import UBI poppler-20.11.0-11.el8

SOURCES/poppler-20.11.0-XRef-check-isDict.patch

@@ -0,0 +1,21 @@
+From dcd5bd8238ea448addd102ff045badd0aca1b990 Mon Sep 17 00:00:00 2001
+From: crt <chluo@cse.cuhk.edu.hk>
+Date: Wed, 27 Jul 2022 08:40:02 +0000
+Subject: pdfseparate: Check XRef's Catalog for being a Dict
+
+
+diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
+index 351140af..c26a41c4 100644
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -886,6 +886,10 @@ int PDFDoc::savePageAs(const GooString &name, int pageNo)
+ 
+     // get and mark output intents etc.
+     Object catObj = getXRef()->getCatalog();
++    if (!catObj.isDict()) {
++        error(errSyntaxError, -1, "XRef's Catelog is not a dictionary");
++        return errOpenFile;
++    }
+     Dict *catDict = catObj.getDict();
+     Object pagesObj = catDict->lookup("Pages");
+     Object afObj = catDict->lookupNF("AcroForm").copy();

SOURCES/poppler-20.11.0-bad-generation.patch

@@ -0,0 +1,35 @@
+From 4f478daa6a9734b8f269a6586bdce2909844bb6f Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Wed, 23 Dec 2020 23:52:58 +0100
+Subject: Fix opening files by some generators that are a bit broken
+
+But Adobe opens it and it's easy to fix
+
+diff --git a/poppler/XRef.cc b/poppler/XRef.cc
+index 66d3f04a..c36c747a 100644
+--- a/poppler/XRef.cc
++++ b/poppler/XRef.cc
+@@ -45,6 +45,7 @@
+ #include <cctype>
+ #include <climits>
+ #include <cfloat>
++#include <limits>
+ #include "goo/gfile.h"
+ #include "goo/gmem.h"
+ #include "Object.h"
+@@ -793,8 +794,13 @@ bool XRef::readXRefStreamSection(Stream *xrefStr, const int *w, int first, int n
+             gen = (gen << 8) + c;
+         }
+         if (gen > INT_MAX) {
+-            error(errSyntaxError, -1, "Gen inside xref table too large (bigger than INT_MAX)");
+-            return false;
++            if (i == 0 && gen == std::numeric_limits<uint32_t>::max()) {
++                // workaround broken generators
++                gen = 65535;
++            } else {
++                error(errSyntaxError, -1, "Gen inside xref table too large (bigger than INT_MAX)");
++                return false;
++            }
+         }
+         if (entries[i].offset == -1) {
+             switch (type) {

SOURCES/poppler-20.11.0-check-gdatetime.patch

@@ -0,0 +1,30 @@
+--- poppler-20.11.0/glib/poppler-attachment.cc
++++ poppler-20.11.0/glib/poppler-attachment.cc
+@@ -114,17 +114,21 @@ PopplerAttachment *_poppler_attachment_n
+         if (embFile->createDate()) {
+             priv->ctime = _poppler_convert_pdf_date_to_date_time(embFile->createDate());
+             G_GNUC_BEGIN_IGNORE_DEPRECATIONS
+-            /* This will overflow on dates from after 2038. This field is
+-             * deprecated, only kept for backward compatibility. */
+-            attachment->ctime = (GTime)g_date_time_to_unix(priv->ctime);
++            if (priv->ctime != NULL) {
++                /* This will overflow on dates from after 2038. This field is
++                 * deprecated, only kept for backward compatibility. */
++                attachment->ctime = (GTime)g_date_time_to_unix(priv->ctime);
++            }
+             G_GNUC_END_IGNORE_DEPRECATIONS
+         }
+         if (embFile->modDate()) {
+             priv->mtime = _poppler_convert_pdf_date_to_date_time(embFile->modDate());
+             G_GNUC_BEGIN_IGNORE_DEPRECATIONS
+-            /* This will overflow on dates from after 2038. This field is
+-             * deprecated, only kept for backward compatibility. */
+-            attachment->mtime = (GTime)g_date_time_to_unix(priv->mtime);
++            if (priv->mtime != NULL) {
++                /* This will overflow on dates from after 2038. This field is
++                 * deprecated, only kept for backward compatibility. */
++                attachment->mtime = (GTime)g_date_time_to_unix(priv->mtime);
++            }
+             G_GNUC_END_IGNORE_DEPRECATIONS
+         }
+ 

SOURCES/poppler-20.11.0-check-isDict.patch

@@ -0,0 +1,34 @@
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -1757,6 +1757,9 @@ void PDFDoc::replacePageDict(int pageNo,
+ {
+     Ref *refPage = getCatalog()->getPageRef(pageNo);
+     Object page = getXRef()->fetch(*refPage);
++    if (!page.isDict()) {
++        return;
++    }
+     Dict *pageDict = page.getDict();
+     pageDict->remove("MediaBoxssdf");
+     pageDict->remove("MediaBox");
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -293,9 +293,18 @@ int main(int argc, char *argv[])
+             const PDFRectangle *cropBox = nullptr;
+             if (docs[i]->getCatalog()->getPage(j)->isCropped())
+                 cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
+-            docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+             Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
+             Object page = docs[i]->getXRef()->fetch(*refPage);
++            if (!page.isDict()) {
++                fclose(f);
++                delete yRef;
++                delete countRef;
++                delete outStr;
++                error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
++                return -1;
++            } else {
++              docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
++            }
+             Dict *pageDict = page.getDict();
+             Object *resDict = docs[i]->getCatalog()->getPage(j)->getResourceDictObject();
+             if (resDict->isDict()) {

SOURCES/poppler-20.11.0-fix-crash-in-FoFiType1C.patch

@@ -0,0 +1,45 @@
+From 3cc28b66132e66ed2dfe13a9a285ac41ac7267d5 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Wed, 23 Dec 2020 23:27:02 +0100
+Subject: [PATCH] FoFiType1C: Fix crashes with broken files
+
+---
+ fofi/FoFiType1C.cc | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fofi/FoFiType1C.cc b/fofi/FoFiType1C.cc
+index 0387b0a87..4c2e9a770 100644
+--- a/fofi/FoFiType1C.cc
++++ b/fofi/FoFiType1C.cc
+@@ -194,7 +194,6 @@ void FoFiType1C::convertToType1(const char *psName, const char **newEncoding, bo
+     Type1CIndexVal val;
+     GooString *buf;
+     char buf2[256];
+-    const char **enc;
+     bool ok;
+     int i;
+ 
+@@ -299,9 +298,9 @@ void FoFiType1C::convertToType1(const char *psName, const char **newEncoding, bo
+     } else {
+         (*outputFunc)(outputStream, "256 array\n", 10);
+         (*outputFunc)(outputStream, "0 1 255 {1 index exch /.notdef put} for\n", 40);
+-        enc = newEncoding ? newEncoding : (const char **)encoding;
++        const char **enc = newEncoding ? newEncoding : (const char **)encoding;
+         for (i = 0; i < 256; ++i) {
+-            if (enc[i]) {
++            if (enc && enc[i]) {
+                 buf = GooString::format("dup {0:d} /{1:s} put\n", i, enc[i]);
+                 (*outputFunc)(outputStream, buf->c_str(), buf->getLength());
+                 delete buf;
+@@ -1945,7 +1944,7 @@ bool FoFiType1C::parse()
+             readPrivateDict(0, 0, &privateDicts[0]);
+         } else {
+             getIndex(topDict.fdArrayOffset, &fdIdx, &parsedOk);
+-            if (!parsedOk) {
++            if (!parsedOk || fdIdx.len <= 0) {
+                 return false;
+             }
+             nFDs = fdIdx.len;
+-- 
+GitLab
+

SOURCES/poppler-20.11.0-hints.patch

@@ -0,0 +1,58 @@
+From 81044c64b9ed9a10ae82a28bac753060bdfdac74 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Tue, 15 Mar 2022 15:14:32 +0100
+Subject: Hints::readTables: bail out if we run out of file when reading
+
+Fixes #1230
+
+diff --git a/poppler/Hints.cc b/poppler/Hints.cc
+index 79f04088..4707e1c6 100644
+--- a/poppler/Hints.cc
++++ b/poppler/Hints.cc
+@@ -5,7 +5,7 @@
+ // This file is licensed under the GPLv2 or later
+ //
+ // Copyright 2010, 2012 Hib Eris <hib@hiberis.nl>
+-// Copyright 2010, 2011, 2013, 2014, 2016-2019 Albert Astals Cid <aacid@kde.org>
++// Copyright 2010, 2011, 2013, 2014, 2016-2019, 2021, 2022 Albert Astals Cid <aacid@kde.org>
+ // Copyright 2010, 2013 Pino Toscano <pino@kde.org>
+ // Copyright 2013 Adrian Johnson <ajohnson@redneon.com>
+ // Copyright 2014 Fabio D'Urso <fabiodurso@hotmail.it>
+@@ -189,21 +189,31 @@ void Hints::readTables(BaseStream *str, Linearization *linearization, XRef *xref
+     char *p = &buf[0];
+ 
+     if (hintsOffset && hintsLength) {
+-        Stream *s = str->makeSubStream(hintsOffset, false, hintsLength, Object(objNull));
++        std::unique_ptr<Stream> s(str->makeSubStream(hintsOffset, false, hintsLength, Object(objNull)));
+         s->reset();
+         for (unsigned int i = 0; i < hintsLength; i++) {
+-            *p++ = s->getChar();
++            const int c = s->getChar();
++            if (unlikely(c == EOF)) {
++                error(errSyntaxWarning, -1, "Found EOF while reading hints");
++                ok = false;
++                return;
++            }
++            *p++ = c;
+         }
+-        delete s;
+     }
+ 
+     if (hintsOffset2 && hintsLength2) {
+-        Stream *s = str->makeSubStream(hintsOffset2, false, hintsLength2, Object(objNull));
++        std::unique_ptr<Stream> s(str->makeSubStream(hintsOffset2, false, hintsLength2, Object(objNull)));
+         s->reset();
+         for (unsigned int i = 0; i < hintsLength2; i++) {
+-            *p++ = s->getChar();
++            const int c = s->getChar();
++            if (unlikely(c == EOF)) {
++                error(errSyntaxWarning, -1, "Found EOF while reading hints2");
++                ok = false;
++                return;
++            }
++            *p++ = c;
+         }
+-        delete s;
+     }
+ 
+     MemStream *memStream = new MemStream(&buf[0], 0, bufLength, Object(objNull));

SOURCES/poppler-20.11.0-jbig-symbol-overflow.patch

@@ -0,0 +1,26 @@
+From 27354e9d9696ee2bc063910a6c9a6b27c5184a52 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Thu, 25 Aug 2022 00:14:22 +0200
+Subject: JBIG2Stream: Fix crash on broken file
+
+https://github.com/jeffssh/CVE-2021-30860
+
+Thanks to David Warren for the heads up
+
+diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
+index 662276e5..9f70431d 100644
+--- a/poppler/JBIG2Stream.cc
++++ b/poppler/JBIG2Stream.cc
+@@ -1976,7 +1976,11 @@ void JBIG2Stream::readTextRegionSeg(unsigned int segNum, bool imm, bool lossless
+     for (i = 0; i < nRefSegs; ++i) {
+         if ((seg = findSegment(refSegs[i]))) {
+             if (seg->getType() == jbig2SegSymbolDict) {
+-                numSyms += ((JBIG2SymbolDict *)seg)->getSize();
++                const unsigned int segSize = ((JBIG2SymbolDict *)seg)->getSize();
++                if (unlikely(checkedAdd(numSyms, segSize, &numSyms))) {
++                    error(errSyntaxError, getPos(), "Too many symbols in JBIG2 text region");
++                    return;
++                }
+             } else if (seg->getType() == jbig2SegCodeTable) {
+                 codeTables->push_back(seg);
+             }

SOURCES/poppler-20.11.0-pdfunite-broken-document.patch

@@ -0,0 +1,48 @@
+From efb68686784f0c58668b7ced990fd173e09346db Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Thu, 18 Aug 2022 23:41:24 +0200
+Subject: pdfunite: Don't crash in broken documents
+
+
+diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
+index 86e75555..a154f40d 100644
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -106,16 +106,21 @@ static void doMergeNameDict(PDFDoc *doc, XRef *srcXRef, XRef *countRef, int oldR
+     }
+ }
+ 
+-static void doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
++static bool doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
+ {
+     Object srcFields = srcFormDict->lookup("Fields");
+     Object mergeFields = mergeFormDict->lookup("Fields");
+     if (srcFields.isArray() && mergeFields.isArray()) {
+         for (int i = 0; i < mergeFields.arrayGetLength(); i++) {
+             const Object &value = mergeFields.arrayGetNF(i);
++            if (!value.isRef()) {
++                error(errSyntaxError, -1, "Fields object is not a Ref.");
++                return false;
++            }
+             srcFields.arrayAdd(Object({ value.getRef().num + numOffset, value.getRef().gen }));
+         }
+     }
++    return true;
+ }
+ 
+ ///////////////////////////////////////////////////////////////////////////
+@@ -332,7 +337,13 @@ int main(int argc, char *argv[])
+             if (afObj.isNull()) {
+                 afObj = pageCatDict->lookupNF("AcroForm").copy();
+             } else if (afObj.isDict()) {
+-                doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset);
++                if (!doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset)) {
++                    fclose(f);
++                    delete yRef;
++                    delete countRef;
++                    delete outStr;
++                    return -1;
++                }
+             }
+         }
+         objectsCount += docs[i]->writePageObjects(outStr, yRef, numOffset, true);

SOURCES/poppler-20.11.0-pdfunite-check-isDict.patch

@@ -0,0 +1,41 @@
+From 4631115647c1e4f0482ffe0491c2f38d2231337b Mon Sep 17 00:00:00 2001
+From: crt <chluo@cse.cuhk.edu.hk>
+Date: Fri, 29 Jul 2022 20:51:11 +0000
+Subject: Check isDict before calling getDict
+
+Issue #1276
+
+diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
+index b96b0378..050927d3 100644
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -197,6 +197,14 @@ int main(int argc, char *argv[])
+     Object ocObj;
+     if (docs.size() >= 1) {
+         Object catObj = docs[0]->getXRef()->getCatalog();
++        if(!catObj.isDict()){
++            fclose(f);
++            delete yRef;
++            delete countRef;
++            delete outStr;
++            error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
++            return -1;
++        }
+         Dict *catDict = catObj.getDict();
+         intents = catDict->lookup("OutputIntents");
+         afObj = catDict->lookupNF("AcroForm").copy();
+@@ -295,6 +303,14 @@ int main(int argc, char *argv[])
+             }
+         }
+         Object pageCatObj = docs[i]->getXRef()->getCatalog();
++        if(!pageCatObj.isDict()){
++            fclose(f);
++            delete yRef;
++            delete countRef;
++            delete outStr;
++            error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
++            return -1;
++        }
+         Dict *pageCatDict = pageCatObj.getDict();
+         Object pageNames = pageCatDict->lookup("Names");
+         if (!pageNames.isNull() && pageNames.isDict()) {

SPECS/poppler.spec

@@ -4,7 +4,7 @@
 Summary: PDF rendering library
 Name:    poppler
 Version: 20.11.0
-Release: 2%{?dist}
+Release: 11%{?dist}
 License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
 URL:     http://poppler.freedesktop.org/
 Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@@ -21,6 +21,33 @@ Patch4:  poppler-0.66.0-covscan.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1618766
 Patch21: poppler-0.66.0-nss.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1981108
+Patch22: poppler-20.11.0-check-gdatetime.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2002575
+Patch23: poppler-20.11.0-bad-generation.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2087190
+Patch24: poppler-20.11.0-hints.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2124527
+Patch25: poppler-20.11.0-jbig-symbol-overflow.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189815
+Patch26: poppler-20.11.0-pdfunite-broken-document.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189811
+Patch27: poppler-20.11.0-pdfunite-check-isDict.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189814
+Patch28: poppler-20.11.0-check-isDict.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189810
+Patch29: poppler-20.11.0-XRef-check-isDict.patch
+
+# https://issues.redhat.com/browse/RHEL-4255
+Patch30: poppler-20.11.0-fix-crash-in-FoFiType1C.patch
+
 BuildRequires: cmake
 BuildRequires: gettext-devel
 BuildRequires: pkgconfig(cairo)
@@ -225,6 +252,45 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
 %{_mandir}/man1/*
 
 %changelog
+* Thu Oct 12 2023 Marek Kasik <mkasik@redhat.com> - 21.01.0-11
+- Fix crashes in FoFiType1C
+- Rebuild for inclusion of poppler-glib-doc in CRB
+- Resolves: RHEL-4255, RHEL-4273
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 21.01.0-10
+- Check XRef's Catalog for being a Dict
+- Resolves: #2189816
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-9
+- Check isDict before calling getDict 2
+- Resolves: #2189837
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-8
+- Check isDict before calling getDict
+- Resolves: #2189823
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-7
+- Don't crash in broken documents
+- Resolves: #2189844
+
+* Tue Sep 20 2022 Marek Kasik <mkasik@redhat.com> - 20.11.0-6
+- Check for overflow when computing number of symbols
+- in JBIG2 text region
+- Resolves: #2126361
+
+* Fri Jun 17 2022 Marek Kasik <mkasik@redhat.com> - 20.11.0-5
+- Don't run out of file for Hints
+- Rebuild for #2096452
+- Resolves: #2090969, #2096452
+
+* Thu Sep 9 2021 Marek Kasik <mkasik@redhat.com> - 20.11.0-4
+- Fix opening files with streams with wrong generations
+- Resolves: #2002575
+
+* Wed Aug 4 2021 Marek Kasik <mkasik@redhat.com> - 20.11.0-3
+- Fix crash when processing dates of embedded files
+- Resolves: #1981108
+
 * Tue Dec 8 2020 Marek Kasik <mkasik@redhat.com> - 20.11.0-2
 - Improve python3 build dependency
 - Resolves: #1896335