parent
1cd3a406e9
commit
347b10e4f3
1
.gitignore
vendored
1
.gitignore
vendored
@ -23,3 +23,4 @@
|
||||
/mupdf-1.17.0-source.tar.gz
|
||||
/mupdf-1.18.0-rc1-source.tar.gz
|
||||
/mupdf-1.18.0-source.tar.gz
|
||||
/mupdf-1.19.0-source.tar.gz
|
||||
|
@ -1,49 +0,0 @@
|
||||
From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001
|
||||
Message-Id: <cee7cefc610d42fd383b3c80c12cbc675443176a.1614110865.git.mjg@fedoraproject.org>
|
||||
From: Robin Watts <Robin.Watts@artifex.com>
|
||||
Date: Fri, 22 Jan 2021 17:05:15 +0000
|
||||
Subject: [PATCH] Bug 703366: Fix double free of object during linearization.
|
||||
|
||||
This appears to happen because we parse an illegal object from
|
||||
a broken file and assign it to object 0, which is defined to
|
||||
be free.
|
||||
|
||||
Here, we fix the parsing code so this can't happen.
|
||||
---
|
||||
source/pdf/pdf-parse.c | 6 ++++++
|
||||
source/pdf/pdf-xref.c | 2 ++
|
||||
2 files changed, 8 insertions(+)
|
||||
|
||||
diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
|
||||
index 7abc8c3d4..5761c3351 100644
|
||||
--- a/source/pdf/pdf-parse.c
|
||||
+++ b/source/pdf/pdf-parse.c
|
||||
@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
|
||||
fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
|
||||
}
|
||||
gen = buf->i;
|
||||
+ if (gen < 0 || gen >= 65536)
|
||||
+ {
|
||||
+ if (try_repair)
|
||||
+ *try_repair = 1;
|
||||
+ fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
|
||||
+ }
|
||||
|
||||
tok = pdf_lex(ctx, file, buf);
|
||||
if (tok != PDF_TOK_OBJ)
|
||||
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
|
||||
index 1b2bdcd59..30197b4b8 100644
|
||||
--- a/source/pdf/pdf-xref.c
|
||||
+++ b/source/pdf/pdf-xref.c
|
||||
@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
|
||||
{
|
||||
ofs = fz_tell(ctx, doc->file);
|
||||
trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
|
||||
+ if (num == 0)
|
||||
+ fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
|
||||
}
|
||||
fz_catch(ctx)
|
||||
{
|
||||
--
|
||||
2.30.1.724.gc30ef96fb6
|
||||
|
12
mupdf.spec
12
mupdf.spec
@ -4,7 +4,7 @@
|
||||
%global jbig2dec_version 0.19
|
||||
|
||||
Name: mupdf
|
||||
Version: 1.18.0
|
||||
Version: 1.19.0
|
||||
Release: %autorelease
|
||||
Summary: A lightweight PDF viewer and toolkit
|
||||
License: AGPLv3+
|
||||
@ -24,13 +24,14 @@ Requires: jbig2dec-libs = %{jbig2dec_version}
|
||||
# We need to build against the Artifex fork of lcms2 so that we are thread safe
|
||||
# (see bug #1553915). Artifex make sure to rebase against upstream, who refuse
|
||||
# to integrate Artifex's changes.
|
||||
Provides: bundled(lcms2-devel) = 2.10art
|
||||
Provides: bundled(lcms2-devel) = 2.12mt
|
||||
# We need to build against the Artifex fork of freeglut so that we are unicode safe.
|
||||
Provides: bundled(freeglut-devel) = 3.0.0
|
||||
# muPDF needs the muJS sources for the build even if we build against the system
|
||||
# version so bundling them is the safer choice.
|
||||
Provides: bundled(mujs-devel) = 1.0.9
|
||||
Patch1: 0001-Bug-703366-Fix-double-free-of-object-during-lineariz.patch
|
||||
Provides: bundled(mujs-devel) = 1.1.3
|
||||
# muPDF builds only against in-tree extract which is versioned along with ghostpdl.
|
||||
Provides: bundled(extract) = 9.55.0
|
||||
|
||||
%description
|
||||
MuPDF is a lightweight PDF viewer and toolkit written in portable C.
|
||||
@ -58,11 +59,10 @@ applications that use mupdf and static libraries
|
||||
|
||||
%prep
|
||||
%setup -q -n %{name}-%{version}-source
|
||||
for d in $(ls thirdparty | grep -v -e freeglut -e lcms2 -e mujs)
|
||||
for d in $(ls thirdparty | grep -v -e extract -e freeglut -e lcms2 -e mujs)
|
||||
do
|
||||
rm -rf thirdparty/$d
|
||||
done
|
||||
%patch1 -p1
|
||||
|
||||
echo > user.make "\
|
||||
USE_SYSTEM_FREETYPE := yes
|
||||
|
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (mupdf-1.18.0-source.tar.gz) = dd3d413badc5ea50ee100a39aa0265f2d096006e6466f3029ef5f4902e7a9f8e9f958b78ae484524233217ae6ef6ecf56431b8ac462d603a050c4e490503aef1
|
||||
SHA512 (mupdf-1.19.0-source.tar.gz) = c6bb0e4331212d5d01d2f5e04f7e981b195c144d282db99ddd3ae263ae2e5ff09a727b0b5a50942f1a21cacb46b23f76ff9fe00b67f5fab1eebe9d66158c5d09
|
||||
|
Loading…
Reference in New Issue
Block a user