Author: sip Date: 2006-03-26 03:27:54 +0200 (Sun, 26 Mar 2006) New Revision: 1017 Added: crux-2.2/ports/opt/xpdf/xpdf-3.01pl2.patch Removed: crux-2.2/ports/opt/xpdf/xpdf-3.01pl1.patch Modified: crux-2.2/ports/opt/xpdf/.md5sum crux-2.2/ports/opt/xpdf/Pkgfile Log: [security] xpdf: updated to 3.1pl2 Modified: crux-2.2/ports/opt/xpdf/.md5sum =================================================================== --- crux-2.2/ports/opt/xpdf/.md5sum 2006-03-26 01:15:56 UTC (rev 1016) +++ crux-2.2/ports/opt/xpdf/.md5sum 2006-03-26 01:27:54 UTC (rev 1017) @@ -1,2 +1,2 @@ e004c69c7dddef165d768b1362b44268 xpdf-3.01.tar.gz -4184783da2885ecde3c2256de5144555 xpdf-3.01pl1.patch +8f1f5d37153c7e98f794f18d0b80fc25 xpdf-3.01pl2.patch Modified: crux-2.2/ports/opt/xpdf/Pkgfile =================================================================== --- crux-2.2/ports/opt/xpdf/Pkgfile 2006-03-26 01:15:56 UTC (rev 1016) +++ crux-2.2/ports/opt/xpdf/Pkgfile 2006-03-26 01:27:54 UTC (rev 1017) @@ -5,7 +5,7 @@ # Depends on: lesstif, t1lib name=xpdf -version=3.01pl1 +version=3.01pl2 release=1 source=(ftp://ftp.foolabs.com/pub/xpdf/$name-3.01.tar.gz \ $name-$version.patch) Deleted: crux-2.2/ports/opt/xpdf/xpdf-3.01pl1.patch =================================================================== --- crux-2.2/ports/opt/xpdf/xpdf-3.01pl1.patch 2006-03-26 01:15:56 UTC (rev 1016) +++ crux-2.2/ports/opt/xpdf/xpdf-3.01pl1.patch 2006-03-26 01:27:54 UTC (rev 1017) @@ -1,168 +0,0 @@ -diff -c -r xpdf-3.01-orig/xpdf/JPXStream.cc xpdf-3.01/xpdf/JPXStream.cc -*** xpdf-3.01-orig/xpdf/JPXStream.cc Tue Aug 16 22:34:31 2005 ---- xpdf-3.01/xpdf/JPXStream.cc Thu Nov 3 16:50:39 2005 -*************** -*** 783,789 **** - int segType; - GBool haveSIZ, haveCOD, haveQCD, haveSOT; - Guint precinctSize, style; -! Guint segLen, capabilities, comp, i, j, r; - - //----- main header - haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; ---- 783,789 ---- - int segType; - GBool haveSIZ, haveCOD, haveQCD, haveSOT; - Guint precinctSize, style; -! Guint segLen, capabilities, nTiles, comp, i, j, r; - - //----- main header - haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; -*************** -*** 818,825 **** - / img.xTileSize; - img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) - / img.yTileSize; -! img.tiles = (JPXTile *)gmallocn(img.nXTiles * img.nYTiles, -! sizeof(JPXTile)); - for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { - img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps, - sizeof(JPXTileComp)); ---- 818,830 ---- - / img.xTileSize; - img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) - / img.yTileSize; -! nTiles = img.nXTiles * img.nYTiles; -! // check for overflow before allocating memory -! if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) { -! error(getPos(), "Bad tile count in JPX SIZ marker segment"); -! return gFalse; -! } -! img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile)); - for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { - img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps, - sizeof(JPXTileComp)); -diff -c -r xpdf-3.01-orig/xpdf/Stream.cc xpdf-3.01/xpdf/Stream.cc -*** xpdf-3.01-orig/xpdf/Stream.cc Tue Aug 16 22:34:31 2005 ---- xpdf-3.01/xpdf/Stream.cc Thu Nov 3 16:50:39 2005 -*************** -*** 401,418 **** - - StreamPredictor::StreamPredictor(Stream *strA, int predictorA, - int widthA, int nCompsA, int nBitsA) { - str = strA; - predictor = predictorA; - width = widthA; - nComps = nCompsA; - nBits = nBitsA; - - nVals = width * nComps; - pixBytes = (nComps * nBits + 7) >> 3; -! rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; - predLine = (Guchar *)gmalloc(rowBytes); - memset(predLine, 0, rowBytes); - predIdx = rowBytes; - } - - StreamPredictor::~StreamPredictor() { ---- 401,433 ---- - - StreamPredictor::StreamPredictor(Stream *strA, int predictorA, - int widthA, int nCompsA, int nBitsA) { -+ int totalBits; -+ - str = strA; - predictor = predictorA; - width = widthA; - nComps = nCompsA; - nBits = nBitsA; -+ predLine = NULL; -+ ok = gFalse; - - nVals = width * nComps; -+ totalBits = nVals * nBits; -+ if (totalBits == 0 || -+ (totalBits / nBits) / nComps != width || -+ totalBits + 7 < 0) { -+ return; -+ } - pixBytes = (nComps * nBits + 7) >> 3; -! rowBytes = ((totalBits + 7) >> 3) + pixBytes; -! if (rowBytes < 0) { -! return; -! } - predLine = (Guchar *)gmalloc(rowBytes); - memset(predLine, 0, rowBytes); - predIdx = rowBytes; -+ -+ ok = gTrue; - } - - StreamPredictor::~StreamPredictor() { -*************** -*** 1004,1009 **** ---- 1019,1028 ---- - FilterStream(strA) { - if (predictor != 1) { - pred = new StreamPredictor(this, predictor, columns, colors, bits); -+ if (!pred->isOk()) { -+ delete pred; -+ pred = NULL; -+ } - } else { - pred = NULL; - } -*************** -*** 2899,2904 **** ---- 2918,2931 ---- - height = read16(); - width = read16(); - numComps = str->getChar(); -+ if (numComps <= 0 || numComps > 4) { -+ error(getPos(), "Bad number of components in DCT stream", prec); -+ return gFalse; -+ } -+ if (numComps <= 0 || numComps > 4) { -+ error(getPos(), "Bad number of components in DCT stream", prec); -+ return gFalse; -+ } - if (prec != 8) { - error(getPos(), "Bad DCT precision %d", prec); - return gFalse; -*************** -*** 3827,3832 **** ---- 3854,3863 ---- - FilterStream(strA) { - if (predictor != 1) { - pred = new StreamPredictor(this, predictor, columns, colors, bits); -+ if (!pred->isOk()) { -+ delete pred; -+ pred = NULL; -+ } - } else { - pred = NULL; - } -diff -c -r xpdf-3.01-orig/xpdf/Stream.h xpdf-3.01/xpdf/Stream.h -*** xpdf-3.01-orig/xpdf/Stream.h Tue Aug 16 22:34:31 2005 ---- xpdf-3.01/xpdf/Stream.h Thu Nov 3 16:50:39 2005 -*************** -*** 232,237 **** ---- 232,239 ---- - - ~StreamPredictor(); - -+ GBool isOk() { return ok; } -+ - int lookChar(); - int getChar(); - -*************** -*** 249,254 **** ---- 251,257 ---- - int rowBytes; // bytes per line - Guchar *predLine; // line buffer - int predIdx; // current index in predLine -+ GBool ok; - }; - - //------------------------------------------------------------------------ Added: crux-2.2/ports/opt/xpdf/xpdf-3.01pl2.patch =================================================================== --- crux-2.2/ports/opt/xpdf/xpdf-3.01pl2.patch (rev 0) +++ crux-2.2/ports/opt/xpdf/xpdf-3.01pl2.patch 2006-03-26 01:27:54 UTC (rev 1017) @@ -0,0 +1,471 @@ +diff -cr xpdf-3.01.orig/goo/gmem.c xpdf-3.01/goo/gmem.c +*** xpdf-3.01.orig/goo/gmem.c Tue Aug 16 22:34:30 2005 +--- xpdf-3.01/goo/gmem.c Tue Jan 17 17:03:57 2006 +*************** +*** 11,16 **** +--- 11,17 ---- + #include <stdlib.h> + #include <stddef.h> + #include <string.h> ++ #include <limits.h> + #include "gmem.h" + + #ifdef DEBUG_MEM +*************** +*** 63,69 **** + int lst; + unsigned long *trl, *p; + +! if (size == 0) + return NULL; + size1 = gMemDataSize(size); + if (!(mem = (char *)malloc(size1 + gMemHdrSize + gMemTrlSize))) { +--- 64,70 ---- + int lst; + unsigned long *trl, *p; + +! if (size <= 0) + return NULL; + size1 = gMemDataSize(size); + if (!(mem = (char *)malloc(size1 + gMemHdrSize + gMemTrlSize))) { +*************** +*** 86,92 **** + #else + void *p; + +! if (size == 0) + return NULL; + if (!(p = malloc(size))) { + fprintf(stderr, "Out of memory\n"); +--- 87,93 ---- + #else + void *p; + +! if (size <= 0) + return NULL; + if (!(p = malloc(size))) { + fprintf(stderr, "Out of memory\n"); +*************** +*** 102,108 **** + void *q; + int oldSize; + +! if (size == 0) { + if (p) + gfree(p); + return NULL; +--- 103,109 ---- + void *q; + int oldSize; + +! if (size <= 0) { + if (p) + gfree(p); + return NULL; +*************** +*** 120,126 **** + #else + void *q; + +! if (size == 0) { + if (p) + free(p); + return NULL; +--- 121,127 ---- + #else + void *q; + +! if (size <= 0) { + if (p) + free(p); + return NULL; +*************** +*** 140,147 **** + void *gmallocn(int nObjs, int objSize) { + int n; + + n = nObjs * objSize; +! if (objSize == 0 || n / objSize != nObjs) { + fprintf(stderr, "Bogus memory allocation size\n"); + exit(1); + } +--- 141,151 ---- + void *gmallocn(int nObjs, int objSize) { + int n; + ++ if (nObjs == 0) { ++ return NULL; ++ } + n = nObjs * objSize; +! if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { + fprintf(stderr, "Bogus memory allocation size\n"); + exit(1); + } +*************** +*** 151,158 **** + void *greallocn(void *p, int nObjs, int objSize) { + int n; + + n = nObjs * objSize; +! if (objSize == 0 || n / objSize != nObjs) { + fprintf(stderr, "Bogus memory allocation size\n"); + exit(1); + } +--- 155,168 ---- + void *greallocn(void *p, int nObjs, int objSize) { + int n; + ++ if (nObjs == 0) { ++ if (p) { ++ gfree(p); ++ } ++ return NULL; ++ } + n = nObjs * objSize; +! if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { + fprintf(stderr, "Bogus memory allocation size\n"); + exit(1); + } +diff -cr xpdf-3.01.orig/xpdf/JBIG2Stream.cc xpdf-3.01/xpdf/JBIG2Stream.cc +*** xpdf-3.01.orig/xpdf/JBIG2Stream.cc Tue Aug 16 22:34:31 2005 +--- xpdf-3.01/xpdf/JBIG2Stream.cc Tue Jan 17 17:29:46 2006 +*************** +*** 13,18 **** +--- 13,19 ---- + #endif + + #include <stdlib.h> ++ #include <limits.h> + #include "GList.h" + #include "Error.h" + #include "JArithmeticDecoder.h" +*************** +*** 681,686 **** +--- 682,691 ---- + w = wA; + h = hA; + line = (wA + 7) >> 3; ++ if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) { ++ data = NULL; ++ return; ++ } + // need to allocate one extra guard byte for use in combine() + data = (Guchar *)gmalloc(h * line + 1); + data[h * line] = 0; +*************** +*** 692,697 **** +--- 697,706 ---- + w = bitmap->w; + h = bitmap->h; + line = bitmap->line; ++ if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX - 1) / line) { ++ data = NULL; ++ return; ++ } + // need to allocate one extra guard byte for use in combine() + data = (Guchar *)gmalloc(h * line + 1); + memcpy(data, bitmap->data, h * line); +*************** +*** 720,726 **** + } + + void JBIG2Bitmap::expand(int newH, Guint pixel) { +! if (newH <= h) { + return; + } + // need to allocate one extra guard byte for use in combine() +--- 729,735 ---- + } + + void JBIG2Bitmap::expand(int newH, Guint pixel) { +! if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) { + return; + } + // need to allocate one extra guard byte for use in combine() +*************** +*** 2294,2299 **** +--- 2303,2316 ---- + !readUWord(&stepX) || !readUWord(&stepY)) { + goto eofError; + } ++ if (w == 0 || h == 0 || w >= INT_MAX / h) { ++ error(getPos(), "Bad bitmap size in JBIG2 halftone segment"); ++ return; ++ } ++ if (gridH == 0 || gridW >= INT_MAX / gridH) { ++ error(getPos(), "Bad grid size in JBIG2 halftone segment"); ++ return; ++ } + + // get pattern dictionary + if (nRefSegs != 1) { +diff -cr xpdf-3.01.orig/xpdf/JPXStream.cc xpdf-3.01/xpdf/JPXStream.cc +*** xpdf-3.01.orig/xpdf/JPXStream.cc Tue Aug 16 22:34:31 2005 +--- xpdf-3.01/xpdf/JPXStream.cc Tue Jan 17 17:14:06 2006 +*************** +*** 12,17 **** +--- 12,18 ---- + #pragma implementation + #endif + ++ #include <limits.h> + #include "gmem.h" + #include "Error.h" + #include "JArithmeticDecoder.h" +*************** +*** 818,823 **** +--- 819,830 ---- + / img.xTileSize; + img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) + / img.yTileSize; ++ // check for overflow before allocating memory ++ if (img.nXTiles <= 0 || img.nYTiles <= 0 || ++ img.nXTiles >= INT_MAX / img.nYTiles) { ++ error(getPos(), "Bad tile count in JPX SIZ marker segment"); ++ return gFalse; ++ } + img.tiles = (JPXTile *)gmallocn(img.nXTiles * img.nYTiles, + sizeof(JPXTile)); + for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { +diff -cr xpdf-3.01.orig/xpdf/Stream.cc xpdf-3.01/xpdf/Stream.cc +*** xpdf-3.01.orig/xpdf/Stream.cc Tue Aug 16 22:34:31 2005 +--- xpdf-3.01/xpdf/Stream.cc Tue Jan 17 17:31:52 2006 +*************** +*** 15,20 **** +--- 15,21 ---- + #include <stdio.h> + #include <stdlib.h> + #include <stddef.h> ++ #include <limits.h> + #ifndef WIN32 + #include <unistd.h> + #endif +*************** +*** 406,418 **** +--- 407,432 ---- + width = widthA; + nComps = nCompsA; + nBits = nBitsA; ++ predLine = NULL; ++ ok = gFalse; + + nVals = width * nComps; ++ if (width <= 0 || nComps <= 0 || nBits <= 0 || ++ nComps >= INT_MAX / nBits || ++ width >= INT_MAX / nComps / nBits || ++ nVals * nBits + 7 < 0) { ++ return; ++ } + pixBytes = (nComps * nBits + 7) >> 3; + rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; ++ if (rowBytes <= 0) { ++ return; ++ } + predLine = (Guchar *)gmalloc(rowBytes); + memset(predLine, 0, rowBytes); + predIdx = rowBytes; ++ ++ ok = gTrue; + } + + StreamPredictor::~StreamPredictor() { +*************** +*** 1004,1009 **** +--- 1018,1027 ---- + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +*************** +*** 1259,1264 **** +--- 1277,1285 ---- + if (columns < 1) { + columns = 1; + } ++ if (columns + 4 <= 0) { ++ columns = INT_MAX - 4; ++ } + rows = rowsA; + endOfBlock = endOfBlockA; + black = blackA; +*************** +*** 2899,2904 **** +--- 2920,2930 ---- + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream"); ++ numComps = 0; ++ return gFalse; ++ } + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +*************** +*** 2925,2930 **** +--- 2951,2961 ---- + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream"); ++ numComps = 0; ++ return gFalse; ++ } + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +*************** +*** 2947,2952 **** +--- 2978,2988 ---- + + length = read16() - 2; + scanInfo.numComps = str->getChar(); ++ if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream"); ++ scanInfo.numComps = 0; ++ return gFalse; ++ } + --length; + if (length != 2 * scanInfo.numComps + 3) { + error(getPos(), "Bad DCT scan info block"); +*************** +*** 3041,3046 **** +--- 3077,3083 ---- + numACHuffTables = index+1; + tbl = &acHuffTables[index]; + } else { ++ index &= 0x0f; + if (index >= numDCHuffTables) + numDCHuffTables = index+1; + tbl = &dcHuffTables[index]; +*************** +*** 3827,3832 **** +--- 3864,3873 ---- + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +diff -cr xpdf-3.01.orig/xpdf/Stream.h xpdf-3.01/xpdf/Stream.h +*** xpdf-3.01.orig/xpdf/Stream.h Tue Aug 16 22:34:31 2005 +--- xpdf-3.01/xpdf/Stream.h Tue Jan 17 17:19:54 2006 +*************** +*** 232,237 **** +--- 232,239 ---- + + ~StreamPredictor(); + ++ GBool isOk() { return ok; } ++ + int lookChar(); + int getChar(); + +*************** +*** 249,254 **** +--- 251,257 ---- + int rowBytes; // bytes per line + Guchar *predLine; // line buffer + int predIdx; // current index in predLine ++ GBool ok; + }; + + //------------------------------------------------------------------------ +*************** +*** 527,533 **** + short getWhiteCode(); + short getBlackCode(); + short lookBits(int n); +! void eatBits(int n) { inputBits -= n; } + }; + + //------------------------------------------------------------------------ +--- 530,536 ---- + short getWhiteCode(); + short getBlackCode(); + short lookBits(int n); +! void eatBits(int n) { if ((inputBits -= n) < 0) inputBits = 0; } + }; + + //------------------------------------------------------------------------ +diff -cr xpdf-3.01.orig/splash/SplashXPathScanner.cc xpdf-3.01/splash/SplashXPathScanner.cc +*** xpdf-3.01.orig/splash/SplashXPathScanner.cc Tue Aug 16 22:34:31 2005 +--- xpdf-3.01/splash/SplashXPathScanner.cc Wed Feb 1 17:01:14 2006 +*************** +*** 186,192 **** + } + + void SplashXPathScanner::computeIntersections(int y) { +! SplashCoord ySegMin, ySegMax, xx0, xx1; + SplashXPathSeg *seg; + int i, j; + +--- 186,192 ---- + } + + void SplashXPathScanner::computeIntersections(int y) { +! SplashCoord xSegMin, xSegMax, ySegMin, ySegMax, xx0, xx1; + SplashXPathSeg *seg; + int i, j; + +*************** +*** 236,254 **** + } else if (seg->flags & splashXPathVert) { + xx0 = xx1 = seg->x0; + } else { +! if (ySegMin <= y) { +! // intersection with top edge +! xx0 = seg->x0 + ((SplashCoord)y - seg->y0) * seg->dxdy; + } else { +! // x coord of segment endpoint with min y coord +! xx0 = (seg->flags & splashXPathFlip) ? seg->x1 : seg->x0; + } +! if (ySegMax >= y + 1) { +! // intersection with bottom edge +! xx1 = seg->x0 + ((SplashCoord)y + 1 - seg->y0) * seg->dxdy; +! } else { +! // x coord of segment endpoint with max y coord +! xx1 = (seg->flags & splashXPathFlip) ? seg->x0 : seg->x1; + } + } + if (xx0 < xx1) { +--- 236,262 ---- + } else if (seg->flags & splashXPathVert) { + xx0 = xx1 = seg->x0; + } else { +! if (seg->x0 < seg->x1) { +! xSegMin = seg->x0; +! xSegMax = seg->x1; + } else { +! xSegMin = seg->x1; +! xSegMax = seg->x0; + } +! // intersection with top edge +! xx0 = seg->x0 + ((SplashCoord)y - seg->y0) * seg->dxdy; +! // intersection with bottom edge +! xx1 = seg->x0 + ((SplashCoord)y + 1 - seg->y0) * seg->dxdy; +! // the segment may not actually extend to the top and/or bottom edges +! if (xx0 < xSegMin) { +! xx0 = xSegMin; +! } else if (xx0 > xSegMax) { +! xx0 = xSegMax; +! } +! if (xx1 < xSegMin) { +! xx1 = xSegMin; +! } else if (xx1 > xSegMax) { +! xx1 = xSegMax; + } + } + if (xx0 < xx1) {
participants (1)
-
crux＠crux.nu