diff --git a/poppler-0.73.0-check-catalog-is-dict.patch b/poppler-0.73.0-check-catalog-is-dict.patch new file mode 100644 index 0000000..f4b86eb --- /dev/null +++ b/poppler-0.73.0-check-catalog-is-dict.patch @@ -0,0 +1,27 @@ +diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc +index 61613f60..462fb00c 100644 +--- a/utils/pdfunite.cc ++++ b/utils/pdfunite.cc +@@ -165,7 +165,7 @@ int main (int argc, char *argv[]) + for (i = 1; i < argc - 1; i++) { + GooString *gfileName = new GooString(argv[i]); + PDFDoc *doc = new PDFDoc(gfileName, nullptr, nullptr, nullptr); +- if (doc->isOk() && !doc->isEncrypted()) { ++ if (doc->isOk() && !doc->isEncrypted() && doc->getXRef()->getCatalog().isDict()) { + docs.push_back(doc); + if (doc->getPDFMajorVersion() > majorVersion) { + majorVersion = doc->getPDFMajorVersion(); +@@ -175,9 +175,12 @@ int main (int argc, char *argv[]) + minorVersion = doc->getPDFMinorVersion(); + } + } +- } else if (doc->isOk()) { ++ } else if (doc->isEncrypted()) { + error(errUnimplemented, -1, "Could not merge encrypted files ('{0:s}')", argv[i]); + return -1; ++ } else if (!doc->getXRef()->getCatalog().isDict()) { ++ error(errSyntaxError, -1, "Catalog is not a dictionary ('{0:s}')", argv[i]); ++ return -1; + } else { + error(errSyntaxError, -1, "Could not merge damaged documents ('{0:s}')", argv[i]); + return -1; diff --git a/poppler.spec b/poppler.spec index a7e2f23..436d968 100644 --- a/poppler.spec +++ b/poppler.spec @@ -4,7 +4,7 @@ Summary: PDF rendering library Name: poppler Version: 0.73.0 -Release: 3%{?dist} +Release: 4%{?dist} License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT URL: http://poppler.freedesktop.org/ Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz @@ -25,6 +25,9 @@ Patch7: poppler-0.67.0-qt4-const.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1672419 Patch8: poppler-0.73.0-negative-xref-indices.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1665273 +Patch9: poppler-0.73.0-check-catalog-is-dict.patch + BuildRequires: cmake BuildRequires: gcc-c++ BuildRequires: gettext-devel @@ -255,6 +258,10 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}" %{_mandir}/man1/* %changelog +* Wed Feb 20 2019 Marek Kasik - 0.73.0-4 +- Check Catalog from XRef for being a Dict +- Resolves: #1665274 + * Wed Feb 20 2019 Marek Kasik - 0.73.0-3 - Defend against requests for negative XRef indices - Resolves: #1672420