[pkgsrc/trunk]: pkgsrc/print/cups Port the security fixes for SA181303 from p...

[joerg <joerg%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/f065a12348c7
branches:  trunk
changeset: 508150:f065a12348c7
user:      joerg <joerg%pkgsrc.org@localhost>
date:      Wed Feb 15 19:06:13 2006 +0000

description:
Port the security fixes for SA181303 from print/xpdf to print/cups.

diffstat:

 print/cups/distinfo         |   5 +-
 print/cups/patches/patch-ap |  70 ++++++++++++++++++++++++++++++++++++++++
 print/cups/patches/patch-be |  77 +++++++++++++++++++++++++++++++++-----------
 3 files changed, 131 insertions(+), 21 deletions(-)

diffs (220 lines):

diff -r 9cd676c55b95 -r f065a12348c7 print/cups/distinfo
--- a/print/cups/distinfo       Wed Feb 15 18:43:45 2006 +0000
+++ b/print/cups/distinfo       Wed Feb 15 19:06:13 2006 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.36 2005/12/19 16:04:48 joerg Exp $
+$NetBSD: distinfo,v 1.37 2006/02/15 19:06:13 joerg Exp $
 
 SHA1 (cups-1.1.23-source.tar.bz2) = 32d5bfb44c4edc1b54ccb014b5a44499295c6c5c
 RMD160 (cups-1.1.23-source.tar.bz2) = 255ec4c22422b14f2367d69f3ec7e590dc46bea5
@@ -12,9 +12,10 @@
 SHA1 (patch-ag) = 47a5c7a9ad7c604fa3253aebbaa62f576fb477d0
 SHA1 (patch-an) = 8eb0f80067839d3d112d93e08cb8ad6854fa2b4c
 SHA1 (patch-ao) = c4c8f833cf4a09a686a338df6c209cebec36c6ef
+SHA1 (patch-ap) = 81b8213e16f875b22d0684d0c06dfe75af11dcb4
 SHA1 (patch-at) = aa36ec591164675b889d2cf32e4d754e9b6db94f
 SHA1 (patch-au) = ab43911c1b27b250a257c67d1d34066237e4da98
 SHA1 (patch-av) = 33437f71e0b6443b172246f1962f9d2eebbd8f11
 SHA1 (patch-aw) = f9a83423eac1a631b67e10911e0ef9e111da9b84
-SHA1 (patch-be) = f9b4733f1d5ea28066fc0f0272b5e2b5f9881108
+SHA1 (patch-be) = 98f0c2d060df5f6bd95129d80b5ba29c276a3c67
 SHA1 (patch-bf) = 50d42bcdf3b103e2c5828baa2661ec1c87c7da1c
diff -r 9cd676c55b95 -r f065a12348c7 print/cups/patches/patch-ap
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/print/cups/patches/patch-ap       Wed Feb 15 19:06:13 2006 +0000
@@ -0,0 +1,70 @@
+$NetBSD: patch-ap,v 1.6 2006/02/15 19:06:13 joerg Exp $
+
+--- pdftops/JBIG2Stream.cxx.orig       2006-02-13 22:20:31.000000000 +0100
++++ pdftops/JBIG2Stream.cxx
+@@ -13,6 +13,7 @@
+ #endif
+ 
+ #include <stdlib.h>
++#include <limits.h>
+ #include "GList.h"
+ #include "Error.h"
+ #include "JBIG2Stream.h"
+@@ -1001,6 +1002,10 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    data = NULL;
++    return;
++  }
+   data = (Guchar *)gmalloc(h * line);
+ }
+ 
+@@ -1010,6 +1015,12 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+   memcpy(data, bitmap->data, h * line);
+ }
+@@ -1036,7 +1047,7 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++  if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
+     return;
+   }
+   data = (Guchar *)grealloc(data, newH * line);
+@@ -2576,6 +2587,14 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (w == 0 || h >= INT_MAX / w) {
++    error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -2763,6 +2782,9 @@ JBIG2Bitmap *JBIG2Stream::readGenericBit
+   int code1, code2, code3;
+   int x, y, a0, pix, i, refI, codingI;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h)
++    return NULL;
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
diff -r 9cd676c55b95 -r f065a12348c7 print/cups/patches/patch-be
--- a/print/cups/patches/patch-be       Wed Feb 15 18:43:45 2006 +0000
+++ b/print/cups/patches/patch-be       Wed Feb 15 19:06:13 2006 +0000
@@ -1,31 +1,34 @@
-$NetBSD: patch-be,v 1.1 2005/12/17 04:22:55 jlam Exp $
+$NetBSD: patch-be,v 1.2 2006/02/15 19:06:13 joerg Exp $
 
 --- pdftops/Stream.cxx.orig    2004-02-02 17:41:09.000000000 -0500
 +++ pdftops/Stream.cxx
-@@ -404,18 +404,34 @@ void ImageStream::skipLine() {
- 
- StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
-                                int widthA, int nCompsA, int nBitsA) {
-+  int totalBits;
-+
-   str = strA;
-   predictor = predictorA;
+@@ -15,6 +15,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <stddef.h>
++#include <limits.h>
+ #ifndef WIN32
+ #include <unistd.h>
+ #endif
+@@ -409,13 +410,30 @@ StreamPredictor::StreamPredictor(Stream 
    width = widthA;
    nComps = nCompsA;
    nBits = nBitsA;
 +  predLine = NULL;
 +  ok = gFalse;
++
++  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
++      nComps >= INT_MAX / nBits ||
++      width >= INT_MAX / nComps / nBits) {
++    return;
++  }
  
    nVals = width * nComps;
-+  totalBits = nVals * nBits;
-+  if (totalBits == 0 ||
-+      (totalBits / nBits) / nComps != width ||
-+      totalBits + 7 < 0) {
++  if (nVals * nBits + 7 <= 0) {
 +    return;
 +  }
    pixBytes = (nComps * nBits + 7) >> 3;
--  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
-+  rowBytes = ((totalBits + 7) >> 3) + pixBytes;
+   rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
 +  if (rowBytes < 0) {
 +    return;
 +  }
@@ -38,7 +41,7 @@
  }
  
  StreamPredictor::~StreamPredictor() {
-@@ -991,6 +1007,10 @@ LZWStream::LZWStream(Stream *strA, int p
+@@ -991,6 +1009,10 @@ LZWStream::LZWStream(Stream *strA, int p
      FilterStream(strA) {
    if (predictor != 1) {
      pred = new StreamPredictor(this, predictor, columns, colors, bits);
@@ -49,7 +52,17 @@
    } else {
      pred = NULL;
    }
-@@ -2891,6 +2911,10 @@ GBool DCTStream::readBaselineSOF() {
+@@ -1239,6 +1261,9 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns + 3 < 1 || columns + 4 < 1 || columns < 1) {
++    columns = 1;
++  }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+@@ -2891,6 +2916,10 @@ GBool DCTStream::readBaselineSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
@@ -60,7 +73,7 @@
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -2917,6 +2941,10 @@ GBool DCTStream::readProgressiveSOF() {
+@@ -2917,6 +2946,10 @@ GBool DCTStream::readProgressiveSOF() {
    height = read16();
    width = read16();
    numComps = str->getChar();
@@ -71,7 +84,33 @@
    if (prec != 8) {
      error(getPos(), "Bad DCT precision %d", prec);
      return gFalse;
-@@ -3249,6 +3277,10 @@ FlateStream::FlateStream(Stream *strA, i
+@@ -2939,6 +2972,10 @@ GBool DCTStream::readScanInfo() {
+ 
+   length = read16() - 2;
+   scanInfo.numComps = str->getChar();
++  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   --length;
+   if (length != 2 * scanInfo.numComps + 3) {
+     error(getPos(), "Bad DCT scan info block");
+@@ -3013,12 +3050,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & 0x0f) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+       numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3249,6 +3286,10 @@ FlateStream::FlateStream(Stream *strA, i
      FilterStream(strA) {
    if (predictor != 1) {
      pred = new StreamPredictor(this, predictor, columns, colors, bits);