Sync from SUSE:SLFO:Main poppler revision d648c128b0fa15dfae184065aec25a65

poppler-CVE-2024-6239.patch

@@ -0,0 +1,109 @@
+From 0554731052d1a97745cb179ab0d45620589dd9c4 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Fri, 7 Jun 2024 00:54:55 +0200
+Subject: [PATCH] pdfinfo: Fix crash in broken documents when using -dests
+
+---
+ utils/pdfinfo.cc | 35 +++++++++++++++--------------------
+ 1 file changed, 15 insertions(+), 20 deletions(-)
+
+diff --git a/utils/pdfinfo.cc b/utils/pdfinfo.cc
+index 5d37ef64f..7d569749b 100644
+--- a/utils/pdfinfo.cc
++++ b/utils/pdfinfo.cc
+@@ -15,7 +15,7 @@
+ // under GPL version 2 or later
+ //
+ // Copyright (C) 2006 Dom Lachowicz <cinamod@hotmail.com>
+-// Copyright (C) 2007-2010, 2012, 2016-2022 Albert Astals Cid <aacid@kde.org>
++// Copyright (C) 2007-2010, 2012, 2016-2022, 2024 Albert Astals Cid <aacid@kde.org>
+ // Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
+ // Copyright (C) 2011 Vittal Aithal <vittal.aithal@cognidox.com>
+ // Copyright (C) 2012, 2013, 2016-2018, 2021 Adrian Johnson <ajohnson@redneon.com>
+@@ -113,16 +113,21 @@ static const ArgDesc argDesc[] = { { "-f", argInt, &firstPage, 0, "first page to
+                                    { "-?", argFlag, &printHelp, 0, "print usage information" },
+                                    {} };
+ 
+-static void printTextString(const GooString *s, const UnicodeMap *uMap)
++static void printStdTextString(const std::string &s, const UnicodeMap *uMap)
+ {
+     char buf[8];
+-    std::vector<Unicode> u = TextStringToUCS4(s->toStr());
++    const std::vector<Unicode> u = TextStringToUCS4(s);
+     for (const auto &c : u) {
+         int n = uMap->mapUnicode(c, buf, sizeof(buf));
+         fwrite(buf, 1, n, stdout);
+     }
+ }
+ 
++static void printTextString(const GooString *s, const UnicodeMap *uMap)
++{
++    printStdTextString(s->toStr(), uMap);
++}
++
+ static void printUCS4String(const Unicode *u, int len, const UnicodeMap *uMap)
+ {
+     char buf[8];
+@@ -294,11 +299,6 @@ static void printStruct(const StructElement *element, unsigned indent)
+     }
+ }
+ 
+-struct GooStringCompare
+-{
+-    bool operator()(GooString *lhs, GooString *rhs) const { return lhs->cmp(const_cast<GooString *>(rhs)) < 0; }
+-};
+-
+ static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
+ {
+     GooString s;
+@@ -369,29 +369,25 @@ static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
+ 
+ static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
+ {
+-    std::map<Ref, std::map<GooString *, std::unique_ptr<LinkDest>, GooStringCompare>> map;
++    std::map<Ref, std::map<std::string, std::unique_ptr<LinkDest>>> map;
+ 
+     int numDests = doc->getCatalog()->numDestNameTree();
+     for (int i = 0; i < numDests; i++) {
+-        GooString *name = new GooString(doc->getCatalog()->getDestNameTreeName(i));
++        const GooString *name = doc->getCatalog()->getDestNameTreeName(i);
+         std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestNameTreeDest(i);
+-        if (dest && dest->isPageRef()) {
++        if (name && dest && dest->isPageRef()) {
+             Ref pageRef = dest->getPageRef();
+-            map[pageRef].insert(std::make_pair(name, std::move(dest)));
+-        } else {
+-            delete name;
++            map[pageRef].insert(std::make_pair(name->toStr(), std::move(dest)));
+         }
+     }
+ 
+     numDests = doc->getCatalog()->numDests();
+     for (int i = 0; i < numDests; i++) {
+-        GooString *name = new GooString(doc->getCatalog()->getDestsName(i));
++        const char *name = doc->getCatalog()->getDestsName(i);
+         std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestsDest(i);
+-        if (dest && dest->isPageRef()) {
++        if (name && dest && dest->isPageRef()) {
+             Ref pageRef = dest->getPageRef();
+             map[pageRef].insert(std::make_pair(name, std::move(dest)));
+-        } else {
+-            delete name;
+         }
+     }
+ 
+@@ -405,9 +401,8 @@ static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
+                     printf("%4d ", i);
+                     printLinkDest(it.second);
+                     printf(" \"");
+-                    printTextString(it.first, uMap);
++                    printStdTextString(it.first, uMap);
+                     printf("\"\n");
+-                    delete it.first;
+                 }
+             }
+         }
+-- 
+GitLab
+
+

poppler.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Thu Jul  4 07:39:57 UTC 2024 - pgajdos@suse.com
+
+- security update
+- added patches
+  fix CVE-2024-6239 [bsc#1226916], crash when using pdfinfo with -dests parameter on malformed input files
+  + poppler-CVE-2024-6239.patch
+
 -------------------------------------------------------------------
 Wed Feb 14 15:41:55 UTC 2024 - pgajdos@suse.com
 

poppler.spec

@@ -44,6 +44,8 @@ Source90:       poppler.keyring
 Source99:       baselibs.conf
 Patch0:         reduce-boost-required-version.patch
 Patch1:         reduce-libtiff-required-version.patch
+# CVE-2024-6239 [bsc#1226916], crash when using pdfinfo with -dests parameter on malformed input files
+Patch2:         poppler-CVE-2024-6239.patch
 BuildRequires:  cmake >= 3.10
 BuildRequires:  gtk-doc
 BuildRequires:  libboost_headers-devel >= 1.66
@@ -217,6 +219,7 @@ developed by Derek Noonburg of Glyph and Cog, LLC.
 %setup -q -n poppler-%{version}
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %build
 %if "%{flavor}" == "qt5"