Dr. Werner Fink
24ff9d9346
* Several optimizations, tweaks, and fixes to the structured text
device text extraction.
* Improve table-hunting code in structured text device.
* Import image-rafting code from layout project to the structured
text device.
* Fix bug causing FitR link destination rectangles to remain
untransformed.
* Fix bug causing xps rendering to enter eternal loop.
- For changes in 1.27.0 and older see
https://mupdf.com/releases/history
- CVE-2025-55780: null pointer dereference occurs in the function
break_word_for_overflow_wrap() (bsc#1250443)
Fixed by update
- CVE-2026-25556: double-free in fz_fill_pixmap_from_display_list()
(bsc#1257944)
Add cve-2026-25556.patch (upstream)
OBS-URL: https://build.opensuse.org/package/show/Publishing/mupdf?expand=0&rev=148
50 lines
1.2 KiB
Diff
50 lines
1.2 KiB
Diff
From d4743b6092d513321c23c6f7fe5cff87cde043c1 Mon Sep 17 00:00:00 2001
|
|
From: Robin Watts <Robin.Watts@artifex.com>
|
|
Date: Mon, 12 Jan 2026 19:08:56 +0000
|
|
Subject: Bug 709029: Fix incorrect error-case free of pixmap.
|
|
|
|
Don't free a pixmap we don't own!
|
|
---
|
|
source/fitz/util.c | 15 +++++++++------
|
|
1 file changed, 9 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/source/fitz/util.c b/source/fitz/util.c
|
|
index 7710124cc..90226a5c1 100644
|
|
--- a/source/fitz/util.c
|
|
+++ b/source/fitz/util.c
|
|
@@ -119,7 +119,15 @@ fz_new_pixmap_from_display_list_with_separations(fz_context *ctx, fz_display_lis
|
|
else
|
|
fz_clear_pixmap_with_value(ctx, pix, 0xFF);
|
|
|
|
- return fz_fill_pixmap_from_display_list(ctx, list, ctm, pix);
|
|
+ fz_try(ctx)
|
|
+ fz_fill_pixmap_from_display_list(ctx, list, ctm, pix);
|
|
+ fz_catch(ctx)
|
|
+ {
|
|
+ fz_drop_pixmap(ctx, pix);
|
|
+ fz_rethrow(ctx);
|
|
+ }
|
|
+
|
|
+ return pix;
|
|
}
|
|
|
|
fz_pixmap *
|
|
@@ -136,14 +144,9 @@ fz_fill_pixmap_from_display_list(fz_context *ctx, fz_display_list *list, fz_matr
|
|
fz_close_device(ctx, dev);
|
|
}
|
|
fz_always(ctx)
|
|
- {
|
|
fz_drop_device(ctx, dev);
|
|
- }
|
|
fz_catch(ctx)
|
|
- {
|
|
- fz_drop_pixmap(ctx, pix);
|
|
fz_rethrow(ctx);
|
|
- }
|
|
|
|
return pix;
|
|
}
|
|
--
|
|
cgit v1.2.3
|
|
|