diff options
author | Marcus Alves Grando <mnag@FreeBSD.org> | 2005-12-07 14:26:01 +0000 |
---|---|---|
committer | Marcus Alves Grando <mnag@FreeBSD.org> | 2005-12-07 14:26:01 +0000 |
commit | 4a0a39807224f6787362971d926e6474d5cb9e15 (patch) | |
tree | 2cd4dc133366de092622b802a85be2455605c1d9 /graphics | |
parent | Add vendor patch for security issues (diff) |
Backport xpdf vendor patch
Bump PORTREVISION
Approved by: gnome (marcus)
Security: http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities
http://secunia.com/advisories/17897/
CVE-2005-3191, CVE-2005-3192, CVE-2005-3193
Notes
Notes:
svn path=/head/; revision=150590
Diffstat (limited to 'graphics')
-rw-r--r-- | graphics/gpdf/Makefile | 2 | ||||
-rw-r--r-- | graphics/gpdf/files/patch-SA17897 | 120 | ||||
-rw-r--r-- | graphics/poppler/Makefile | 1 | ||||
-rw-r--r-- | graphics/poppler/files/patch-SA17897 | 120 |
4 files changed, 242 insertions, 1 deletions
diff --git a/graphics/gpdf/Makefile b/graphics/gpdf/Makefile index 7ea93a3182e4..6967064942f7 100644 --- a/graphics/gpdf/Makefile +++ b/graphics/gpdf/Makefile @@ -7,7 +7,7 @@ PORTNAME= gpdf PORTVERSION= 2.10.0 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= graphics print gnome MASTER_SITES= ${MASTER_SITE_GNOME} MASTER_SITE_SUBDIR= sources/${PORTNAME}/2.10 diff --git a/graphics/gpdf/files/patch-SA17897 b/graphics/gpdf/files/patch-SA17897 new file mode 100644 index 000000000000..f27f1a139be4 --- /dev/null +++ b/graphics/gpdf/files/patch-SA17897 @@ -0,0 +1,120 @@ +--- xpdf/JPXStream.cc.orig Mon May 17 15:11:49 2004 ++++ xpdf/JPXStream.cc Tue Dec 6 18:07:18 2005 +@@ -666,7 +666,7 @@ + int segType; + GBool haveSIZ, haveCOD, haveQCD, haveSOT; + Guint precinctSize, style; +- Guint segLen, capabilities, comp, i, j, r; ++ Guint segLen, capabilities, nTiles, comp, i, j, r; + + //----- main header + haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; +@@ -701,8 +701,13 @@ + / img.xTileSize; + img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) + / img.yTileSize; +- img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles * +- sizeof(JPXTile)); ++ nTiles = img.nXTiles * img.nYTiles; ++ // check for overflow before allocating memory ++ if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) { ++ error(getPos(), "Bad tile count in JPX SIZ marker segment"); ++ return gFalse; ++ } ++ img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile)); + for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { + img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps * + sizeof(JPXTileComp)); +--- xpdf/Stream.cc.orig Mon May 17 16:37:57 2004 ++++ xpdf/Stream.cc Tue Dec 6 18:05:14 2005 +@@ -407,18 +407,33 @@ + + StreamPredictor::StreamPredictor(Stream *strA, int predictorA, + int widthA, int nCompsA, int nBitsA) { ++ int totalBits; ++ + str = strA; + predictor = predictorA; + width = widthA; + nComps = nCompsA; + nBits = nBitsA; ++ predLine = NULL; ++ ok = gFalse; + + nVals = width * nComps; ++ totalBits = nVals * nBits; ++ if (totalBits == 0 || ++ (totalBits / nBits) / nComps != width || ++ totalBits + 7 < 0) { ++ return; ++ } + pixBytes = (nComps * nBits + 7) >> 3; +- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; ++ rowBytes = ((totalBits + 7) >> 3) + pixBytes; ++ if (rowBytes < 0) { ++ return; ++ } + predLine = (Guchar *)gmalloc(rowBytes); + memset(predLine, 0, rowBytes); + predIdx = rowBytes; ++ ++ ok = gTrue; + } + + StreamPredictor::~StreamPredictor() { +@@ -1012,6 +1027,10 @@ + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +@@ -2897,6 +2916,14 @@ + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +@@ -3255,6 +3282,10 @@ + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +--- xpdf/Stream.h.orig Mon May 17 16:37:57 2004 ++++ xpdf/Stream.h Tue Dec 6 18:05:14 2005 +@@ -233,6 +233,8 @@ + + ~StreamPredictor(); + ++ GBool isOk() { return ok; } ++ + int lookChar(); + int getChar(); + +@@ -250,6 +252,7 @@ + int rowBytes; // bytes per line + Guchar *predLine; // line buffer + int predIdx; // current index in predLine ++ GBool ok; + }; + + //------------------------------------------------------------------------ diff --git a/graphics/poppler/Makefile b/graphics/poppler/Makefile index 19124133b48a..27f6c0d3d3fb 100644 --- a/graphics/poppler/Makefile +++ b/graphics/poppler/Makefile @@ -8,6 +8,7 @@ PORTNAME= poppler PORTVERSION= 0.4.2 +PORTREVISION= 1 CATEGORIES= graphics print MASTER_SITES= http://poppler.freedesktop.org/ diff --git a/graphics/poppler/files/patch-SA17897 b/graphics/poppler/files/patch-SA17897 new file mode 100644 index 000000000000..61b5472fe06f --- /dev/null +++ b/graphics/poppler/files/patch-SA17897 @@ -0,0 +1,120 @@ +--- poppler/JPXStream.cc.orig Thu Mar 3 16:46:03 2005 ++++ poppler/JPXStream.cc Wed Dec 7 00:33:40 2005 +@@ -666,7 +666,7 @@ + int segType; + GBool haveSIZ, haveCOD, haveQCD, haveSOT; + Guint precinctSize, style; +- Guint segLen, capabilities, comp, i, j, r; ++ Guint segLen, capabilities, nTiles, comp, i, j, r; + + //----- main header + haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; +@@ -701,8 +701,13 @@ + / img.xTileSize; + img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) + / img.yTileSize; +- img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles * +- sizeof(JPXTile)); ++ nTiles = img.nXTiles * img.nYTiles; ++ // check for overflow before allocating memory ++ if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) { ++ error(getPos(), "Bad tile count in JPX SIZ marker segment"); ++ return gFalse; ++ } ++ img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile)); + for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { + img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps * + sizeof(JPXTileComp)); +--- poppler/Stream.cc.orig Wed Apr 27 17:56:18 2005 ++++ poppler/Stream.cc Wed Dec 7 00:32:08 2005 +@@ -415,18 +415,33 @@ + + StreamPredictor::StreamPredictor(Stream *strA, int predictorA, + int widthA, int nCompsA, int nBitsA) { ++ int totalBits; ++ + str = strA; + predictor = predictorA; + width = widthA; + nComps = nCompsA; + nBits = nBitsA; ++ predLine = NULL; ++ ok = gFalse; + + nVals = width * nComps; ++ totalBits = nVals * nBits; ++ if (totalBits == 0 || ++ (totalBits / nBits) / nComps != width || ++ totalBits + 7 < 0) { ++ return; ++ } + pixBytes = (nComps * nBits + 7) >> 3; +- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; ++ rowBytes = ((totalBits + 7) >> 3) + pixBytes; ++ if (rowBytes < 0) { ++ return; ++ } + predLine = (Guchar *)gmalloc(rowBytes); + memset(predLine, 0, rowBytes); + predIdx = rowBytes; ++ ++ ok = gTrue; + } + + StreamPredictor::~StreamPredictor() { +@@ -1020,6 +1035,10 @@ + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +@@ -2907,6 +2926,14 @@ + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +@@ -3268,6 +3295,10 @@ + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +--- poppler/Stream.h.orig Wed Apr 27 17:56:18 2005 ++++ poppler/Stream.h Wed Dec 7 00:32:08 2005 +@@ -231,6 +231,8 @@ + + ~StreamPredictor(); + ++ GBool isOk() { return ok; } ++ + int lookChar(); + int getChar(); + +@@ -248,6 +250,7 @@ + int rowBytes; // bytes per line + Guchar *predLine; // line buffer + int predIdx; // current index in predLine ++ GBool ok; + }; + + //------------------------------------------------------------------------ |