This patch came from https://git.ghostscript.com/?p=mupdf.git;a=patch;h=cee7cefc610d42fd383b3c80c12cbc675443176a and fixes CVE-2021-3407. From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001 From: Robin Watts Date: Fri, 22 Jan 2021 17:05:15 +0000 Subject: [PATCH] Bug 703366: Fix double free of object during linearization. This appears to happen because we parse an illegal object from a broken file and assign it to object 0, which is defined to be free. Here, we fix the parsing code so this can't happen. --- source/pdf/pdf-parse.c | 6 ++++++ source/pdf/pdf-xref.c | 2 ++ 2 files changed, 8 insertions(+) diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c index 7abc8c3d4..5761c3351 100644 --- a/source/pdf/pdf-parse.c +++ b/source/pdf/pdf-parse.c @@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc, fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num); } gen = buf->i; + if (gen < 0 || gen >= 65536) + { + if (try_repair) + *try_repair = 1; + fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen); + } tok = pdf_lex(ctx, file, buf); if (tok != PDF_TOK_OBJ) diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 1b2bdcd59..30197b4b8 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) { ofs = fz_tell(ctx, doc->file); trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL); + if (num == 0) + fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n"); } fz_catch(ctx) { -- 2.17.1 ct name='qt'>
path: root/gnu/packages/toys.scm
AgeCommit message (Expand)Author
2024-02-22gnu: Add xfishtank....* gnu/packages/toys.scm (xfishtank): New variable. Reviewed-by: Greg Hogan <code@greghogan.com> Reviewed-by: Steve George <steve@futurile.net> Signed-off-by: Nicolas Goaziou <mail@nicolasgoaziou.fr> Change-Id: I490fba2d9ded274266d6376adf67c39bf5c9744a Sarthak Shah
2024-02-22gnu: Add xpenguins....* gnu/packages/toys.scm (xpenguins): New variable. Reviewed-by: Greg Hogan <code@greghogan.com> Reviewed-by: Steve George <steve@futurile.net> Signed-off-by: Nicolas Goaziou <mail@nicolasgoaziou.fr> Change-Id: I6262092da4d51abaca1d6f01ec2e3f27baca7a01 Sarthak Shah
2024-02-05gnu: xsnow: Update to 3.7.7....* gnu/packages/toys.scm (xsnow): Update to 3.7.7. [inputs]: Add gsl and move gtk+ to ... [propagated-inputs]: ... here and add gdk-pixbuf. Change-Id: I45ba6bffc670180ffd713bc098513e5d4cd3dc23 Signed-off-by: Ludovic Courtès <ludo@gnu.org> Greg Hogan
2023-11-25gnu: daikichi: Fix cross-compilation....* gnu/packages/textutils.scm (daikichi): Fix cross-compilation. [inputs]: Add diffutils. Change-Id: I7e46a3f61a869c10f3491e1397232125ccf76149 Signed-off-by: Mathieu Othacehe <othacehe@gnu.org> Zheng Junjie