch-at,v 1.2 2006/01/22 23:13:33 tron Exp $
---- xpdf/Stream.cc.orig 2005-12-15 22:53:25.000000000 -0500
-+++ xpdf/Stream.cc
-@@ -2919,11 +2919,7 @@ GBool DCTStream::readBaselineSOF() {
- width = read16();
- numComps = str->getChar();
- if (numComps <= 0 || numComps > 4) {
+--- xpdf/Stream.cc.orig 2006-01-22 23:03:34.000000000 +0000
++++ xpdf/Stream.cc 2006-01-22 23:03:00.000000000 +0000
+@@ -15,6 +15,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <stddef.h>
++#include <limits.h>
+ #ifndef WIN32
+ #include <unistd.h>
+ #endif
+@@ -401,8 +402,6 @@
+
+ StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
+ int widthA, int nCompsA, int nBitsA) {
+- int totalBits;
+-
+ str = strA;
+ predictor = predictorA;
+ width = widthA;
+@@ -411,15 +410,17 @@
+ predLine = NULL;
+ ok = gFalse;
+
++ if (width <= 0 || nComps <= 0 || nBits <= 0 ||
++ nComps >= INT_MAX/nBits ||
++ width >= INT_MAX/nComps/nBits) {
++ return;
++ }
+ nVals = width * nComps;
+- totalBits = nVals * nBits;
+- if (totalBits == 0 ||
+- (totalBits / nBits) / nComps != width ||
+- totalBits + 7 < 0) {
++ if (nVals * nBits + 7 <= 0) {
+ return;
+ }
+ pixBytes = (nComps * nBits + 7) >> 3;
+- rowBytes = ((totalBits + 7) >> 3) + pixBytes;
++ rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+ if (rowBytes < 0) {
+ return;
+ }
+@@ -1275,7 +1276,7 @@
+ endOfLine = endOfLineA;
+ byteAlign = byteAlignA;
+ columns = columnsA;
+- if (columns < 1) {
++ if (columns + 3 < 1 || columns + 4 < 1 || columns < 1) {
+ columns = 1;
+ }
+ rows = rowsA;
+@@ -2922,10 +2923,6 @@
+ error(getPos(), "Bad number of components in DCT stream", prec);
+ return gFalse;
+ }
+- if (numComps <= 0 || numComps > 4) {
- error(getPos(), "Bad number of components in DCT stream", prec);
- return gFalse;
- }
-- if (numComps <= 0 || numComps > 4) {
-- error(getPos(), "Bad number of components in DCT stream", prec);
-+ error(getPos(), "Bad number of components %d in DCT stream", numComps);
+ if (prec != 8) {
+ error(getPos(), "Bad DCT precision %d", prec);
return gFalse;
- }
- if (prec != 8) {
-@@ -2952,6 +2948,10 @@ GBool DCTStream::readProgressiveSOF() {
+@@ -2952,6 +2949,10 @@
height = read16();
width = read16();
numComps = str->getChar();
+ if (numComps <= 0 || numComps > 4) {
-+ error(getPos(), "Bad number of components %d in DCT stream", numComps);
++ error(getPos(), "Bad number of components in DCT stream", prec);
+ return gFalse;
+ }
if (prec != 8) {
error(getPos(), "Bad DCT precision %d", prec);
return gFalse;
+@@ -2974,6 +2975,10 @@
+
+ length = read16() - 2;
+ scanInfo.numComps = str->getChar();
++ if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++ error(getPos(), "Bad number of components in DCT stream");
++ return gFalse;
++ }
+ --length;
+ if (length != 2 * scanInfo.numComps + 3) {
+ error(getPos(), "Bad DCT scan info block");
+@@ -3058,12 +3063,12 @@
+ while (length > 0) {
+ index = str->getChar();
+ --length;
+- if ((index & 0x0f) >= 4) {
++ if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+ error(getPos(), "Bad DCT Huffman table");
+ return gFalse;
+ }
+ if (index & 0x10) {
+- index &= 0x0f;
++ index &= 0x03;
+ if (index >= numACHuffTables)
+ numACHuffTables = index+1;
+ tbl = &acHuffTables[index];
Home |
Main Index |
Thread Index |
Old Index