Ignore dict Length if it is broken

Resolves: #1732342
This commit is contained in:
Marek Kasik 2019-07-24 16:33:30 +02:00
parent ad26aced43
commit e2efd8b527
2 changed files with 34 additions and 1 deletions

View File

@ -0,0 +1,26 @@
From 68ef84e5968a4249c2162b839ca6d7975048a557 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Mon, 15 Jul 2019 23:24:22 +0200
Subject: [PATCH] JPXStream::init: ignore dict Length if clearly broken
Fixes issue #805
---
poppler/JPEG2000Stream.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/poppler/JPEG2000Stream.cc b/poppler/JPEG2000Stream.cc
index 0eea3a2d..8e6902f4 100644
--- a/poppler/JPEG2000Stream.cc
+++ b/poppler/JPEG2000Stream.cc
@@ -219,7 +219,7 @@ void JPXStream::init()
}
int bufSize = BUFFER_INITIAL_SIZE;
- if (oLen.isInt()) bufSize = oLen.getInt();
+ if (oLen.isInt() && oLen.getInt() > 0) bufSize = oLen.getInt();
bool indexed = false;
if (cspace.isArray() && cspace.arrayGetLength() > 0) {
--
2.21.0

View File

@ -4,7 +4,7 @@
Summary: PDF rendering library
Name: poppler
Version: 0.73.0
Release: 13%{?dist}
Release: 14%{?dist}
License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
URL: http://poppler.freedesktop.org/
Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@ -53,6 +53,9 @@ Patch17: poppler-0.73.0-clip-aa-line.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1696636
Patch18: poppler-0.73.0-PSOutputDev-buffer-read.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1732340
Patch19: poppler-0.73.0-JPXStream-length.patch
BuildRequires: cmake
BuildRequires: gcc-c++
BuildRequires: gettext-devel
@ -283,6 +286,10 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
%{_mandir}/man1/*
%changelog
* Wed Jul 24 2019 Marek Kasik <mkasik@redhat.com> - 0.73.0-14
- Ignore dict Length if it is broken
- Resolves: #1732342
* Thu May 30 2019 Marek Kasik <mkasik@redhat.com> - 0.73.0-13
- Don't read outside of image buffer in PSOutputDev
- Resolves: #1696640