diff options
Diffstat (limited to 'devel/libextractor/patches/patch-ad')
-rw-r--r-- | devel/libextractor/patches/patch-ad | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/devel/libextractor/patches/patch-ad b/devel/libextractor/patches/patch-ad new file mode 100644 index 00000000000..a193a1f953f --- /dev/null +++ b/devel/libextractor/patches/patch-ad @@ -0,0 +1,77 @@ +$NetBSD: patch-ad,v 1.2.4.1 2005/12/16 17:15:56 seb Exp $ + +Security fix for CVE-2005-3191 and CVE-2005-3192. +From libextractor 0.5.8. + +--- src/plugins/pdf/Stream.cc.orig 2005-04-24 04:59:57.000000000 +0200 ++++ src/plugins/pdf/Stream.cc 2005-12-15 13:49:30.000000000 +0100 +@@ -410,18 +410,32 @@ void ImageStream::skipLine() { + + StreamPredictor::StreamPredictor(Stream *strA, int predictorA, + int widthA, int nCompsA, int nBitsA) { ++ int totalBits; ++ + str = strA; + predictor = predictorA; + width = widthA; + nComps = nCompsA; + nBits = nBitsA; ++ predLine = NULL; ++ ok = gFalse; + + nVals = width * nComps; ++ totalBits = nVals * nBits; ++ if (totalBits == 0 || ++ (totalBits / nBits) / nComps != width || ++ totalBits + 7 < 0) { ++ return; ++ } + pixBytes = (nComps * nBits + 7) >> 3; +- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; ++ rowBytes = ((totalBits + 7) >> 3) + pixBytes; ++ if (rowBytes < 0) { ++ return; ++ } + predLine = (Guchar *)gmalloc(rowBytes); + memset(predLine, 0, rowBytes); + predIdx = rowBytes; ++ ok = gTrue; + } + + StreamPredictor::~StreamPredictor() { +@@ -1015,6 +1029,10 @@ LZWStream::LZWStream(Stream *strA, int p + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (! pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +@@ -2900,6 +2918,13 @@ GBool DCTStream::readBaselineSOF() { + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ return gFalse; ++ } ++ if (numComps <= 0 || numComps > 4) { ++ return gFalse; ++ } ++ + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +@@ -3258,6 +3283,10 @@ FlateStream::FlateStream(Stream *strA, i + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (! pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } |