SHA256
1
0
forked from pool/mupdf
mupdf/mupdf-CVE-2018-16647.patch
Martin Pluskal aa442929d8 Accepting request 684259 from home:guoyunhe:branches:Publishing
- Add build dependencies:
  * liblcms2-devel
  * Mesa-libGL-devel
  * freeglut-devel
  * pkgconfig(openssl)
  * pkgconfig(xi)
  * pkgconfig(xrandr)
- Change COPYING to %licnese instead of %doc
- Update mupdf-no-strip.patch
- Add patches from Fedora project:
  * mupdf-CVE-2018-16647.patch
  * mupdf-CVE-2018-16648.patch
  * mupdf-CVE-2018-18662.patch
  * 0001-Fix-699840-Use-saved-sig_widget-pointer-to-sign-sign.patch
  * 0001-Write-placeholder-appearance-streams-for-digital-sig.patch
  * 0001-fix-build-on-big-endian.patch
- Update to version 1.14:
  * New features:
    * Added "Source Han Serif" CJK fallback font.
    * Added more scripts to the Noto fallback fonts.
    * Multi-page PNM support.
    * "mutool show" now supports a path syntax for selecting objects to show.
  * Build system simplifications:
    * Auto-generated CMap, ICC, and JS source files are checked in to git.
    * Embedded CMap resources are now generated by a python script.
    * Embedded font resources are linked directly if using GNU ld or windows.
    * Namegen tool replaced by use of C macros.
    * Simplified Makefile.
  * Annotation editing:
    * New annotation editing mode in mupdf-gl.
    * Can create, edit, and delete most annotation types.
    * Can create appearance streams for most annotation types.
    * Can create appearance streams for Tx form fields.
    * Can create appearance streams for Ch form fields.
  * Form filling in mupdf-gl:
    * Can click buttons, checkboxes, and radioboxes.
    * Can fill out text fields using dialog box.
    * Can select choice options using dialog box.
    * Can verify and sign digital signatures.
  * Improved UI for mupdf-gl:
    * Password dialog.
    * Error dialog.
    * Open/save file dialog.
    * Snap selection to words or lines by holding control or control+shift.
    * Save and restore current location, bookmarks, and navigation history.
  * Bug fixes:
    * Improved CJK character fallback handling in EPUB.
  * API changes:
    * Pass rectangle and matrix structs by value.
    * Replaced PDF_NAME_Xxx macros with PDF_NAME(Xxx).
    * Added PDF_TRUE, PDF_FALSE, and PDF_NULL constant pdf_obj* macros.
    * Added helper functions: pdf_dict_get_int, etc.
    * Removed 'doc' argument in pdf_new_int, etc.
    * Quads instead of rects when highlighting and searching text.
    * mutool run: Pass arguments to script in scriptArgs global.

OBS-URL: https://build.opensuse.org/request/show/684259
OBS-URL: https://build.opensuse.org/package/show/Publishing/mupdf?expand=0&rev=81
2019-03-12 13:41:52 +00:00

78 lines
2.4 KiB
Diff

From 351c99d8ce23bbf7099dbd52771a095f67e45a2c Mon Sep 17 00:00:00 2001
Message-Id: <351c99d8ce23bbf7099dbd52771a095f67e45a2c.1542272011.git.mjg@fedoraproject.org>
From: Sebastian Rasmussen <sebras@gmail.com>
Date: Mon, 1 Oct 2018 15:13:13 +0800
Subject: [PATCH] Avoid being smart about keeping only a single reference to
the buffer.
When pdf_dev_pop() is called it will drop the reference to the buffer.
pdf_dev_push_new_buf() will either create a new buffer reference or take a reference to the existing buffer.
When pdf_dev_pop() is called unbalance this creates a problem as the
top level buffer will be unreferenced too many times.
fails-32.pdf
---
source/pdf/pdf-device.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/source/pdf/pdf-device.c b/source/pdf/pdf-device.c
index 31a7a10f..0103e9a7 100644
--- a/source/pdf/pdf-device.c
+++ b/source/pdf/pdf-device.c
@@ -66,7 +66,6 @@ struct pdf_device_s
pdf_document *doc;
pdf_obj *resources;
- fz_buffer *buffer;
int in_text;
@@ -1061,7 +1060,10 @@ pdf_dev_drop_device(fz_context *ctx, fz_device *dev)
int i;
for (i = pdev->num_gstates-1; i >= 0; i--)
+ {
+ fz_drop_buffer(ctx, pdev->gstates[i].buf);
fz_drop_stroke_state(ctx, pdev->gstates[i].stroke_state);
+ }
for (i = pdev->num_cid_fonts-1; i >= 0; i--)
fz_drop_font(ctx, pdev->cid_fonts[i]);
@@ -1069,7 +1071,6 @@ pdf_dev_drop_device(fz_context *ctx, fz_device *dev)
for (i = pdev->num_groups - 1; i >= 0; i--)
pdf_drop_obj(ctx, pdev->groups[i].ref);
- fz_drop_buffer(ctx, pdev->buffer);
pdf_drop_obj(ctx, pdev->resources);
fz_free(ctx, pdev->cid_fonts);
fz_free(ctx, pdev->image_indices);
@@ -1111,10 +1112,13 @@ fz_device *pdf_new_pdf_device(fz_context *ctx, pdf_document *doc, fz_matrix topc
dev->super.begin_tile = pdf_dev_begin_tile;
dev->super.end_tile = pdf_dev_end_tile;
+ fz_var(buf);
+
fz_try(ctx)
{
- dev->buffer = fz_keep_buffer(ctx, buf);
- if (!buf)
+ if (buf)
+ buf = fz_keep_buffer(ctx, buf);
+ else
buf = fz_new_buffer(ctx, 256);
dev->doc = doc;
dev->resources = pdf_keep_obj(ctx, resources);
@@ -1136,8 +1140,7 @@ fz_device *pdf_new_pdf_device(fz_context *ctx, pdf_document *doc, fz_matrix topc
}
fz_catch(ctx)
{
- if (dev->gstates && dev->buffer == NULL)
- fz_drop_buffer(ctx, dev->gstates[0].buf);
+ fz_drop_buffer(ctx, buf);
fz_free(ctx, dev);
fz_rethrow(ctx);
}
--
2.19.1.1238.g4b45f61cc0