diff options
| -rw-r--r-- | print/poppler/Makefile | 4 | ||||
| -rw-r--r-- | print/poppler/distinfo | 5 | ||||
| -rw-r--r-- | print/poppler/patches/patch-aa | 31 | ||||
| -rw-r--r-- | print/poppler/patches/patch-ab | 78 | ||||
| -rw-r--r-- | print/poppler/patches/patch-ac | 23 |
5 files changed, 138 insertions, 3 deletions
diff --git a/print/poppler/Makefile b/print/poppler/Makefile index 6bee848b858..3d79af9bf7e 100644 --- a/print/poppler/Makefile +++ b/print/poppler/Makefile @@ -1,8 +1,8 @@ -# $NetBSD: Makefile,v 1.4 2005/12/06 17:13:50 reed Exp $ +# $NetBSD: Makefile,v 1.5 2005/12/11 05:08:50 salo Exp $ # DISTNAME= poppler-0.4.2 -PKGREVISION= 1 +PKGREVISION= 2 CATEGORIES= print MASTER_SITES= http://poppler.freedesktop.org/ diff --git a/print/poppler/distinfo b/print/poppler/distinfo index b605dfa2c33..44a886c4476 100644 --- a/print/poppler/distinfo +++ b/print/poppler/distinfo @@ -1,5 +1,8 @@ -$NetBSD: distinfo,v 1.2 2005/10/16 12:24:06 jmmv Exp $ +$NetBSD: distinfo,v 1.3 2005/12/11 05:08:50 salo Exp $ SHA1 (poppler-0.4.2.tar.gz) = fa1dec65f0df87f9348441563593915344caf9be RMD160 (poppler-0.4.2.tar.gz) = e81a8d900c4f3ca51b09ebec8f0ca62b0165d3a3 Size (poppler-0.4.2.tar.gz) = 777935 bytes +SHA1 (patch-aa) = f6e79539b4b2c9edf5579fcca1a1a63808be2e1a +SHA1 (patch-ab) = 2199d1770eed24818924823ddc53a463ebceee9a +SHA1 (patch-ac) = 202615a7be0dc9c8f9e47c75ed878e68e0cbae36 diff --git a/print/poppler/patches/patch-aa b/print/poppler/patches/patch-aa new file mode 100644 index 00000000000..b22536acc49 --- /dev/null +++ b/print/poppler/patches/patch-aa @@ -0,0 +1,31 @@ +$NetBSD: patch-aa,v 1.3 2005/12/11 05:08:50 salo Exp $ + +Security fix for CVE-2005-3193. + +--- poppler/JPXStream.cc.orig 2005-03-03 20:46:03.000000000 +0100 ++++ poppler/JPXStream.cc 2005-12-11 05:58:51.000000000 +0100 +@@ -666,7 +666,7 @@ + int segType; + GBool haveSIZ, haveCOD, haveQCD, haveSOT; + Guint precinctSize, style; +- Guint segLen, capabilities, comp, i, j, r; ++ Guint segLen, capabilities, nTiles, comp, i, j, r; + + //----- main header + haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; +@@ -701,8 +701,13 @@ + / img.xTileSize; + img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) + / img.yTileSize; +- img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles * +- sizeof(JPXTile)); ++ nTiles = img.nXTiles * img.nYTiles; ++ // check for overflow before allocating memory ++ if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) { ++ error(getPos(), "Bad tile count in JPX SIZ marker segment"); ++ return gFalse; ++ } ++ img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile)); + for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { + img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps * + sizeof(JPXTileComp)); diff --git a/print/poppler/patches/patch-ab b/print/poppler/patches/patch-ab new file mode 100644 index 00000000000..57c4c116bba --- /dev/null +++ b/print/poppler/patches/patch-ab @@ -0,0 +1,78 @@ +$NetBSD: patch-ab,v 1.1 2005/12/11 05:08:50 salo Exp $ + +Security fix for CVE-2005-3191 and CVE-2005-3192. + +--- poppler/Stream.cc.orig 2005-04-27 22:56:18.000000000 +0200 ++++ poppler/Stream.cc 2005-12-11 05:51:36.000000000 +0100 +@@ -415,18 +415,33 @@ void ImageStream::skipLine() { + + StreamPredictor::StreamPredictor(Stream *strA, int predictorA, + int widthA, int nCompsA, int nBitsA) { ++ int totalBits; ++ + str = strA; + predictor = predictorA; + width = widthA; + nComps = nCompsA; + nBits = nBitsA; ++ predLine = NULL; ++ ok = gFalse; + + nVals = width * nComps; ++ totalBits = nVals * nBits; ++ if (totalBits == 0 || ++ (totalBits / nBits) / nComps != width || ++ totalBits + 7 < 0) { ++ return; ++ } + pixBytes = (nComps * nBits + 7) >> 3; +- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; ++ rowBytes = ((totalBits + 7) >> 3) + pixBytes; ++ if (rowBytes < 0) { ++ return; ++ } + predLine = (Guchar *)gmalloc(rowBytes); + memset(predLine, 0, rowBytes); + predIdx = rowBytes; ++ ++ ok = gTrue; + } + + StreamPredictor::~StreamPredictor() { +@@ -1020,6 +1035,10 @@ LZWStream::LZWStream(Stream *strA, int p + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +@@ -2907,6 +2926,14 @@ GBool DCTStream::readBaselineSOF() { + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +@@ -3268,6 +3295,10 @@ FlateStream::FlateStream(Stream *strA, i + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } diff --git a/print/poppler/patches/patch-ac b/print/poppler/patches/patch-ac new file mode 100644 index 00000000000..e09dba96cfa --- /dev/null +++ b/print/poppler/patches/patch-ac @@ -0,0 +1,23 @@ +$NetBSD: patch-ac,v 1.1 2005/12/11 05:08:50 salo Exp $ + +Security fix for CVE-2005-3192. + +--- poppler/Stream.h.orig 2005-04-27 22:56:18.000000000 +0200 ++++ poppler/Stream.h 2005-12-11 05:51:36.000000000 +0100 +@@ -231,6 +231,8 @@ public: + + ~StreamPredictor(); + ++ GBool isOk() { return ok; } ++ + int lookChar(); + int getChar(); + +@@ -248,6 +250,7 @@ private: + int rowBytes; // bytes per line + Guchar *predLine; // line buffer + int predIdx; // current index in predLine ++ GBool ok; + }; + + //------------------------------------------------------------------------ |