rpms/poppler
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Security bugfixes

Browse Source 
Add poppler-0.15.0-CVE-2010-3702.patch
  (Properly initialize parser)
Add poppler-0.15.0-CVE-2010-3703.patch
  (Properly initialize stack)
Add poppler-0.15.0-CVE-2010-3704.patch
  (Fix crash in broken pdf (code < 0))
Resolves: #639861
This commit is contained in:
Marek Kasik 2010-10-07 14:58:41 +02:00
parent affa15d361
commit b99c78bb0f
4 changed files with 80 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
poppler-0.15.0-CVE-2010-3702.patch Normal file
View File

@ -0,0 +1,18 @@
--- poppler-0.15.0/poppler/Gfx.cc 2010-09-12 23:44:11.000000000 +0200
+++ poppler-0.15.0/poppler/Gfx.cc 2010-10-07 12:44:51.000000000 +0200
@@ -536,6 +536,7 @@ Gfx::Gfx(XRef *xrefA, OutputDev *outA, i
drawText = gFalse;
maskHaveCSPattern = gFalse;
mcStack = NULL;
+ parser = NULL;
// start the resource stack
res = new GfxResources(xref, resDict, NULL);
@@ -590,6 +591,7 @@ Gfx::Gfx(XRef *xrefA, OutputDev *outA, D
drawText = gFalse;
maskHaveCSPattern = gFalse;
mcStack = NULL;
+ parser = NULL;
// start the resource stack
res = new GfxResources(xref, resDict, NULL);

10
poppler-0.15.0-CVE-2010-3703.patch Normal file
View File

@ -0,0 +1,10 @@
--- poppler-0.15.0/poppler/Function.cc 2010-07-24 01:18:28.000000000 +0200
+++ poppler-0.15.0/poppler/Function.cc 2010-10-07 12:44:51.000000000 +0200
@@ -1108,6 +1108,7 @@ PostScriptFunction::PostScriptFunction(O
code = NULL;
codeString = NULL;
codeSize = 0;
+ stack = NULL;
ok = gFalse;
cache = new PopplerCache(5);

28
poppler-0.15.0-CVE-2010-3704.patch Normal file
View File

@ -0,0 +1,28 @@
--- poppler-0.15.0/fofi/FoFiType1.cc 2010-07-24 01:18:27.000000000 +0200
+++ poppler-0.15.0/fofi/FoFiType1.cc 2010-10-07 12:44:51.000000000 +0200
@@ -13,7 +13,7 @@
// All changes made under the Poppler project to this file are licensed
// under GPL version 2 or later
//
-// Copyright (C) 2005, 2008 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2005, 2008, 2010 Albert Astals Cid <aacid@kde.org>
// Copyright (C) 2005 Kristian Høgsberg <krh@redhat.com>
// Copyright (C) 2010 Jakub Wilk <ubanus@users.sf.net>
//
@@ -31,6 +31,7 @@
#include <stdlib.h>
#include <string.h>
#include "goo/gmem.h"
+#include "goo/GooLikely.h"
#include "FoFiEncodings.h"
#include "FoFiType1.h"
#include "poppler/Error.h"
@@ -243,7 +244,7 @@ void FoFiType1::parse() {
code = code * 8 + (*p2 - '0');
}
}
- if (code < 256) {
+ if (likely(code < 256 && code >= 0)) {
for (p = p2; *p == ' ' || *p == '\t'; ++p) ;
if (*p == '/') {
++p;

27
poppler.spec
View File

@ -2,7 +2,7 @@
Summary: PDF rendering library
Name: poppler
Version: 0.15.0
Release: 4%{?dist}
Release: 5%{?dist}
License: GPLv2
Group: Development/Libraries
URL: http://poppler.freedesktop.org/
@ -10,9 +10,18 @@ Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.gz
## upstreamable patches
# http://bugzilla.redhat.com/show_bug.cgi?id=480868
Patch104: poppler-0.12.4-annot-appearance.patch
Patch1: poppler-0.12.4-annot-appearance.patch
## upstream patches
# https://bugzilla.redhat.com/show_bug.cgi?id=595245
Patch100: poppler-0.15.0-CVE-2010-3702.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=639356
Patch101: poppler-0.15.0-CVE-2010-3703.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=638960
Patch102: poppler-0.15.0-CVE-2010-3704.patch
Requires: poppler-data >= 0.4.0
BuildRequires: automake libtool
@ -135,7 +144,10 @@ converting PDF files to a number of other formats.
%prep
%setup -q
%patch104 -p1 -b .annot
%patch1 -p1 -b .annot
%patch100 -p1 -b .CVE-2010-3702
%patch101 -p1 -b .CVE-2010-3703
%patch102 -p1 -b .CVE-2010-3704
chmod -x goo/GooTimer.h
@ -249,6 +261,15 @@ rm -fv $RPM_BUILD_ROOT%{_libdir}/lib*.la
%changelog
* Thu Oct 7 2010 Marek Kasik <mkasik@redhat.com> - 0.15.0-5
- Add poppler-0.15.0-CVE-2010-3702.patch
(Properly initialize parser)
- Add poppler-0.15.0-CVE-2010-3703.patch
(Properly initialize stack)
- Add poppler-0.15.0-CVE-2010-3704.patch
(Fix crash in broken pdf (code < 0))
- Resolves: #639861
* Wed Sep 29 2010 jkeating - 0.15.0-4
- Rebuilt for gcc bug 634757