SHA256
1
0
forked from pool/mupdf
mupdf/mupdf-CVE-2018-16647.patch

78 lines
2.4 KiB
Diff
Raw Normal View History

Accepting request 684259 from home:guoyunhe:branches:Publishing - Add build dependencies: * liblcms2-devel * Mesa-libGL-devel * freeglut-devel * pkgconfig(openssl) * pkgconfig(xi) * pkgconfig(xrandr) - Change COPYING to %licnese instead of %doc - Update mupdf-no-strip.patch - Add patches from Fedora project: * mupdf-CVE-2018-16647.patch * mupdf-CVE-2018-16648.patch * mupdf-CVE-2018-18662.patch * 0001-Fix-699840-Use-saved-sig_widget-pointer-to-sign-sign.patch * 0001-Write-placeholder-appearance-streams-for-digital-sig.patch * 0001-fix-build-on-big-endian.patch - Update to version 1.14: * New features: * Added "Source Han Serif" CJK fallback font. * Added more scripts to the Noto fallback fonts. * Multi-page PNM support. * "mutool show" now supports a path syntax for selecting objects to show. * Build system simplifications: * Auto-generated CMap, ICC, and JS source files are checked in to git. * Embedded CMap resources are now generated by a python script. * Embedded font resources are linked directly if using GNU ld or windows. * Namegen tool replaced by use of C macros. * Simplified Makefile. * Annotation editing: * New annotation editing mode in mupdf-gl. * Can create, edit, and delete most annotation types. * Can create appearance streams for most annotation types. * Can create appearance streams for Tx form fields. * Can create appearance streams for Ch form fields. * Form filling in mupdf-gl: * Can click buttons, checkboxes, and radioboxes. * Can fill out text fields using dialog box. * Can select choice options using dialog box. * Can verify and sign digital signatures. * Improved UI for mupdf-gl: * Password dialog. * Error dialog. * Open/save file dialog. * Snap selection to words or lines by holding control or control+shift. * Save and restore current location, bookmarks, and navigation history. * Bug fixes: * Improved CJK character fallback handling in EPUB. * API changes: * Pass rectangle and matrix structs by value. * Replaced PDF_NAME_Xxx macros with PDF_NAME(Xxx). * Added PDF_TRUE, PDF_FALSE, and PDF_NULL constant pdf_obj* macros. * Added helper functions: pdf_dict_get_int, etc. * Removed 'doc' argument in pdf_new_int, etc. * Quads instead of rects when highlighting and searching text. * mutool run: Pass arguments to script in scriptArgs global. OBS-URL: https://build.opensuse.org/request/show/684259 OBS-URL: https://build.opensuse.org/package/show/Publishing/mupdf?expand=0&rev=81
2019-03-12 14:41:52 +01:00
From 351c99d8ce23bbf7099dbd52771a095f67e45a2c Mon Sep 17 00:00:00 2001
Message-Id: <351c99d8ce23bbf7099dbd52771a095f67e45a2c.1542272011.git.mjg@fedoraproject.org>
From: Sebastian Rasmussen <sebras@gmail.com>
Date: Mon, 1 Oct 2018 15:13:13 +0800
Subject: [PATCH] Avoid being smart about keeping only a single reference to
the buffer.
When pdf_dev_pop() is called it will drop the reference to the buffer.
pdf_dev_push_new_buf() will either create a new buffer reference or take a reference to the existing buffer.
When pdf_dev_pop() is called unbalance this creates a problem as the
top level buffer will be unreferenced too many times.
fails-32.pdf
---
source/pdf/pdf-device.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/source/pdf/pdf-device.c b/source/pdf/pdf-device.c
index 31a7a10f..0103e9a7 100644
--- a/source/pdf/pdf-device.c
+++ b/source/pdf/pdf-device.c
@@ -66,7 +66,6 @@ struct pdf_device_s
pdf_document *doc;
pdf_obj *resources;
- fz_buffer *buffer;
int in_text;
@@ -1061,7 +1060,10 @@ pdf_dev_drop_device(fz_context *ctx, fz_device *dev)
int i;
for (i = pdev->num_gstates-1; i >= 0; i--)
+ {
+ fz_drop_buffer(ctx, pdev->gstates[i].buf);
fz_drop_stroke_state(ctx, pdev->gstates[i].stroke_state);
+ }
for (i = pdev->num_cid_fonts-1; i >= 0; i--)
fz_drop_font(ctx, pdev->cid_fonts[i]);
@@ -1069,7 +1071,6 @@ pdf_dev_drop_device(fz_context *ctx, fz_device *dev)
for (i = pdev->num_groups - 1; i >= 0; i--)
pdf_drop_obj(ctx, pdev->groups[i].ref);
- fz_drop_buffer(ctx, pdev->buffer);
pdf_drop_obj(ctx, pdev->resources);
fz_free(ctx, pdev->cid_fonts);
fz_free(ctx, pdev->image_indices);
@@ -1111,10 +1112,13 @@ fz_device *pdf_new_pdf_device(fz_context *ctx, pdf_document *doc, fz_matrix topc
dev->super.begin_tile = pdf_dev_begin_tile;
dev->super.end_tile = pdf_dev_end_tile;
+ fz_var(buf);
+
fz_try(ctx)
{
- dev->buffer = fz_keep_buffer(ctx, buf);
- if (!buf)
+ if (buf)
+ buf = fz_keep_buffer(ctx, buf);
+ else
buf = fz_new_buffer(ctx, 256);
dev->doc = doc;
dev->resources = pdf_keep_obj(ctx, resources);
@@ -1136,8 +1140,7 @@ fz_device *pdf_new_pdf_device(fz_context *ctx, pdf_document *doc, fz_matrix topc
}
fz_catch(ctx)
{
- if (dev->gstates && dev->buffer == NULL)
- fz_drop_buffer(ctx, dev->gstates[0].buf);
+ fz_drop_buffer(ctx, buf);
fz_free(ctx, dev);
fz_rethrow(ctx);
}
--
2.19.1.1238.g4b45f61cc0