mupdf/mupdf-CVE-2018-16648.patch

49 lines
1.6 KiB
Diff

From 38f883fe129a5e89306252a4676eaaf4bc968824 Mon Sep 17 00:00:00 2001
Message-Id: <38f883fe129a5e89306252a4676eaaf4bc968824.1542272532.git.mjg@fedoraproject.org>
From: Tor Andersson <tor.andersson@artifex.com>
Date: Mon, 22 Oct 2018 17:16:35 +0200
Subject: [PATCH] Fix text used as clip mask in pdfwrite device.
Push the clip state, and pass the correct text rendering mode state.
---
source/pdf/pdf-device.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/source/pdf/pdf-device.c b/source/pdf/pdf-device.c
index 4dd729b8..427e3b38 100644
--- a/source/pdf/pdf-device.c
+++ b/source/pdf/pdf-device.c
@@ -734,9 +734,13 @@ pdf_dev_clip_text(fz_context *ctx, fz_device *dev, const fz_text *text, fz_matri
{
pdf_device *pdev = (pdf_device*)dev;
fz_text_span *span;
+
+ pdf_dev_end_text(ctx, pdev);
+ pdf_dev_push(ctx, pdev);
+
for (span = text->head; span; span = span->next)
{
- pdf_dev_begin_text(ctx, pdev, span->trm, 0);
+ pdf_dev_begin_text(ctx, pdev, span->trm, 7);
pdf_dev_ctm(ctx, pdev, ctm);
pdf_dev_font(ctx, pdev, span->font);
pdf_dev_text_span(ctx, pdev, span);
@@ -748,9 +752,13 @@ pdf_dev_clip_stroke_text(fz_context *ctx, fz_device *dev, const fz_text *text, c
{
pdf_device *pdev = (pdf_device*)dev;
fz_text_span *span;
+
+ pdf_dev_end_text(ctx, pdev);
+ pdf_dev_push(ctx, pdev);
+
for (span = text->head; span; span = span->next)
{
- pdf_dev_begin_text(ctx, pdev, span->trm, 0);
+ pdf_dev_begin_text(ctx, pdev, span->trm, 7);
pdf_dev_font(ctx, pdev, span->font);
pdf_dev_ctm(ctx, pdev, ctm);
pdf_dev_text_span(ctx, pdev, span);
--
2.19.1.1238.g4b45f61cc0