aboutsummaryrefslogtreecommitdiffstats
path: root/main/poppler/CVE-2013-1788.patch
diff options
context:
space:
mode:
Diffstat (limited to 'main/poppler/CVE-2013-1788.patch')
-rw-r--r--main/poppler/CVE-2013-1788.patch103
1 files changed, 103 insertions, 0 deletions
diff --git a/main/poppler/CVE-2013-1788.patch b/main/poppler/CVE-2013-1788.patch
new file mode 100644
index 0000000000..ba0493c647
--- /dev/null
+++ b/main/poppler/CVE-2013-1788.patch
@@ -0,0 +1,103 @@
+Description: fix invalid memory access issues
+Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=9529e776e53e71069ba4215cdb8b84592d37b555
+Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=e5661e1a08c38d4c8d69976a8c1c02c1102bc88c
+Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=d0df8e54512f584ca2b3edbae1c19e167948e5c3
+Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492
+Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=e14b6e9c13d35c9bd1e0c50906ace8e707816888
+Origin: backport, http://cgit.freedesktop.org/poppler/poppler/commit/?id=0388837f01bc467045164f9ddaff787000a8caaa
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702071
+
+Index: poppler-0.16.7/poppler/Function.cc
+===================================================================
+--- poppler-0.16.7.orig/poppler/Function.cc 2013-03-27 10:18:19.704260518 -0400
++++ poppler-0.16.7/poppler/Function.cc 2013-03-27 10:18:19.696260518 -0400
+@@ -261,6 +261,10 @@
+ goto err3;
+ }
+ sampleSize[i] = obj2.getInt();
++ if (sampleSize[i] <= 0) {
++ error(-1, "Illegal non-positive value in function size array");
++ goto err3;
++ }
+ obj2.free();
+ }
+ obj1.free();
+@@ -953,6 +957,10 @@
+ return;
+ }
+ --sp;
++ if (sp + i + 1 >= psStackSize) {
++ error(-1, "Stack underflow in PostScript function");
++ return;
++ }
+ stack[sp] = stack[sp + 1 + i];
+ }
+ void pop()
+@@ -1001,6 +1009,10 @@
+ error(-1, "Stack underflow in PostScript function");
+ return;
+ }
++ if (unlikely(sp - n > psStackSize)) {
++ error(-1, "Stack underflow in PostScript function");
++ return;
++ }
+ if (!checkOverflow(n)) {
+ return;
+ }
+@@ -1025,7 +1037,7 @@
+ j = n - j;
+ }
+ }
+- if (n <= 0 || j == 0) {
++ if (n <= 0 || j == 0 || n > psStackSize || sp + n > psStackSize) {
+ return;
+ }
+ if (j <= n / 2) {
+Index: poppler-0.16.7/poppler/Stream.cc
+===================================================================
+--- poppler-0.16.7.orig/poppler/Stream.cc 2013-03-27 10:18:19.704260518 -0400
++++ poppler-0.16.7/poppler/Stream.cc 2013-03-27 10:18:19.696260518 -0400
+@@ -2131,7 +2131,8 @@
+
+ // clip [-256,511] --> [0,255]
+ #define dctClipOffset 256
+-static Guchar dctClip[768];
++#define dctClipLength 768
++static Guchar dctClip[dctClipLength];
+ static int dctClipInit = 0;
+
+ // zig zag decode map
+@@ -3077,7 +3078,12 @@
+
+ // convert to 8-bit integers
+ for (i = 0; i < 64; ++i) {
+- dataOut[i] = dctClip[dctClipOffset + 128 + ((dataIn[i] + 8) >> 4)];
++ const int ix = dctClipOffset + 128 + ((dataIn[i] + 8) >> 4);
++ if (unlikely(ix < 0 || ix >= dctClipLength)) {
++ dataOut[i] = 0;
++ } else {
++ dataOut[i] = dctClip[ix];
++ }
+ }
+ }
+
+Index: poppler-0.16.7/splash/Splash.cc
+===================================================================
+--- poppler-0.16.7.orig/splash/Splash.cc 2013-03-27 10:18:19.704260518 -0400
++++ poppler-0.16.7/splash/Splash.cc 2013-03-27 10:18:19.700260518 -0400
+@@ -1497,11 +1497,14 @@
+ lineDashStartPhase -= (SplashCoord)i * lineDashTotal;
+ lineDashStartOn = gTrue;
+ lineDashStartIdx = 0;
+- while (lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
++ while (lineDashStartIdx < state->lineDashLength && lineDashStartPhase >= state->lineDash[lineDashStartIdx]) {
+ lineDashStartOn = !lineDashStartOn;
+ lineDashStartPhase -= state->lineDash[lineDashStartIdx];
+ ++lineDashStartIdx;
+ }
++ if (unlikely(lineDashStartIdx == state->lineDashLength)) {
++ return new SplashPath();
++ }
+
+ dPath = new SplashPath();
+