aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
authorKei Kebreau <kkebreau@posteo.net>2021-03-04 19:43:17 -0500
committerKei Kebreau <kkebreau@posteo.net>2021-03-04 20:12:07 -0500
commit6891f95739c733df217ceaf5d0787cbed380ec1c (patch)
tree96fc985c5f8bcd12995a1db17845db64422a1613 /gnu/packages/patches
parentd5a8e530d794beb0e162a124ea3068887b920556 (diff)
downloadguix-6891f95739c733df217ceaf5d0787cbed380ec1c.tar.gz
guix-6891f95739c733df217ceaf5d0787cbed380ec1c.zip
gnu: mupdf: Fix CVE-2021-3407.
* gnu/packages/pdf.scm (mupdf)[source]: Add patch. * gnu/packages/patches/mupdf-CVE-2021-3407.patch: New file. * gnu/local.mk (dist_patch_DATA): Register it.
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/mupdf-CVE-2021-3407.patch51
1 files changed, 51 insertions, 0 deletions
diff --git a/gnu/packages/patches/mupdf-CVE-2021-3407.patch b/gnu/packages/patches/mupdf-CVE-2021-3407.patch
new file mode 100644
index 0000000000..9f901517c5
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2021-3407.patch
@@ -0,0 +1,51 @@
+This patch came from https://git.ghostscript.com/?p=mupdf.git;a=patch;h=cee7cefc610d42fd383b3c80c12cbc675443176a
+and fixes CVE-2021-3407.
+
+From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001
+From: Robin Watts <Robin.Watts@artifex.com>
+Date: Fri, 22 Jan 2021 17:05:15 +0000
+Subject: [PATCH] Bug 703366: Fix double free of object during linearization.
+
+This appears to happen because we parse an illegal object from
+a broken file and assign it to object 0, which is defined to
+be free.
+
+Here, we fix the parsing code so this can't happen.
+---
+ source/pdf/pdf-parse.c | 6 ++++++
+ source/pdf/pdf-xref.c | 2 ++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
+index 7abc8c3d4..5761c3351 100644
+--- a/source/pdf/pdf-parse.c
++++ b/source/pdf/pdf-parse.c
+@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
+ fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
+ }
+ gen = buf->i;
++ if (gen < 0 || gen >= 65536)
++ {
++ if (try_repair)
++ *try_repair = 1;
++ fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
++ }
+
+ tok = pdf_lex(ctx, file, buf);
+ if (tok != PDF_TOK_OBJ)
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 1b2bdcd59..30197b4b8 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
+ {
+ ofs = fz_tell(ctx, doc->file);
+ trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
++ if (num == 0)
++ fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
+ }
+ fz_catch(ctx)
+ {
+--
+2.17.1
+