Marek Kasik
parent
59361ebf61
commit
bf9d454415
135
poppler-0.73.0-overlapping-boxes.patch
Normal file
135
poppler-0.73.0-overlapping-boxes.patch
Normal file
@ -0,0 +1,135 @@
|
|||||||
|
From 6a1580e84f492b5671d23be98192267bb73de250 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Marek Kasik <mkasik@redhat.com>
|
||||||
|
Date: Mon, 13 May 2019 15:08:38 +0200
|
||||||
|
Subject: Splash: Restrict filling of overlapping boxes
|
||||||
|
|
||||||
|
Check whether area to fill in Splash::blitTransparent()
|
||||||
|
does not run out of allocated memory for source and for destination
|
||||||
|
and shrink it if needed.
|
||||||
|
|
||||||
|
Fixes #750
|
||||||
|
|
||||||
|
diff --git a/splash/Splash.cc b/splash/Splash.cc
|
||||||
|
index 0a06f9c8..4ac163e4 100644
|
||||||
|
--- a/splash/Splash.cc
|
||||||
|
+++ b/splash/Splash.cc
|
||||||
|
@@ -5851,7 +5851,7 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
int xDest, int yDest, int w, int h) {
|
||||||
|
SplashColorPtr p, sp;
|
||||||
|
unsigned char *q;
|
||||||
|
- int x, y, mask, srcMask;
|
||||||
|
+ int x, y, mask, srcMask, width = w, height = h;
|
||||||
|
|
||||||
|
if (src->mode != bitmap->mode) {
|
||||||
|
return splashErrModeMismatch;
|
||||||
|
@@ -5861,14 +5861,32 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
return splashErrZeroImage;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (src->getWidth() - xSrc < width)
|
||||||
|
+ width = src->getWidth() - xSrc;
|
||||||
|
+
|
||||||
|
+ if (src->getHeight() - ySrc < height)
|
||||||
|
+ height = src->getHeight() - ySrc;
|
||||||
|
+
|
||||||
|
+ if (bitmap->getWidth() - xDest < width)
|
||||||
|
+ width = bitmap->getWidth() - xDest;
|
||||||
|
+
|
||||||
|
+ if (bitmap->getHeight() - yDest < height)
|
||||||
|
+ height = bitmap->getHeight() - yDest;
|
||||||
|
+
|
||||||
|
+ if (width < 0)
|
||||||
|
+ width = 0;
|
||||||
|
+
|
||||||
|
+ if (height < 0)
|
||||||
|
+ height = 0;
|
||||||
|
+
|
||||||
|
switch (bitmap->mode) {
|
||||||
|
case splashModeMono1:
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
p = &bitmap->data[(yDest + y) * bitmap->rowSize + (xDest >> 3)];
|
||||||
|
mask = 0x80 >> (xDest & 7);
|
||||||
|
sp = &src->data[(ySrc + y) * src->rowSize + (xSrc >> 3)];
|
||||||
|
srcMask = 0x80 >> (xSrc & 7);
|
||||||
|
- for (x = 0; x < w; ++x) {
|
||||||
|
+ for (x = 0; x < width; ++x) {
|
||||||
|
if (*sp & srcMask) {
|
||||||
|
*p |= mask;
|
||||||
|
} else {
|
||||||
|
@@ -5886,20 +5904,20 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case splashModeMono8:
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
p = &bitmap->data[(yDest + y) * bitmap->rowSize + xDest];
|
||||||
|
sp = &src->data[(ySrc + y) * bitmap->rowSize + xSrc];
|
||||||
|
- for (x = 0; x < w; ++x) {
|
||||||
|
+ for (x = 0; x < width; ++x) {
|
||||||
|
*p++ = *sp++;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case splashModeRGB8:
|
||||||
|
case splashModeBGR8:
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
p = &bitmap->data[(yDest + y) * bitmap->rowSize + 3 * xDest];
|
||||||
|
sp = &src->data[(ySrc + y) * src->rowSize + 3 * xSrc];
|
||||||
|
- for (x = 0; x < w; ++x) {
|
||||||
|
+ for (x = 0; x < width; ++x) {
|
||||||
|
*p++ = *sp++;
|
||||||
|
*p++ = *sp++;
|
||||||
|
*p++ = *sp++;
|
||||||
|
@@ -5907,10 +5925,10 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case splashModeXBGR8:
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
p = &bitmap->data[(yDest + y) * bitmap->rowSize + 4 * xDest];
|
||||||
|
sp = &src->data[(ySrc + y) * src->rowSize + 4 * xSrc];
|
||||||
|
- for (x = 0; x < w; ++x) {
|
||||||
|
+ for (x = 0; x < width; ++x) {
|
||||||
|
*p++ = *sp++;
|
||||||
|
*p++ = *sp++;
|
||||||
|
*p++ = *sp++;
|
||||||
|
@@ -5921,10 +5939,10 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
break;
|
||||||
|
#ifdef SPLASH_CMYK
|
||||||
|
case splashModeCMYK8:
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
p = &bitmap->data[(yDest + y) * bitmap->rowSize + 4 * xDest];
|
||||||
|
sp = &src->data[(ySrc + y) * src->rowSize + 4 * xSrc];
|
||||||
|
- for (x = 0; x < w; ++x) {
|
||||||
|
+ for (x = 0; x < width; ++x) {
|
||||||
|
*p++ = *sp++;
|
||||||
|
*p++ = *sp++;
|
||||||
|
*p++ = *sp++;
|
||||||
|
@@ -5933,10 +5951,10 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
case splashModeDeviceN8:
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
p = &bitmap->data[(yDest + y) * bitmap->rowSize + (SPOT_NCOMPS+4) * xDest];
|
||||||
|
sp = &src->data[(ySrc + y) * src->rowSize + (SPOT_NCOMPS+4) * xSrc];
|
||||||
|
- for (x = 0; x < w; ++x) {
|
||||||
|
+ for (x = 0; x < width; ++x) {
|
||||||
|
for (int cp=0; cp < SPOT_NCOMPS+4; cp++)
|
||||||
|
*p++ = *sp++;
|
||||||
|
}
|
||||||
|
@@ -5946,9 +5964,9 @@ SplashError Splash::blitTransparent(SplashBitmap *src, int xSrc, int ySrc,
|
||||||
|
}
|
||||||
|
|
||||||
|
if (bitmap->alpha) {
|
||||||
|
- for (y = 0; y < h; ++y) {
|
||||||
|
+ for (y = 0; y < height; ++y) {
|
||||||
|
q = &bitmap->alpha[(yDest + y) * bitmap->width + xDest];
|
||||||
|
- memset(q, 0x00, w);
|
||||||
|
+ memset(q, 0x00, width);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
@ -4,7 +4,7 @@
|
|||||||
Summary: PDF rendering library
|
Summary: PDF rendering library
|
||||||
Name: poppler
|
Name: poppler
|
||||||
Version: 0.73.0
|
Version: 0.73.0
|
||||||
Release: 10%{?dist}
|
Release: 11%{?dist}
|
||||||
License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
|
License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
|
||||||
URL: http://poppler.freedesktop.org/
|
URL: http://poppler.freedesktop.org/
|
||||||
Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
|
Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
|
||||||
@ -44,6 +44,9 @@ Patch14: poppler-0.73.0-scan-fonts.patch
|
|||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1713582
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1713582
|
||||||
Patch15: poppler-0.73.0-jpeg2000-component-size.patch
|
Patch15: poppler-0.73.0-jpeg2000-component-size.patch
|
||||||
|
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1696638
|
||||||
|
Patch16: poppler-0.73.0-overlapping-boxes.patch
|
||||||
|
|
||||||
BuildRequires: cmake
|
BuildRequires: cmake
|
||||||
BuildRequires: gcc-c++
|
BuildRequires: gcc-c++
|
||||||
BuildRequires: gettext-devel
|
BuildRequires: gettext-devel
|
||||||
@ -274,6 +277,10 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
|
|||||||
%{_mandir}/man1/*
|
%{_mandir}/man1/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu May 30 2019 Marek Kasik <mkasik@redhat.com> - 0.73.0-11
|
||||||
|
- Restrict filling of overlapping boxes in Splash
|
||||||
|
- Resolves: #1696640
|
||||||
|
|
||||||
* Wed May 29 2019 Marek Kasik <mkasik@redhat.com> - 0.73.0-10
|
* Wed May 29 2019 Marek Kasik <mkasik@redhat.com> - 0.73.0-10
|
||||||
- Fail gracefully if not all components of JPEG2000Stream
|
- Fail gracefully if not all components of JPEG2000Stream
|
||||||
- have the same size
|
- have the same size
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user