diff options
-rw-r--r-- | print/xpdf/patches/patch-ao | 30 | ||||
-rw-r--r-- | print/xpdf/patches/patch-ar | 32 | ||||
-rw-r--r-- | print/xpdf/patches/patch-au | 38 | ||||
-rw-r--r-- | print/xpdf/patches/patch-av | 52 | ||||
-rw-r--r-- | print/xpdf/patches/patch-aw | 13 |
5 files changed, 0 insertions, 165 deletions
diff --git a/print/xpdf/patches/patch-ao b/print/xpdf/patches/patch-ao deleted file mode 100644 index 7db03857de9..00000000000 --- a/print/xpdf/patches/patch-ao +++ /dev/null @@ -1,30 +0,0 @@ -$NetBSD: patch-ao,v 1.4 2006/03/29 17:20:09 joerg Exp $ - ---- xpdf/JBIG2Stream.cc.orig 2005-08-17 06:34:31.000000000 +0100 -+++ xpdf/JBIG2Stream.cc 2006-01-22 22:48:31.000000000 +0000 -@@ -2305,6 +2318,15 @@ - error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment"); - return; - } -+ if (gridH == 0 || gridW >= INT_MAX / gridH) { -+ error(getPos(), "Bad size in JBIG2 halftone segment"); -+ return; -+ } -+ if (w == 0 || h >= INT_MAX / w) { -+ error(getPos(), "Bad size in JBIG2 bitmap segment"); -+ return; -+ } -+ - patternDict = (JBIG2PatternDict *)seg; - bpp = 0; - i = 1; -@@ -2936,6 +2958,9 @@ - JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2; - int x, y, pix; - -+ if (w < 0 || h <= 0 || w >= INT_MAX / h) -+ return NULL; -+ - bitmap = new JBIG2Bitmap(0, w, h); - bitmap->clearToZero(); - diff --git a/print/xpdf/patches/patch-ar b/print/xpdf/patches/patch-ar deleted file mode 100644 index 0f1fcca2a8d..00000000000 --- a/print/xpdf/patches/patch-ar +++ /dev/null @@ -1,32 +0,0 @@ -$NetBSD: patch-ar,v 1.2 2005/09/07 15:19:08 adam Exp $ - ---- fofi/FoFiTrueType.cc.orig 2005-08-17 05:34:30.000000000 +0000 -+++ fofi/FoFiTrueType.cc -@@ -1652,6 +1652,27 @@ void FoFiTrueType::parse() { - return; - } - -+ // make sure the loca table is sane (correct length and entries are -+ // in bounds) -+ i = seekTable("loca"); -+ if (tables[i].len < (nGlyphs + 1) * (locaFmt ? 4 : 2)) { -+ parsedOk = gFalse; -+ return; -+ } -+ for (j = 0; j <= nGlyphs; ++j) { -+ if (locaFmt) { -+ pos = (int)getU32BE(tables[i].offset + j*4, &parsedOk); -+ } else { -+ pos = getU16BE(tables[i].offset + j*2, &parsedOk); -+ } -+ if (pos < 0 || pos > len) { -+ parsedOk = gFalse; -+ } -+ } -+ if (!parsedOk) { -+ return; -+ } -+ - // read the post table - readPostTable(); - } diff --git a/print/xpdf/patches/patch-au b/print/xpdf/patches/patch-au deleted file mode 100644 index 9d3c33e4a0e..00000000000 --- a/print/xpdf/patches/patch-au +++ /dev/null @@ -1,38 +0,0 @@ -$NetBSD: patch-au,v 1.1 2005/12/20 16:00:16 ghen Exp $ - ---- xpdf/XPDFCore.cc.orig 2005-12-20 13:30:48.000000000 +0100 -+++ xpdf/XPDFCore.cc -@@ -975,6 +975,9 @@ void XPDFCore::resizeCbk(Widget widget, - XPDFCore *core = (XPDFCore *)ptr; - XEvent event; - Widget top; -+ Window rootWin; -+ int x1, y1; -+ Guint w1, h1, bw1, depth1; - Arg args[2]; - int n; - Dimension w, h; -@@ -982,15 +985,20 @@ void XPDFCore::resizeCbk(Widget widget, - - // find the top-most widget which has an associated window, and look - // for a pending ConfigureNotify in the event queue -- if there is -- // one, that means we're still resizing, and we want to skip the -- // current event -+ // one, and it specifies a different width or height, that means -+ // we're still resizing, and we want to skip the current event - for (top = core->parentWidget; - XtParent(top) && XtWindow(XtParent(top)); - top = XtParent(top)) ; - if (XCheckTypedWindowEvent(core->display, XtWindow(top), - ConfigureNotify, &event)) { - XPutBackEvent(core->display, &event); -- return; -+ XGetGeometry(core->display, event.xconfigure.window, -+ &rootWin, &x1, &y1, &w1, &h1, &bw1, &depth1); -+ if ((Guint)event.xconfigure.width != w1 || -+ (Guint)event.xconfigure.height != h1) { -+ return; -+ } - } - - n = 0; diff --git a/print/xpdf/patches/patch-av b/print/xpdf/patches/patch-av deleted file mode 100644 index fab9953b315..00000000000 --- a/print/xpdf/patches/patch-av +++ /dev/null @@ -1,52 +0,0 @@ -$NetBSD: patch-av,v 1.1 2007/01/17 17:38:05 drochner Exp $ - ---- xpdf/Catalog.cc.orig 2005-08-17 07:34:31.000000000 +0200 -+++ xpdf/Catalog.cc -@@ -23,6 +23,12 @@ - #include "Link.h" - #include "Catalog.h" - -+// This define is used to limit the depth of recursive readPageTree calls -+// This is needed because the page tree nodes can reference their parents -+// leaving us in an infinite loop -+// Most sane pdf documents don't have a call depth higher than 10 -+#define MAX_CALL_DEPTH 1000 -+ - //------------------------------------------------------------------------ - // Catalog - //------------------------------------------------------------------------ -@@ -71,7 +77,7 @@ Catalog::Catalog(XRef *xrefA) { - pageRefs[i].num = -1; - pageRefs[i].gen = -1; - } -- numPages = readPageTree(pagesDict.getDict(), NULL, 0); -+ numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0); - if (numPages != numPages0) { - error(-1, "Page count in top-level pages object is incorrect"); - } -@@ -169,7 +175,7 @@ GString *Catalog::readMetadata() { - return s; - } - --int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) { -+int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) { - Object kids; - Object kid; - Object kidRef; -@@ -214,9 +220,13 @@ int Catalog::readPageTree(Dict *pagesDic - // This should really be isDict("Pages"), but I've seen at least one - // PDF file where the /Type entry is missing. - } else if (kid.isDict()) { -- if ((start = readPageTree(kid.getDict(), attrs1, start)) -- < 0) -- goto err2; -+ if (callDepth > MAX_CALL_DEPTH) { -+ error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH); -+ } else { -+ if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1)) -+ < 0) -+ goto err2; -+ } - } else { - error(-1, "Kid object (page %d) is wrong type (%s)", - start+1, kid.getTypeName()); diff --git a/print/xpdf/patches/patch-aw b/print/xpdf/patches/patch-aw deleted file mode 100644 index 4e7a2ea0deb..00000000000 --- a/print/xpdf/patches/patch-aw +++ /dev/null @@ -1,13 +0,0 @@ -$NetBSD: patch-aw,v 1.1 2007/01/17 17:38:05 drochner Exp $ - ---- xpdf/Catalog.h.orig 2005-08-17 07:34:31.000000000 +0200 -+++ xpdf/Catalog.h -@@ -85,7 +85,7 @@ private: - Object acroForm; // AcroForm dictionary - GBool ok; // true if catalog is valid - -- int readPageTree(Dict *pages, PageAttrs *attrs, int start); -+ int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth); - Object *findDestInTree(Object *tree, GString *name, Object *obj); - }; - |