rpm/mupdf
SHA256
1
0
Fork 0
forked from pool/mupdf
Code Pull Requests Activity

Accepting request 222656 from Publishing

Browse Source 
- add mupdf-fix-array-overflow.patch in order to fix a stack-based
  buffer overflow in xps_parse_color() (bnc#863975) (forwarded request 222307 from gberh)

OBS-URL: https://build.opensuse.org/request/show/222656
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mupdf?expand=0&rev=8
This commit is contained in:
Stephan Kulow 2014-02-18 13:45:20 +00:00 committed by Git OBS Bridge
commit 2599df0136
3 changed files with 135 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

126
mupdf-fix-array-overflow.patch Normal file
View File

@ -0,0 +1,126 @@
From: Simon Bünzli <zeniko@gmail.com>
Date: Thu, 16 Jan 2014 21:04:51 +0000 (+0100)
Subject: Bug 694957: fix stack buffer overflow in xps_parse_color
X-Git-Url: http://git.ghostscript.com/?p=mupdf.git;a=commitdiff_plain;h=60dabde18d7fe12b19da8b509bdfee9cc886aafc
Bug 694957: fix stack buffer overflow in xps_parse_color
xps_parse_color happily reads more than FZ_MAX_COLORS values out of a
ContextColor array which overflows the passed in samples array.
Limiting the number of allowed samples to FZ_MAX_COLORS and make sure
to use that constant for all callers fixes the problem.
Thanks to Jean-Jamil Khalifé for reporting and investigating the issue
and providing a sample exploit file.
---
diff --git a/source/xps/xps-common.c b/source/xps/xps-common.c
index b780f42..32a30ba 100644
--- a/source/xps/xps-common.c
+++ b/source/xps/xps-common.c
@@ -89,7 +89,7 @@ xps_begin_opacity(xps_document *doc, const fz_matrix *ctm, const fz_rect *area,
if (scb_color_att)
{
fz_colorspace *colorspace;
- float samples[32];
+ float samples[FZ_MAX_COLORS];
xps_parse_color(doc, base_uri, scb_color_att, &colorspace, samples);
opacity = opacity * samples[0];
}
@@ -208,12 +208,13 @@ void
xps_parse_color(xps_document *doc, char *base_uri, char *string,
fz_colorspace **csp, float *samples)
{
+ fz_context *ctx = doc->ctx;
char *p;
int i, n;
char buf[1024];
char *profile;
- *csp = fz_device_rgb(doc->ctx);
+ *csp = fz_device_rgb(ctx);
samples[0] = 1;
samples[1] = 0;
@@ -259,7 +260,7 @@ xps_parse_color(xps_document *doc, char *base_uri, char *string,
profile = strchr(buf, ' ');
if (!profile)
{
- fz_warn(doc->ctx, "cannot find icc profile uri in '%s'", string);
+ fz_warn(ctx, "cannot find icc profile uri in '%s'", string);
return;
}
@@ -267,12 +268,17 @@ xps_parse_color(xps_document *doc, char *base_uri, char *string,
p = strchr(profile, ' ');
if (!p)
{
- fz_warn(doc->ctx, "cannot find component values in '%s'", profile);
+ fz_warn(ctx, "cannot find component values in '%s'", profile);
return;
}
*p++ = 0;
n = count_commas(p) + 1;
+ if (n > FZ_MAX_COLORS)
+ {
+ fz_warn(ctx, "ignoring %d color components (max %d allowed)", n - FZ_MAX_COLORS, FZ_MAX_COLORS);
+ n = FZ_MAX_COLORS;
+ }
i = 0;
while (i < n)
{
@@ -292,10 +298,10 @@ xps_parse_color(xps_document *doc, char *base_uri, char *string,
/* TODO: load ICC profile */
switch (n)
{
- case 2: *csp = fz_device_gray(doc->ctx); break;
- case 4: *csp = fz_device_rgb(doc->ctx); break;
- case 5: *csp = fz_device_cmyk(doc->ctx); break;
- default: *csp = fz_device_gray(doc->ctx); break;
+ case 2: *csp = fz_device_gray(ctx); break;
+ case 4: *csp = fz_device_rgb(ctx); break;
+ case 5: *csp = fz_device_cmyk(ctx); break;
+ default: *csp = fz_device_gray(ctx); break;
}
}
}
diff --git a/source/xps/xps-glyphs.c b/source/xps/xps-glyphs.c
index b26e18d..e621257 100644
--- a/source/xps/xps-glyphs.c
+++ b/source/xps/xps-glyphs.c
@@ -590,7 +590,7 @@ xps_parse_glyphs(xps_document *doc, const fz_matrix *ctm,
if (fill_att)
{
- float samples[32];
+ float samples[FZ_MAX_COLORS];
fz_colorspace *colorspace;
xps_parse_color(doc, base_uri, fill_att, &colorspace, samples);
diff --git a/source/xps/xps-gradient.c b/source/xps/xps-gradient.c
index 7d03f89..76188e9 100644
--- a/source/xps/xps-gradient.c
+++ b/source/xps/xps-gradient.c
@@ -39,7 +39,7 @@ xps_parse_gradient_stops(xps_document *doc, char *base_uri, fz_xml *node,
struct stop *stops, int maxcount)
{
fz_colorspace *colorspace;
- float sample[8];
+ float sample[FZ_MAX_COLORS];
float rgb[3];
int before, after;
int count;
diff --git a/source/xps/xps-path.c b/source/xps/xps-path.c
index b97ee17..ea84a81 100644
--- a/source/xps/xps-path.c
+++ b/source/xps/xps-path.c
@@ -826,7 +826,7 @@ xps_parse_path(xps_document *doc, const fz_matrix *ctm, char *base_uri, xps_reso
fz_stroke_state *stroke = NULL;
fz_matrix transform;
- float samples[32];
+ float samples[FZ_MAX_COLORS];
fz_colorspace *colorspace;
fz_path *path = NULL;
fz_path *stroke_path = NULL;

6
mupdf.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Fri Feb 14 10:04:23 UTC 2014 - gber@opensuse.org
- add mupdf-fix-array-overflow.patch in order to fix a stack-based
buffer overflow in xps_parse_color() (bnc#863975)
-------------------------------------------------------------------
Sat Jan 4 20:08:44 UTC 2014 - gber@opensuse.org

3
mupdf.spec
View File

@ -29,6 +29,8 @@ Source1: mupdf.desktop
Source2: mupdf.png
# PATCH-FIX-OPENSUSE mupdf-fix-openjpeg2.patch gber@opensuse.org -- Fix cflags, libs of openjpeg2 on openSUSE
Patch0: mupdf-fix-openjpeg2.patch
# PATCH-FIX-UPSTREAM mupdf-fix-array-overflow.patch http://bugs.ghostscript.com/show_bug.cgi?id=694957 bnc#863975 gber@opensuse.org -- Fix stack-based buffer overflow in xps_parse_color()
Patch1: mupdf-fix-array-overflow.patch
BuildRequires: freetype-devel
BuildRequires: gcc-c++
BuildRequires: jbig2dec-devel
@ -73,6 +75,7 @@ based on mupdf.
rm -rf thirdparty
%patch0 -p1
%patch1 -p1
mkdir docs/examples
for src in docs/*.c; do