diff options
author | Natanael Copa <ncopa@alpinelinux.org> | 2013-04-17 09:22:37 +0000 |
---|---|---|
committer | Natanael Copa <ncopa@alpinelinux.org> | 2013-04-17 09:29:27 +0000 |
commit | 8d87ec68389b741072a10feef59462edc468349b (patch) | |
tree | 5e51649498aaa8a16272aab7adb141d9b877d26c /main/poppler/CVE-2013-1788.patch | |
parent | 9020a9844363c7d73e729fa57cf4f33b4669bb6e (diff) |
main/poppler: security fix (CVE-2013-1788,CVE-2013-1790)
fixes #1786
patches are from
https://launchpad.net/ubuntu/+source/poppler/0.16.7-2ubuntu2.1
Diffstat (limited to 'main/poppler/CVE-2013-1788.patch')
-rw-r--r-- | main/poppler/CVE-2013-1788.patch | 103 |
1 files changed, 103 insertions, 0 deletions
diff --git a/main/poppler/CVE-2013-1788.patch b/main/poppler/CVE-2013-1788.patch new file mode 100644 index 00000000000..ba0493c6472 --- /dev/null +++ b/main/poppler/CVE-2013-1788.patch @@ -0,0 +1,103 @@ +Description: fix invalid memory access issues +Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=9529e776e53e71069ba4215cdb8b84592d37b555 +Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=e5661e1a08c38d4c8d69976a8c1c02c1102bc88c +Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=d0df8e54512f584ca2b3edbae1c19e167948e5c3 +Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492 +Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=e14b6e9c13d35c9bd1e0c50906ace8e707816888 +Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=0388837f01bc467045164f9ddaff787000a8caaa +Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702071 + +Index: poppler-0.16.7/poppler/Function.cc +=================================================================== +--- poppler-0.16.7.orig/poppler/Function.cc 2013-03-27 10:18:19.704260518 -0400 ++++ poppler-0.16.7/poppler/Function.cc 2013-03-27 10:18:19.696260518 -0400 +@@ -261,6 +261,10 @@ + goto err3; + } + sampleSize[i] = obj2.getInt(); ++ if (sampleSize[i] <= 0) { ++ error(-1, "Illegal non-positive value in function size array"); ++ goto err3; ++ } + obj2.free(); + } + obj1.free(); +@@ -953,6 +957,10 @@ + return; + } + --sp; ++ if (sp + i + 1 >= psStackSize) { ++ error(-1, "Stack underflow in PostScript function"); ++ return; ++ } + stack[sp] = stack[sp + 1 + i]; + } + void pop() +@@ -1001,6 +1009,10 @@ + error(-1, "Stack underflow in PostScript function"); + return; + } ++ if (unlikely(sp - n > psStackSize)) { ++ error(-1, "Stack underflow in PostScript function"); ++ return; ++ } + if (!checkOverflow(n)) { + return; + } +@@ -1025,7 +1037,7 @@ + j = n - j; + } + } +- if (n <= 0 || j == 0) { ++ if (n <= 0 || j == 0 || n > psStackSize || sp + n > psStackSize) { + return; + } + if (j <= n / 2) { +Index: poppler-0.16.7/poppler/Stream.cc +=================================================================== +--- poppler-0.16.7.orig/poppler/Stream.cc 2013-03-27 10:18:19.704260518 -0400 ++++ poppler-0.16.7/poppler/Stream.cc 2013-03-27 10:18:19.696260518 -0400 +@@ -2131,7 +2131,8 @@ + + // clip [-256,511] --> [0,255] + #define dctClipOffset 256 +-static Guchar dctClip[768]; ++#define dctClipLength 768 ++static Guchar dctClip[dctClipLength]; + static int dctClipInit = 0; + + // zig zag decode map +@@ -3077,7 +3078,12 @@ + + // convert to 8-bit integers + for (i = 0; i < 64; ++i) { +- dataOut[i] = dctClip[dctClipOffset + 128 + ((dataIn[i] + 8) >> 4)]; ++ const int ix = dctClipOffset + 128 + ((dataIn[i] + 8) >> 4); ++ if (unlikely(ix < 0 || ix >= dctClipLength)) { ++ dataOut[i] = 0; ++ } else { ++ dataOut[i] = dctClip[ix]; ++ } + } + } + +Index: poppler-0.16.7/splash/Splash.cc +=================================================================== +--- poppler-0.16.7.orig/splash/Splash.cc 2013-03-27 10:18:19.704260518 -0400 ++++ poppler-0.16.7/splash/Splash.cc 2013-03-27 10:18:19.700260518 -0400 +@@ -1497,11 +1497,14 @@ + lineDashStartPhase -= (SplashCoord)i * lineDashTotal; + lineDashStartOn = gTrue; + lineDashStartIdx = 0; +- while (lineDashStartPhase >= state->lineDash[lineDashStartIdx]) { ++ while (lineDashStartIdx < state->lineDashLength && lineDashStartPhase >= state->lineDash[lineDashStartIdx]) { + lineDashStartOn = !lineDashStartOn; + lineDashStartPhase -= state->lineDash[lineDashStartIdx]; + ++lineDashStartIdx; + } ++ if (unlikely(lineDashStartIdx == state->lineDashLength)) { ++ return new SplashPath(); ++ } + + dPath = new SplashPath(); + |