46b1efb4f0
- CVE-2018-6192 (rh bz #1539845 #1539846) (gs bz #698916) - CVE-2018-6544 (rh bz #1542264 #1542265) (gs bz #698830 #698965) - CVE-2018-1000051 (rh bz #1544847 #1544848) (gs bz #698825 #698873)
47 lines
1.6 KiB
Diff
47 lines
1.6 KiB
Diff
From 26527eef77b3e51c2258c8e40845bfbc015e405d Mon Sep 17 00:00:00 2001
|
|
Message-Id: <26527eef77b3e51c2258c8e40845bfbc015e405d.1518616043.git.mjg@fedoraproject.org>
|
|
From: Sebastian Rasmussen <sebras@gmail.com>
|
|
Date: Mon, 29 Jan 2018 02:00:48 +0100
|
|
Subject: [PATCH] Bug 698830: Don't drop unkept stream if running out of error
|
|
stack.
|
|
|
|
Under normal conditions where fz_keep_stream() is called inside
|
|
fz_try() we may call fz_drop_stream() in fz_catch() upon exceptions.
|
|
The issue comes when fz_keep_stream() has not yet been called but is
|
|
dropped in fz_catch(). This happens in the PDF from the bug when
|
|
fz_try() runs out of exception stack, and next the code in fz_catch()
|
|
runs, dropping the caller's reference to the filter chain stream!
|
|
|
|
The simplest way of fixing this it to always keep the filter chain
|
|
stream before fz_try() is called. That way fz_catch() may drop the
|
|
stream whether an exception has occurred or if the fz_try() ran out of
|
|
exception stack.
|
|
---
|
|
source/pdf/pdf-stream.c | 5 ++---
|
|
1 file changed, 2 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/source/pdf/pdf-stream.c b/source/pdf/pdf-stream.c
|
|
index c89da5c4..c6ba7ad3 100644
|
|
--- a/source/pdf/pdf-stream.c
|
|
+++ b/source/pdf/pdf-stream.c
|
|
@@ -303,14 +303,13 @@ pdf_open_raw_filter(fz_context *ctx, fz_stream *chain, pdf_document *doc, pdf_ob
|
|
*orig_gen = 0;
|
|
}
|
|
|
|
- fz_var(chain);
|
|
+ chain = fz_keep_stream(ctx, chain);
|
|
|
|
fz_try(ctx)
|
|
{
|
|
len = pdf_to_int(ctx, pdf_dict_get(ctx, stmobj, PDF_NAME_Length));
|
|
|
|
- /* don't close chain when we close this filter */
|
|
- chain2 = fz_keep_stream(ctx, chain);
|
|
+ chain2 = chain;
|
|
chain = NULL;
|
|
chain = fz_open_null(ctx, chain2, len, offset);
|
|
|
|
--
|
|
2.16.1.312.g365a692731
|
|
|