By default, Bugzilla does not search the list of RESOLVED bugs.
You can force it to do so by putting the upper-case word ALL in front of your search query, e.g.: ALL tdelibs
We recommend searching for bugs this way, as you may discover that your bug has already been resolved and fixed in a later release.

[patch] Gentoo kpdf/xpdf patch from 2009

kpdf-3.5.10-xpdf-3.02pl4.patch (text/plain), 6.45 KB, created by ktbz.aoneshot.eliddell on 2012-08-17 19:34:33 CDT

(hide)

Description: Gentoo kpdf/xpdf patch from 2009

Filename:

MIME Type:

Creator: ktbz.aoneshot.eliddell

Created: 2012-08-17 19:34:33 CDT

Size: 6.45 KB

patch

obsolete

>Adaptation of xpdf 3.02pl4 to kpdf. > >2009-11-12 Martin von Gagern >References: >ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch >https://bugs.gentoo.org/290470 >http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603 >http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604 >http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606 >http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608 > >Index: kpdf-3.5.10/kpdf/xpdf/splash/Splash.cc >=================================================================== >--- kpdf-3.5.10.orig/kpdf/xpdf/splash/Splash.cc >+++ kpdf-3.5.10/kpdf/xpdf/splash/Splash.cc >@@ -12,6 +12,7 @@ > > #include <stdlib.h> > #include <string.h> >+#include <limits.h> > #include "gmem.h" > #include "SplashErrorCodes.h" > #include "SplashMath.h" >@@ -1937,7 +1938,10 @@ SplashError Splash::fillImageMask(Splash > xq = w % scaledWidth; > > // allocate pixel buffer >- pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w); >+ if (yp < 0 || yp > INT_MAX - 1) { >+ return splashErrBadArg; >+ } >+ pixBuf = (SplashColorPtr)gmallocn(yp + 1, w); > > // initialize the pixel pipe > pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha, >@@ -2233,9 +2237,12 @@ SplashError Splash::drawImage(SplashImag > xq = w % scaledWidth; > > // allocate pixel buffers >- colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps); >+ if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) { >+ return splashErrBadArg; >+ } >+ colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps); > if (srcAlpha) { >- alphaBuf = (Guchar *)gmalloc((yp + 1) * w); >+ alphaBuf = (Guchar *)gmallocn(yp + 1, w); > } else { > alphaBuf = NULL; > } >Index: kpdf-3.5.10/kpdf/xpdf/splash/SplashBitmap.cc >=================================================================== >--- kpdf-3.5.10.orig/kpdf/xpdf/splash/SplashBitmap.cc >+++ kpdf-3.5.10/kpdf/xpdf/splash/SplashBitmap.cc >@@ -11,6 +11,7 @@ > #endif > > #include <stdio.h> >+#include <limits.h> > #include "gmem.h" > #include "SplashErrorCodes.h" > #include "SplashBitmap.h" >@@ -27,30 +28,48 @@ SplashBitmap::SplashBitmap(int widthA, i > mode = modeA; > switch (mode) { > case splashModeMono1: >- rowSize = (width + 7) >> 3; >+ if (width > 0) { >+ rowSize = (width + 7) >> 3; >+ } else { >+ rowSize = -1; >+ } > break; > case splashModeMono8: >- rowSize = width; >+ if (width > 0) { >+ rowSize = width; >+ } else { >+ rowSize = -1; >+ } > break; > case splashModeRGB8: > case splashModeBGR8: >- rowSize = width * 3; >+ if (width > 0 && width <= INT_MAX / 3) { >+ rowSize = width * 3; >+ } else { >+ rowSize = -1; >+ } > break; > #if SPLASH_CMYK > case splashModeCMYK8: >- rowSize = width * 4; >+ if (width > 0 && width <= INT_MAX / 4) { >+ rowSize = width * 4; >+ } else { >+ rowSize = -1; >+ } > break; > #endif > } >- rowSize += rowPad - 1; >- rowSize -= rowSize % rowPad; >- data = (SplashColorPtr)gmallocn(rowSize, height); >+ if (rowSize > 0) { >+ rowSize += rowPad - 1; >+ rowSize -= rowSize % rowPad; >+ } >+ data = (SplashColorPtr)gmallocn(height, rowSize); > if (!topDown) { > data += (height - 1) * rowSize; > rowSize = -rowSize; > } > if (alphaA) { >- alpha = (Guchar *)gmalloc(width * height); >+ alpha = (Guchar *)gmallocn(width, height); > } else { > alpha = NULL; > } >Index: kpdf-3.5.10/kpdf/xpdf/splash/SplashErrorCodes.h >=================================================================== >--- kpdf-3.5.10.orig/kpdf/xpdf/splash/SplashErrorCodes.h >+++ kpdf-3.5.10/kpdf/xpdf/splash/SplashErrorCodes.h >@@ -31,4 +31,6 @@ > > #define splashErrZeroImage 9 // image of 0x0 > >+#define splashErrBadArg 9 // bad argument >+ > #endif >Index: kpdf-3.5.10/kpdf/xpdf/xpdf/PSOutputDev.cc >=================================================================== >--- kpdf-3.5.10.orig/kpdf/xpdf/xpdf/PSOutputDev.cc >+++ kpdf-3.5.10/kpdf/xpdf/xpdf/PSOutputDev.cc >@@ -4386,7 +4386,7 @@ void PSOutputDev::doImageL1Sep(GfxImageC > width, -height, height); > > // allocate a line buffer >- lineBuf = (Guchar *)gmalloc(4 * width); >+ lineBuf = (Guchar *)gmallocn(width, 4); > > // set up to process the data stream > imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(), >Index: kpdf-3.5.10/kpdf/xpdf/xpdf/Stream.cc >=================================================================== >--- kpdf-3.5.10.orig/kpdf/xpdf/xpdf/Stream.cc >+++ kpdf-3.5.10/kpdf/xpdf/xpdf/Stream.cc >@@ -323,6 +323,10 @@ ImageStream::ImageStream(Stream *strA, i > } else { > imgLineSize = nVals; > } >+ if (width > INT_MAX / nComps) { >+ // force a call to gmallocn(-1,...), which will throw an exception >+ imgLineSize = -1; >+ } > imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar)); > imgIdx = nVals; > } >Index: kpdf-3.5.10/kpdf/xpdf/xpdf/XRef.cc >=================================================================== >--- kpdf-3.5.10.orig/kpdf/xpdf/xpdf/XRef.cc >+++ kpdf-3.5.10/kpdf/xpdf/xpdf/XRef.cc >@@ -52,6 +52,8 @@ public: > // generation 0. > ObjectStream(XRef *xref, int objStrNumA); > >+ GBool isOk() { return ok; } >+ > ~ObjectStream(); > > // Return the object number of this object stream. >@@ -67,6 +69,7 @@ private: > int nObjects; // number of objects in the stream > Object *objs; // the objects (length = nObjects) > int *objNums; // the object numbers (length = nObjects) >+ GBool ok; > }; > > ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { >@@ -80,6 +83,7 @@ ObjectStream::ObjectStream(XRef *xref, i > nObjects = 0; > objs = NULL; > objNums = NULL; >+ ok = gFalse; > > if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) { > goto err1; >@@ -105,6 +109,13 @@ ObjectStream::ObjectStream(XRef *xref, i > goto err1; > } > >+ // this is an arbitrary limit to avoid integer overflow problems >+ // in the 'new Object[nObjects]' call (Acrobat apparently limits >+ // object streams to 100-200 objects) >+ if (nObjects > 1000000) { >+ error(-1, "Too many objects in an object stream"); >+ goto err1; >+ } > objs = new Object[nObjects]; > objNums = (int *)gmallocn(nObjects, sizeof(int)); > offsets = (int *)gmallocn(nObjects, sizeof(int)); >@@ -161,10 +172,10 @@ ObjectStream::ObjectStream(XRef *xref, i > } > > gfree(offsets); >+ ok = gTrue; > > err1: > objStr.free(); >- return; > } > > ObjectStream::~ObjectStream() { >@@ -837,6 +848,11 @@ Object *XRef::fetch(int num, int gen, Ob > delete objStr; > } > objStr = new ObjectStream(this, e->offset); >+ if (!objStr->isOk()) { >+ delete objStr; >+ objStr = NULL; >+ goto err; >+ } > } > objStr->getObject(e->gen, num, obj); > break; View Attachment As Diff View Attachment As Raw

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    [x]
  • | Forgot Password
    Login: [x]