Accepting request 973947 from Publishing

OBS-URL: https://build.opensuse.org/request/show/973947
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/htmldoc?expand=0&rev=30

htmldoc-CVE-2022-28085.patch

@@ -0,0 +1,13 @@
+Index: htmldoc-1.9.15/htmldoc/ps-pdf.cxx
+===================================================================
+--- htmldoc-1.9.15.orig/htmldoc/ps-pdf.cxx
++++ htmldoc-1.9.15/htmldoc/ps-pdf.cxx
+@@ -3583,6 +3583,8 @@ pdf_write_names(FILE *out)		/* I - Outpu
+     pdf_start_object(out);
+     float x, y;
+ 
++    check_pages(link->page);
++
+     x = 0.0f;
+     y = link->top + pages[link->page].bottom;
+     pspdf_transform_coords(pages + link->page, x, y);

htmldoc.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Fri Apr 29 06:02:30 UTC 2022 - pgajdos@suse.com
+
+- security update
+- added patches
+  fix CVE-2022-28085 [bsc#1198933], Heap buffer overflow in function pdf_write_names in ps-pdf.cxx
+  + htmldoc-CVE-2022-28085.patch
+
 -------------------------------------------------------------------
 Thu Feb 10 11:49:32 UTC 2022 - pgajdos@suse.com
 

htmldoc.spec

@@ -24,6 +24,8 @@ License:        LGPL-2.1-or-later
 Group:          Productivity/Publishing/HTML/Tools
 URL:            https://michaelrsweet.github.io/htmldoc/index.html
 Source:         https://github.com/michaelrsweet/htmldoc/releases/download/v%{version}/htmldoc-%{version}-source.tar.gz
+# CVE-2022-28085 [bsc#1198933], Heap buffer overflow in function pdf_write_names in ps-pdf.cxx
+Patch0:         htmldoc-CVE-2022-28085.patch
 BuildRequires:  fltk-devel
 BuildRequires:  gcc-c++
 BuildRequires:  hicolor-icon-theme
@@ -40,7 +42,7 @@ HTMLDOC converts HTML source files into indexed HTML, PostScript, or
 Portable Document Format (PDF) files that can be viewed online or printed.
 
 %prep
-%autosetup
+%autosetup -p1
 
 %build
 %configure \