diff options
author | salo <salo> | 2006-02-16 00:25:30 +0000 |
---|---|---|
committer | salo <salo> | 2006-02-16 00:25:30 +0000 |
commit | dd11c4470360571348108a52c76bf083d02b289b (patch) | |
tree | 18429e2bec1e91f12428e918f4d820d3a5ca2c5d | |
parent | fc0adf0d2e5ce870a793a972f9689ace035d811a (diff) | |
download | pkgsrc-dd11c4470360571348108a52c76bf083d02b289b.tar.gz |
Pullup ticket 1139 - requested by Joerg Sonnenberger
security fix for cups
Revisions pulled up:
- pkgsrc/print/cups/Makefile patch
- pkgsrc/print/cups/distinfo 1.37
- pkgsrc/print/cups/patches/patch-ap 1.6
- pkgsrc/print/cups/patches/patch-be 1.2
Module Name: pkgsrc
Committed By: joerg
Date: Wed Feb 15 19:06:13 UTC 2006
Modified Files:
pkgsrc/print/cups: distinfo
pkgsrc/print/cups/patches: patch-be
Added Files:
pkgsrc/print/cups/patches: patch-ap
Log Message:
Port the security fixes for SA18303 from print/xpdf to print/cups.
-rw-r--r-- | print/cups/Makefile | 4 | ||||
-rw-r--r-- | print/cups/distinfo | 5 | ||||
-rw-r--r-- | print/cups/patches/patch-ap | 70 | ||||
-rw-r--r-- | print/cups/patches/patch-be | 77 |
4 files changed, 133 insertions, 23 deletions
diff --git a/print/cups/Makefile b/print/cups/Makefile index 8dfd26eae8a..b630bb1be76 100644 --- a/print/cups/Makefile +++ b/print/cups/Makefile @@ -1,4 +1,4 @@ -# $NetBSD: Makefile,v 1.103 2005/12/19 16:04:48 joerg Exp $ +# $NetBSD: Makefile,v 1.103.2.1 2006/02/16 00:25:30 salo Exp $ # # The CUPS author is very good about taking back changes into the main # CUPS distribution. The correct place to send patches or bug-fixes is: @@ -6,7 +6,7 @@ DISTNAME= cups-${DIST_VERS}-source PKGNAME= cups-${VERS} -PKGREVISION= 5 +PKGREVISION= 7 BASE_VERS= 1.1.23 DIST_VERS= ${BASE_VERS} VERS= ${DIST_VERS:S/-/./g} diff --git a/print/cups/distinfo b/print/cups/distinfo index 16ea5f7694c..3af4e169547 100644 --- a/print/cups/distinfo +++ b/print/cups/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.36 2005/12/19 16:04:48 joerg Exp $ +$NetBSD: distinfo,v 1.36.2.1 2006/02/16 00:25:30 salo Exp $ SHA1 (cups-1.1.23-source.tar.bz2) = 32d5bfb44c4edc1b54ccb014b5a44499295c6c5c RMD160 (cups-1.1.23-source.tar.bz2) = 255ec4c22422b14f2367d69f3ec7e590dc46bea5 @@ -12,9 +12,10 @@ SHA1 (patch-af) = 04e5bf3b73083eb2457a20b0f5238f017fe4aaab SHA1 (patch-ag) = 47a5c7a9ad7c604fa3253aebbaa62f576fb477d0 SHA1 (patch-an) = 8eb0f80067839d3d112d93e08cb8ad6854fa2b4c SHA1 (patch-ao) = c4c8f833cf4a09a686a338df6c209cebec36c6ef +SHA1 (patch-ap) = 81b8213e16f875b22d0684d0c06dfe75af11dcb4 SHA1 (patch-at) = aa36ec591164675b889d2cf32e4d754e9b6db94f SHA1 (patch-au) = ab43911c1b27b250a257c67d1d34066237e4da98 SHA1 (patch-av) = 33437f71e0b6443b172246f1962f9d2eebbd8f11 SHA1 (patch-aw) = f9a83423eac1a631b67e10911e0ef9e111da9b84 -SHA1 (patch-be) = f9b4733f1d5ea28066fc0f0272b5e2b5f9881108 +SHA1 (patch-be) = 98f0c2d060df5f6bd95129d80b5ba29c276a3c67 SHA1 (patch-bf) = 50d42bcdf3b103e2c5828baa2661ec1c87c7da1c diff --git a/print/cups/patches/patch-ap b/print/cups/patches/patch-ap new file mode 100644 index 00000000000..99cedde643e --- /dev/null +++ b/print/cups/patches/patch-ap @@ -0,0 +1,70 @@ +$NetBSD: patch-ap,v 1.5.14.1 2006/02/16 00:25:30 salo Exp $ + +--- pdftops/JBIG2Stream.cxx.orig 2006-02-13 22:20:31.000000000 +0100 ++++ pdftops/JBIG2Stream.cxx +@@ -13,6 +13,7 @@ + #endif + + #include <stdlib.h> ++#include <limits.h> + #include "GList.h" + #include "Error.h" + #include "JBIG2Stream.h" +@@ -1001,6 +1002,10 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, + w = wA; + h = hA; + line = (wA + 7) >> 3; ++ if (h < 0 || line <= 0 || h >= INT_MAX / line) { ++ data = NULL; ++ return; ++ } + data = (Guchar *)gmalloc(h * line); + } + +@@ -1010,6 +1015,12 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, + w = bitmap->w; + h = bitmap->h; + line = bitmap->line; ++ ++ if (h < 0 || line <= 0 || h >= INT_MAX / line) { ++ data = NULL; ++ return; ++ } ++ + data = (Guchar *)gmalloc(h * line); + memcpy(data, bitmap->data, h * line); + } +@@ -1036,7 +1047,7 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint + } + + void JBIG2Bitmap::expand(int newH, Guint pixel) { +- if (newH <= h) { ++ if (newH <= h || line <= 0 || newH >= INT_MAX / line) { + return; + } + data = (Guchar *)grealloc(data, newH * line); +@@ -2576,6 +2587,14 @@ void JBIG2Stream::readHalftoneRegionSeg( + error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment"); + return; + } ++ if (gridH == 0 || gridW >= INT_MAX / gridH) { ++ error(getPos(), "Bad size in JBIG2 halftone segment"); ++ return; ++ } ++ if (w == 0 || h >= INT_MAX / w) { ++ error(getPos(), "Bad size in JBIG2 bitmap segment"); ++ return; ++ } + patternDict = (JBIG2PatternDict *)seg; + bpp = 0; + i = 1; +@@ -2763,6 +2782,9 @@ JBIG2Bitmap *JBIG2Stream::readGenericBit + int code1, code2, code3; + int x, y, a0, pix, i, refI, codingI; + ++ if (w < 0 || h <= 0 || w >= INT_MAX / h) ++ return NULL; ++ + bitmap = new JBIG2Bitmap(0, w, h); + bitmap->clearToZero(); + diff --git a/print/cups/patches/patch-be b/print/cups/patches/patch-be index 70727aa81b9..1002a0d85dc 100644 --- a/print/cups/patches/patch-be +++ b/print/cups/patches/patch-be @@ -1,31 +1,34 @@ -$NetBSD: patch-be,v 1.1 2005/12/17 04:22:55 jlam Exp $ +$NetBSD: patch-be,v 1.1.2.1 2006/02/16 00:25:30 salo Exp $ --- pdftops/Stream.cxx.orig 2004-02-02 17:41:09.000000000 -0500 +++ pdftops/Stream.cxx -@@ -404,18 +404,34 @@ void ImageStream::skipLine() { - - StreamPredictor::StreamPredictor(Stream *strA, int predictorA, - int widthA, int nCompsA, int nBitsA) { -+ int totalBits; -+ - str = strA; - predictor = predictorA; +@@ -15,6 +15,7 @@ + #include <stdio.h> + #include <stdlib.h> + #include <stddef.h> ++#include <limits.h> + #ifndef WIN32 + #include <unistd.h> + #endif +@@ -409,13 +410,30 @@ StreamPredictor::StreamPredictor(Stream width = widthA; nComps = nCompsA; nBits = nBitsA; + predLine = NULL; + ok = gFalse; ++ ++ if (width <= 0 || nComps <= 0 || nBits <= 0 || ++ nComps >= INT_MAX / nBits || ++ width >= INT_MAX / nComps / nBits) { ++ return; ++ } nVals = width * nComps; -+ totalBits = nVals * nBits; -+ if (totalBits == 0 || -+ (totalBits / nBits) / nComps != width || -+ totalBits + 7 < 0) { ++ if (nVals * nBits + 7 <= 0) { + return; + } pixBytes = (nComps * nBits + 7) >> 3; -- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; -+ rowBytes = ((totalBits + 7) >> 3) + pixBytes; + rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; + if (rowBytes < 0) { + return; + } @@ -38,7 +41,7 @@ $NetBSD: patch-be,v 1.1 2005/12/17 04:22:55 jlam Exp $ } StreamPredictor::~StreamPredictor() { -@@ -991,6 +1007,10 @@ LZWStream::LZWStream(Stream *strA, int p +@@ -991,6 +1009,10 @@ LZWStream::LZWStream(Stream *strA, int p FilterStream(strA) { if (predictor != 1) { pred = new StreamPredictor(this, predictor, columns, colors, bits); @@ -49,7 +52,17 @@ $NetBSD: patch-be,v 1.1 2005/12/17 04:22:55 jlam Exp $ } else { pred = NULL; } -@@ -2891,6 +2911,10 @@ GBool DCTStream::readBaselineSOF() { +@@ -1239,6 +1261,9 @@ CCITTFaxStream::CCITTFaxStream(Stream *s + endOfLine = endOfLineA; + byteAlign = byteAlignA; + columns = columnsA; ++ if (columns + 3 < 1 || columns + 4 < 1 || columns < 1) { ++ columns = 1; ++ } + rows = rowsA; + endOfBlock = endOfBlockA; + black = blackA; +@@ -2891,6 +2916,10 @@ GBool DCTStream::readBaselineSOF() { height = read16(); width = read16(); numComps = str->getChar(); @@ -60,7 +73,7 @@ $NetBSD: patch-be,v 1.1 2005/12/17 04:22:55 jlam Exp $ if (prec != 8) { error(getPos(), "Bad DCT precision %d", prec); return gFalse; -@@ -2917,6 +2941,10 @@ GBool DCTStream::readProgressiveSOF() { +@@ -2917,6 +2946,10 @@ GBool DCTStream::readProgressiveSOF() { height = read16(); width = read16(); numComps = str->getChar(); @@ -71,7 +84,33 @@ $NetBSD: patch-be,v 1.1 2005/12/17 04:22:55 jlam Exp $ if (prec != 8) { error(getPos(), "Bad DCT precision %d", prec); return gFalse; -@@ -3249,6 +3277,10 @@ FlateStream::FlateStream(Stream *strA, i +@@ -2939,6 +2972,10 @@ GBool DCTStream::readScanInfo() { + + length = read16() - 2; + scanInfo.numComps = str->getChar(); ++ if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream"); ++ return gFalse; ++ } + --length; + if (length != 2 * scanInfo.numComps + 3) { + error(getPos(), "Bad DCT scan info block"); +@@ -3013,12 +3050,12 @@ GBool DCTStream::readHuffmanTables() { + while (length > 0) { + index = str->getChar(); + --length; +- if ((index & 0x0f) >= 4) { ++ if ((index & 0x0f) >= 4 || (index & ~0x10) < 0) { + error(getPos(), "Bad DCT Huffman table"); + return gFalse; + } + if (index & 0x10) { +- index &= 0x0f; ++ index &= 0x03; + if (index >= numACHuffTables) + numACHuffTables = index+1; + tbl = &acHuffTables[index]; +@@ -3249,6 +3286,10 @@ FlateStream::FlateStream(Stream *strA, i FilterStream(strA) { if (predictor != 1) { pred = new StreamPredictor(this, predictor, columns, colors, bits); |