mupdf/mupdf-1.12-CVE-2018-5686.patch

58 lines
1.5 KiB
Diff

From b70eb93f6936c03d8af52040bbca4d4a7db39079 Mon Sep 17 00:00:00 2001
Message-Id: <b70eb93f6936c03d8af52040bbca4d4a7db39079.1516784329.git.mjg@fedoraproject.org>
From: Tor Andersson <tor.andersson@artifex.com>
Date: Tue, 9 Jan 2018 13:52:41 +0100
Subject: [PATCH] Don't allow reading from a 'dead' fz_stream.
Once a stream has thrown an exception or reached EOF,
don't allow further reading.
The EOF flag is reset when fz_seek is invoked.
---
include/mupdf/fitz/stream.h | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/include/mupdf/fitz/stream.h b/include/mupdf/fitz/stream.h
index cd26be90..790a0a83 100644
--- a/include/mupdf/fitz/stream.h
+++ b/include/mupdf/fitz/stream.h
@@ -335,10 +335,11 @@ static inline size_t fz_available(fz_context *ctx, fz_stream *stm, size_t max)
if (len)
return len;
+ if (stm->eof)
+ return 0;
+
fz_try(ctx)
- {
c = stm->next(ctx, stm, max);
- }
fz_catch(ctx)
{
fz_rethrow_if(ctx, FZ_ERROR_TRYLATER);
@@ -369,10 +370,10 @@ static inline int fz_read_byte(fz_context *ctx, fz_stream *stm)
if (stm->rp != stm->wp)
return *stm->rp++;
+ if (stm->eof)
+ return EOF;
fz_try(ctx)
- {
c = stm->next(ctx, stm, 1);
- }
fz_catch(ctx)
{
fz_rethrow_if(ctx, FZ_ERROR_TRYLATER);
@@ -398,6 +399,8 @@ static inline int fz_peek_byte(fz_context *ctx, fz_stream *stm)
if (stm->rp != stm->wp)
return *stm->rp;
+ if (stm->eof)
+ return EOF;
c = stm->next(ctx, stm, 1);
if (c != EOF)
--
2.16.1.338.gd8f744ddde