Compare commits

..

7 Commits

Author SHA1 Message Date
1c4bc968ab import UBI poppler-20.11.0-12.el8_10 2024-08-13 19:17:33 +00:00
f1d6121e20 import UBI poppler-20.11.0-11.el8 2024-05-22 14:28:19 +00:00
eabdullin
31db69a74b import UBI poppler-20.11.0-10.el8 2023-11-15 04:47:51 +00:00
CentOS Sources
7e2a60060d import poppler-20.11.0-6.el8 2023-05-16 07:07:21 +00:00
CentOS Sources
1042e88d22 import poppler-20.11.0-5.el8 2022-11-08 14:34:42 +00:00
CentOS Sources
a950d5051b import poppler-20.11.0-4.el8 2022-05-10 06:59:09 +00:00
CentOS Sources
635d339c96 import poppler-20.11.0-3.el8_5.1 2021-12-21 09:12:45 +00:00
10 changed files with 486 additions and 1 deletions

View File

@ -0,0 +1,21 @@
From dcd5bd8238ea448addd102ff045badd0aca1b990 Mon Sep 17 00:00:00 2001
From: crt <chluo@cse.cuhk.edu.hk>
Date: Wed, 27 Jul 2022 08:40:02 +0000
Subject: pdfseparate: Check XRef's Catalog for being a Dict
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index 351140af..c26a41c4 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -886,6 +886,10 @@ int PDFDoc::savePageAs(const GooString &name, int pageNo)
// get and mark output intents etc.
Object catObj = getXRef()->getCatalog();
+ if (!catObj.isDict()) {
+ error(errSyntaxError, -1, "XRef's Catelog is not a dictionary");
+ return errOpenFile;
+ }
Dict *catDict = catObj.getDict();
Object pagesObj = catDict->lookup("Pages");
Object afObj = catDict->lookupNF("AcroForm").copy();

View File

@ -0,0 +1,35 @@
From 4f478daa6a9734b8f269a6586bdce2909844bb6f Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Wed, 23 Dec 2020 23:52:58 +0100
Subject: Fix opening files by some generators that are a bit broken
But Adobe opens it and it's easy to fix
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 66d3f04a..c36c747a 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -45,6 +45,7 @@
#include <cctype>
#include <climits>
#include <cfloat>
+#include <limits>
#include "goo/gfile.h"
#include "goo/gmem.h"
#include "Object.h"
@@ -793,8 +794,13 @@ bool XRef::readXRefStreamSection(Stream *xrefStr, const int *w, int first, int n
gen = (gen << 8) + c;
}
if (gen > INT_MAX) {
- error(errSyntaxError, -1, "Gen inside xref table too large (bigger than INT_MAX)");
- return false;
+ if (i == 0 && gen == std::numeric_limits<uint32_t>::max()) {
+ // workaround broken generators
+ gen = 65535;
+ } else {
+ error(errSyntaxError, -1, "Gen inside xref table too large (bigger than INT_MAX)");
+ return false;
+ }
}
if (entries[i].offset == -1) {
switch (type) {

View File

@ -0,0 +1,34 @@
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -1757,6 +1757,9 @@ void PDFDoc::replacePageDict(int pageNo,
{
Ref *refPage = getCatalog()->getPageRef(pageNo);
Object page = getXRef()->fetch(*refPage);
+ if (!page.isDict()) {
+ return;
+ }
Dict *pageDict = page.getDict();
pageDict->remove("MediaBoxssdf");
pageDict->remove("MediaBox");
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -293,9 +293,18 @@ int main(int argc, char *argv[])
const PDFRectangle *cropBox = nullptr;
if (docs[i]->getCatalog()->getPage(j)->isCropped())
cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
- docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
Object page = docs[i]->getXRef()->fetch(*refPage);
+ if (!page.isDict()) {
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
+ return -1;
+ } else {
+ docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+ }
Dict *pageDict = page.getDict();
Object *resDict = docs[i]->getCatalog()->getPage(j)->getResourceDictObject();
if (resDict->isDict()) {

View File

@ -0,0 +1,45 @@
From 3cc28b66132e66ed2dfe13a9a285ac41ac7267d5 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Wed, 23 Dec 2020 23:27:02 +0100
Subject: [PATCH] FoFiType1C: Fix crashes with broken files
---
fofi/FoFiType1C.cc | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/fofi/FoFiType1C.cc b/fofi/FoFiType1C.cc
index 0387b0a87..4c2e9a770 100644
--- a/fofi/FoFiType1C.cc
+++ b/fofi/FoFiType1C.cc
@@ -194,7 +194,6 @@ void FoFiType1C::convertToType1(const char *psName, const char **newEncoding, bo
Type1CIndexVal val;
GooString *buf;
char buf2[256];
- const char **enc;
bool ok;
int i;
@@ -299,9 +298,9 @@ void FoFiType1C::convertToType1(const char *psName, const char **newEncoding, bo
} else {
(*outputFunc)(outputStream, "256 array\n", 10);
(*outputFunc)(outputStream, "0 1 255 {1 index exch /.notdef put} for\n", 40);
- enc = newEncoding ? newEncoding : (const char **)encoding;
+ const char **enc = newEncoding ? newEncoding : (const char **)encoding;
for (i = 0; i < 256; ++i) {
- if (enc[i]) {
+ if (enc && enc[i]) {
buf = GooString::format("dup {0:d} /{1:s} put\n", i, enc[i]);
(*outputFunc)(outputStream, buf->c_str(), buf->getLength());
delete buf;
@@ -1945,7 +1944,7 @@ bool FoFiType1C::parse()
readPrivateDict(0, 0, &privateDicts[0]);
} else {
getIndex(topDict.fdArrayOffset, &fdIdx, &parsedOk);
- if (!parsedOk) {
+ if (!parsedOk || fdIdx.len <= 0) {
return false;
}
nFDs = fdIdx.len;
--
GitLab

View File

@ -0,0 +1,58 @@
From 81044c64b9ed9a10ae82a28bac753060bdfdac74 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Tue, 15 Mar 2022 15:14:32 +0100
Subject: Hints::readTables: bail out if we run out of file when reading
Fixes #1230
diff --git a/poppler/Hints.cc b/poppler/Hints.cc
index 79f04088..4707e1c6 100644
--- a/poppler/Hints.cc
+++ b/poppler/Hints.cc
@@ -5,7 +5,7 @@
// This file is licensed under the GPLv2 or later
//
// Copyright 2010, 2012 Hib Eris <hib@hiberis.nl>
-// Copyright 2010, 2011, 2013, 2014, 2016-2019 Albert Astals Cid <aacid@kde.org>
+// Copyright 2010, 2011, 2013, 2014, 2016-2019, 2021, 2022 Albert Astals Cid <aacid@kde.org>
// Copyright 2010, 2013 Pino Toscano <pino@kde.org>
// Copyright 2013 Adrian Johnson <ajohnson@redneon.com>
// Copyright 2014 Fabio D'Urso <fabiodurso@hotmail.it>
@@ -189,21 +189,31 @@ void Hints::readTables(BaseStream *str, Linearization *linearization, XRef *xref
char *p = &buf[0];
if (hintsOffset && hintsLength) {
- Stream *s = str->makeSubStream(hintsOffset, false, hintsLength, Object(objNull));
+ std::unique_ptr<Stream> s(str->makeSubStream(hintsOffset, false, hintsLength, Object(objNull)));
s->reset();
for (unsigned int i = 0; i < hintsLength; i++) {
- *p++ = s->getChar();
+ const int c = s->getChar();
+ if (unlikely(c == EOF)) {
+ error(errSyntaxWarning, -1, "Found EOF while reading hints");
+ ok = false;
+ return;
+ }
+ *p++ = c;
}
- delete s;
}
if (hintsOffset2 && hintsLength2) {
- Stream *s = str->makeSubStream(hintsOffset2, false, hintsLength2, Object(objNull));
+ std::unique_ptr<Stream> s(str->makeSubStream(hintsOffset2, false, hintsLength2, Object(objNull)));
s->reset();
for (unsigned int i = 0; i < hintsLength2; i++) {
- *p++ = s->getChar();
+ const int c = s->getChar();
+ if (unlikely(c == EOF)) {
+ error(errSyntaxWarning, -1, "Found EOF while reading hints2");
+ ok = false;
+ return;
+ }
+ *p++ = c;
}
- delete s;
}
MemStream *memStream = new MemStream(&buf[0], 0, bufLength, Object(objNull));

View File

@ -0,0 +1,26 @@
From 27354e9d9696ee2bc063910a6c9a6b27c5184a52 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Thu, 25 Aug 2022 00:14:22 +0200
Subject: JBIG2Stream: Fix crash on broken file
https://github.com/jeffssh/CVE-2021-30860
Thanks to David Warren for the heads up
diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
index 662276e5..9f70431d 100644
--- a/poppler/JBIG2Stream.cc
+++ b/poppler/JBIG2Stream.cc
@@ -1976,7 +1976,11 @@ void JBIG2Stream::readTextRegionSeg(unsigned int segNum, bool imm, bool lossless
for (i = 0; i < nRefSegs; ++i) {
if ((seg = findSegment(refSegs[i]))) {
if (seg->getType() == jbig2SegSymbolDict) {
- numSyms += ((JBIG2SymbolDict *)seg)->getSize();
+ const unsigned int segSize = ((JBIG2SymbolDict *)seg)->getSize();
+ if (unlikely(checkedAdd(numSyms, segSize, &numSyms))) {
+ error(errSyntaxError, getPos(), "Too many symbols in JBIG2 text region");
+ return;
+ }
} else if (seg->getType() == jbig2SegCodeTable) {
codeTables->push_back(seg);
}

View File

@ -0,0 +1,110 @@
From 0554731052d1a97745cb179ab0d45620589dd9c4 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Fri, 7 Jun 2024 00:54:55 +0200
Subject: pdfinfo: Fix crash in broken documents when using -dests
Modified by Marek Kasik due to the backport.
diff --git a/utils/pdfinfo.cc b/utils/pdfinfo.cc
index 5d37ef64..7d569749 100644
--- a/utils/pdfinfo.cc
+++ b/utils/pdfinfo.cc
@@ -15,7 +15,7 @@
// under GPL version 2 or later
//
// Copyright (C) 2006 Dom Lachowicz <cinamod@hotmail.com>
-// Copyright (C) 2007-2010, 2012, 2016-2020 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2007-2010, 2012, 2016-2020, 2024 Albert Astals Cid <aacid@kde.org>
// Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
// Copyright (C) 2011 Vittal Aithal <vittal.aithal@cognidox.com>
// Copyright (C) 2012, 2013, 2016-2018 Adrian Johnson <ajohnson@redneon.com>
@@ -107,6 +107,23 @@ static const ArgDesc argDesc[] = { { "-f
{ "-?", argFlag, &printHelp, 0, "print usage information" },
{} };
+static void printStdTextString(const std::string &s, const UnicodeMap *uMap)
+{
+ char buf[8];
+ Unicode *u;
+ int i, len;
+ GooString *s1 = new GooString(s);
+
+ if (s1 != nullptr) {
+ len = TextStringToUCS4(s1, &u);
+ for (i = 0; i < len; i++) {
+ int n = uMap->mapUnicode(u[i], buf, sizeof(buf));
+ fwrite(buf, 1, n, stdout);
+ }
+ delete s1;
+ }
+}
+
static void printInfoString(Dict *infoDict, const char *key, const char *text, const UnicodeMap *uMap)
{
const GooString *s1;
@@ -278,11 +295,6 @@ static void printStruct(const StructElem
}
}
-struct GooStringCompare
-{
- bool operator()(GooString *lhs, GooString *rhs) const { return lhs->cmp(const_cast<GooString *>(rhs)) < 0; }
-};
-
static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
{
GooString s;
@@ -353,29 +365,25 @@ static void printLinkDest(const std::uni
static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
{
- std::map<Ref, std::map<GooString *, std::unique_ptr<LinkDest>, GooStringCompare>> map;
+ std::map<Ref, std::map<std::string, std::unique_ptr<LinkDest>>> map;
int numDests = doc->getCatalog()->numDestNameTree();
for (int i = 0; i < numDests; i++) {
- GooString *name = new GooString(doc->getCatalog()->getDestNameTreeName(i));
+ const GooString *name = doc->getCatalog()->getDestNameTreeName(i);
std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestNameTreeDest(i);
- if (dest && dest->isPageRef()) {
+ if (name && dest && dest->isPageRef()) {
Ref pageRef = dest->getPageRef();
- map[pageRef].insert(std::make_pair(name, std::move(dest)));
- } else {
- delete name;
+ map[pageRef].insert(std::make_pair(name->toStr(), std::move(dest)));
}
}
numDests = doc->getCatalog()->numDests();
for (int i = 0; i < numDests; i++) {
- GooString *name = new GooString(doc->getCatalog()->getDestsName(i));
+ const char *name = doc->getCatalog()->getDestsName(i);
std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestsDest(i);
- if (dest && dest->isPageRef()) {
+ if (name && dest && dest->isPageRef()) {
Ref pageRef = dest->getPageRef();
map[pageRef].insert(std::make_pair(name, std::move(dest)));
- } else {
- delete name;
}
}
@@ -389,16 +397,8 @@ static void printDestinations(PDFDoc *do
printf("%4d ", i);
printLinkDest(it.second);
printf(" \"");
- Unicode *u;
- char buf[8];
- const int len = TextStringToUCS4(it.first, &u);
- for (int j = 0; j < len; j++) {
- const int n = uMap->mapUnicode(u[j], buf, sizeof(buf));
- fwrite(buf, 1, n, stdout);
- }
- gfree(u);
+ printStdTextString(it.first, uMap);
printf("\"\n");
- delete it.first;
}
}
}

View File

@ -0,0 +1,48 @@
From efb68686784f0c58668b7ced990fd173e09346db Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Thu, 18 Aug 2022 23:41:24 +0200
Subject: pdfunite: Don't crash in broken documents
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
index 86e75555..a154f40d 100644
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -106,16 +106,21 @@ static void doMergeNameDict(PDFDoc *doc, XRef *srcXRef, XRef *countRef, int oldR
}
}
-static void doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
+static bool doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
{
Object srcFields = srcFormDict->lookup("Fields");
Object mergeFields = mergeFormDict->lookup("Fields");
if (srcFields.isArray() && mergeFields.isArray()) {
for (int i = 0; i < mergeFields.arrayGetLength(); i++) {
const Object &value = mergeFields.arrayGetNF(i);
+ if (!value.isRef()) {
+ error(errSyntaxError, -1, "Fields object is not a Ref.");
+ return false;
+ }
srcFields.arrayAdd(Object({ value.getRef().num + numOffset, value.getRef().gen }));
}
}
+ return true;
}
///////////////////////////////////////////////////////////////////////////
@@ -332,7 +337,13 @@ int main(int argc, char *argv[])
if (afObj.isNull()) {
afObj = pageCatDict->lookupNF("AcroForm").copy();
} else if (afObj.isDict()) {
- doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset);
+ if (!doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset)) {
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ return -1;
+ }
}
}
objectsCount += docs[i]->writePageObjects(outStr, yRef, numOffset, true);

View File

@ -0,0 +1,41 @@
From 4631115647c1e4f0482ffe0491c2f38d2231337b Mon Sep 17 00:00:00 2001
From: crt <chluo@cse.cuhk.edu.hk>
Date: Fri, 29 Jul 2022 20:51:11 +0000
Subject: Check isDict before calling getDict
Issue #1276
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
index b96b0378..050927d3 100644
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -197,6 +197,14 @@ int main(int argc, char *argv[])
Object ocObj;
if (docs.size() >= 1) {
Object catObj = docs[0]->getXRef()->getCatalog();
+ if(!catObj.isDict()){
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
+ return -1;
+ }
Dict *catDict = catObj.getDict();
intents = catDict->lookup("OutputIntents");
afObj = catDict->lookupNF("AcroForm").copy();
@@ -295,6 +303,14 @@ int main(int argc, char *argv[])
}
}
Object pageCatObj = docs[i]->getXRef()->getCatalog();
+ if(!pageCatObj.isDict()){
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
+ return -1;
+ }
Dict *pageCatDict = pageCatObj.getDict();
Object pageNames = pageCatDict->lookup("Names");
if (!pageNames.isNull() && pageNames.isDict()) {

View File

@ -4,7 +4,7 @@
Summary: PDF rendering library
Name: poppler
Version: 20.11.0
Release: 3%{?dist}
Release: 12%{?dist}
License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
URL: http://poppler.freedesktop.org/
Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@ -24,6 +24,33 @@ Patch21: poppler-0.66.0-nss.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1981108
Patch22: poppler-20.11.0-check-gdatetime.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2002575
Patch23: poppler-20.11.0-bad-generation.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2087190
Patch24: poppler-20.11.0-hints.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2124527
Patch25: poppler-20.11.0-jbig-symbol-overflow.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2189815
Patch26: poppler-20.11.0-pdfunite-broken-document.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2189811
Patch27: poppler-20.11.0-pdfunite-check-isDict.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2189814
Patch28: poppler-20.11.0-check-isDict.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2189810
Patch29: poppler-20.11.0-XRef-check-isDict.patch
# https://issues.redhat.com/browse/RHEL-4255
Patch30: poppler-20.11.0-fix-crash-in-FoFiType1C.patch
# https://issues.redhat.com/browse/RHEL-44330
Patch31: poppler-20.11.0-pdfinfo-dests.patch
BuildRequires: cmake
BuildRequires: gettext-devel
BuildRequires: pkgconfig(cairo)
@ -228,6 +255,46 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
%{_mandir}/man1/*
%changelog
* Fri Jul 26 2024 Marek Kasik <mkasik@redhat.com> - 20.11.0-12
- Fix crash in broken documents when using -dests
- Fix versions in changelog
- Resolves: RHEL-44330
* Thu Oct 12 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-11
- Fix crashes in FoFiType1C
- Rebuild for inclusion of poppler-glib-doc in CRB
- Resolves: RHEL-4255, RHEL-4273
* Fri Jun 9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-10
- Check XRef's Catalog for being a Dict
- Resolves: #2189816
* Fri Jun 9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-9
- Check isDict before calling getDict 2
- Resolves: #2189837
* Fri Jun 9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-8
- Check isDict before calling getDict
- Resolves: #2189823
* Fri Jun 9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-7
- Don't crash in broken documents
- Resolves: #2189844
* Tue Sep 20 2022 Marek Kasik <mkasik@redhat.com> - 20.11.0-6
- Check for overflow when computing number of symbols
- in JBIG2 text region
- Resolves: #2126361
* Fri Jun 17 2022 Marek Kasik <mkasik@redhat.com> - 20.11.0-5
- Don't run out of file for Hints
- Rebuild for #2096452
- Resolves: #2090969, #2096452
* Thu Sep 9 2021 Marek Kasik <mkasik@redhat.com> - 20.11.0-4
- Fix opening files with streams with wrong generations
- Resolves: #2002575
* Wed Aug 4 2021 Marek Kasik <mkasik@redhat.com> - 20.11.0-3
- Fix crash when processing dates of embedded files
- Resolves: #1981108