import UBI poppler-20.11.0-12.el8_10

SOURCES/poppler-20.11.0-XRef-check-isDict.patch

@@ -0,0 +1,21 @@
+From dcd5bd8238ea448addd102ff045badd0aca1b990 Mon Sep 17 00:00:00 2001
+From: crt <chluo@cse.cuhk.edu.hk>
+Date: Wed, 27 Jul 2022 08:40:02 +0000
+Subject: pdfseparate: Check XRef's Catalog for being a Dict
+
+
+diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
+index 351140af..c26a41c4 100644
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -886,6 +886,10 @@ int PDFDoc::savePageAs(const GooString &name, int pageNo)
+ 
+     // get and mark output intents etc.
+     Object catObj = getXRef()->getCatalog();
++    if (!catObj.isDict()) {
++        error(errSyntaxError, -1, "XRef's Catelog is not a dictionary");
++        return errOpenFile;
++    }
+     Dict *catDict = catObj.getDict();
+     Object pagesObj = catDict->lookup("Pages");
+     Object afObj = catDict->lookupNF("AcroForm").copy();

SOURCES/poppler-20.11.0-check-isDict.patch

@@ -0,0 +1,34 @@
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -1757,6 +1757,9 @@ void PDFDoc::replacePageDict(int pageNo,
+ {
+     Ref *refPage = getCatalog()->getPageRef(pageNo);
+     Object page = getXRef()->fetch(*refPage);
++    if (!page.isDict()) {
++        return;
++    }
+     Dict *pageDict = page.getDict();
+     pageDict->remove("MediaBoxssdf");
+     pageDict->remove("MediaBox");
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -293,9 +293,18 @@ int main(int argc, char *argv[])
+             const PDFRectangle *cropBox = nullptr;
+             if (docs[i]->getCatalog()->getPage(j)->isCropped())
+                 cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
+-            docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+             Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
+             Object page = docs[i]->getXRef()->fetch(*refPage);
++            if (!page.isDict()) {
++                fclose(f);
++                delete yRef;
++                delete countRef;
++                delete outStr;
++                error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
++                return -1;
++            } else {
++              docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
++            }
+             Dict *pageDict = page.getDict();
+             Object *resDict = docs[i]->getCatalog()->getPage(j)->getResourceDictObject();
+             if (resDict->isDict()) {

SOURCES/poppler-20.11.0-fix-crash-in-FoFiType1C.patch

@@ -0,0 +1,45 @@
+From 3cc28b66132e66ed2dfe13a9a285ac41ac7267d5 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Wed, 23 Dec 2020 23:27:02 +0100
+Subject: [PATCH] FoFiType1C: Fix crashes with broken files
+
+---
+ fofi/FoFiType1C.cc | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fofi/FoFiType1C.cc b/fofi/FoFiType1C.cc
+index 0387b0a87..4c2e9a770 100644
+--- a/fofi/FoFiType1C.cc
++++ b/fofi/FoFiType1C.cc
+@@ -194,7 +194,6 @@ void FoFiType1C::convertToType1(const char *psName, const char **newEncoding, bo
+     Type1CIndexVal val;
+     GooString *buf;
+     char buf2[256];
+-    const char **enc;
+     bool ok;
+     int i;
+ 
+@@ -299,9 +298,9 @@ void FoFiType1C::convertToType1(const char *psName, const char **newEncoding, bo
+     } else {
+         (*outputFunc)(outputStream, "256 array\n", 10);
+         (*outputFunc)(outputStream, "0 1 255 {1 index exch /.notdef put} for\n", 40);
+-        enc = newEncoding ? newEncoding : (const char **)encoding;
++        const char **enc = newEncoding ? newEncoding : (const char **)encoding;
+         for (i = 0; i < 256; ++i) {
+-            if (enc[i]) {
++            if (enc && enc[i]) {
+                 buf = GooString::format("dup {0:d} /{1:s} put\n", i, enc[i]);
+                 (*outputFunc)(outputStream, buf->c_str(), buf->getLength());
+                 delete buf;
+@@ -1945,7 +1944,7 @@ bool FoFiType1C::parse()
+             readPrivateDict(0, 0, &privateDicts[0]);
+         } else {
+             getIndex(topDict.fdArrayOffset, &fdIdx, &parsedOk);
+-            if (!parsedOk) {
++            if (!parsedOk || fdIdx.len <= 0) {
+                 return false;
+             }
+             nFDs = fdIdx.len;
+-- 
+GitLab
+

SOURCES/poppler-20.11.0-pdfinfo-dests.patch

@@ -0,0 +1,110 @@
+From 0554731052d1a97745cb179ab0d45620589dd9c4 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Fri, 7 Jun 2024 00:54:55 +0200
+Subject: pdfinfo: Fix crash in broken documents when using -dests
+
+Modified by Marek Kasik due to the backport.
+
+diff --git a/utils/pdfinfo.cc b/utils/pdfinfo.cc
+index 5d37ef64..7d569749 100644
+--- a/utils/pdfinfo.cc
++++ b/utils/pdfinfo.cc
+@@ -15,7 +15,7 @@
+ // under GPL version 2 or later
+ //
+ // Copyright (C) 2006 Dom Lachowicz <cinamod@hotmail.com>
+-// Copyright (C) 2007-2010, 2012, 2016-2020 Albert Astals Cid <aacid@kde.org>
++// Copyright (C) 2007-2010, 2012, 2016-2020, 2024 Albert Astals Cid <aacid@kde.org>
+ // Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
+ // Copyright (C) 2011 Vittal Aithal <vittal.aithal@cognidox.com>
+ // Copyright (C) 2012, 2013, 2016-2018 Adrian Johnson <ajohnson@redneon.com>
+@@ -107,6 +107,23 @@ static const ArgDesc argDesc[] = { { "-f
+                                    { "-?", argFlag, &printHelp, 0, "print usage information" },
+                                    {} };
+ 
++static void printStdTextString(const std::string &s, const UnicodeMap *uMap)
++{
++    char buf[8];
++    Unicode *u;
++    int i, len;
++    GooString *s1 = new GooString(s);
++
++    if (s1 != nullptr) {
++        len = TextStringToUCS4(s1, &u);
++        for (i = 0; i < len; i++) {
++            int n = uMap->mapUnicode(u[i], buf, sizeof(buf));
++            fwrite(buf, 1, n, stdout);
++        }
++        delete s1;
++    }
++}
++
+ static void printInfoString(Dict *infoDict, const char *key, const char *text, const UnicodeMap *uMap)
+ {
+     const GooString *s1;
+@@ -278,11 +295,6 @@ static void printStruct(const StructElem
+     }
+ }
+ 
+-struct GooStringCompare
+-{
+-    bool operator()(GooString *lhs, GooString *rhs) const { return lhs->cmp(const_cast<GooString *>(rhs)) < 0; }
+-};
+-
+ static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
+ {
+     GooString s;
+@@ -353,29 +365,25 @@ static void printLinkDest(const std::uni
+ 
+ static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
+ {
+-    std::map<Ref, std::map<GooString *, std::unique_ptr<LinkDest>, GooStringCompare>> map;
++    std::map<Ref, std::map<std::string, std::unique_ptr<LinkDest>>> map;
+ 
+     int numDests = doc->getCatalog()->numDestNameTree();
+     for (int i = 0; i < numDests; i++) {
+-        GooString *name = new GooString(doc->getCatalog()->getDestNameTreeName(i));
++        const GooString *name = doc->getCatalog()->getDestNameTreeName(i);
+         std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestNameTreeDest(i);
+-        if (dest && dest->isPageRef()) {
++        if (name && dest && dest->isPageRef()) {
+             Ref pageRef = dest->getPageRef();
+-            map[pageRef].insert(std::make_pair(name, std::move(dest)));
+-        } else {
+-            delete name;
++            map[pageRef].insert(std::make_pair(name->toStr(), std::move(dest)));
+         }
+     }
+ 
+     numDests = doc->getCatalog()->numDests();
+     for (int i = 0; i < numDests; i++) {
+-        GooString *name = new GooString(doc->getCatalog()->getDestsName(i));
++        const char *name = doc->getCatalog()->getDestsName(i);
+         std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestsDest(i);
+-        if (dest && dest->isPageRef()) {
++        if (name && dest && dest->isPageRef()) {
+             Ref pageRef = dest->getPageRef();
+             map[pageRef].insert(std::make_pair(name, std::move(dest)));
+-        } else {
+-            delete name;
+         }
+     }
+ 
+@@ -389,16 +397,8 @@ static void printDestinations(PDFDoc *do
+                     printf("%4d ", i);
+                     printLinkDest(it.second);
+                     printf(" \"");
+-                    Unicode *u;
+-                    char buf[8];
+-                    const int len = TextStringToUCS4(it.first, &u);
+-                    for (int j = 0; j < len; j++) {
+-                        const int n = uMap->mapUnicode(u[j], buf, sizeof(buf));
+-                        fwrite(buf, 1, n, stdout);
+-                    }
+-                    gfree(u);
++                    printStdTextString(it.first, uMap);
+                     printf("\"\n");
+-                    delete it.first;
+                 }
+             }
+         }

SOURCES/poppler-20.11.0-pdfunite-broken-document.patch

@@ -0,0 +1,48 @@
+From efb68686784f0c58668b7ced990fd173e09346db Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Thu, 18 Aug 2022 23:41:24 +0200
+Subject: pdfunite: Don't crash in broken documents
+
+
+diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
+index 86e75555..a154f40d 100644
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -106,16 +106,21 @@ static void doMergeNameDict(PDFDoc *doc, XRef *srcXRef, XRef *countRef, int oldR
+     }
+ }
+ 
+-static void doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
++static bool doMergeFormDict(Dict *srcFormDict, Dict *mergeFormDict, int numOffset)
+ {
+     Object srcFields = srcFormDict->lookup("Fields");
+     Object mergeFields = mergeFormDict->lookup("Fields");
+     if (srcFields.isArray() && mergeFields.isArray()) {
+         for (int i = 0; i < mergeFields.arrayGetLength(); i++) {
+             const Object &value = mergeFields.arrayGetNF(i);
++            if (!value.isRef()) {
++                error(errSyntaxError, -1, "Fields object is not a Ref.");
++                return false;
++            }
+             srcFields.arrayAdd(Object({ value.getRef().num + numOffset, value.getRef().gen }));
+         }
+     }
++    return true;
+ }
+ 
+ ///////////////////////////////////////////////////////////////////////////
+@@ -332,7 +337,13 @@ int main(int argc, char *argv[])
+             if (afObj.isNull()) {
+                 afObj = pageCatDict->lookupNF("AcroForm").copy();
+             } else if (afObj.isDict()) {
+-                doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset);
++                if (!doMergeFormDict(afObj.getDict(), pageForm.getDict(), numOffset)) {
++                    fclose(f);
++                    delete yRef;
++                    delete countRef;
++                    delete outStr;
++                    return -1;
++                }
+             }
+         }
+         objectsCount += docs[i]->writePageObjects(outStr, yRef, numOffset, true);

SOURCES/poppler-20.11.0-pdfunite-check-isDict.patch

@@ -0,0 +1,41 @@
+From 4631115647c1e4f0482ffe0491c2f38d2231337b Mon Sep 17 00:00:00 2001
+From: crt <chluo@cse.cuhk.edu.hk>
+Date: Fri, 29 Jul 2022 20:51:11 +0000
+Subject: Check isDict before calling getDict
+
+Issue #1276
+
+diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
+index b96b0378..050927d3 100644
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -197,6 +197,14 @@ int main(int argc, char *argv[])
+     Object ocObj;
+     if (docs.size() >= 1) {
+         Object catObj = docs[0]->getXRef()->getCatalog();
++        if(!catObj.isDict()){
++            fclose(f);
++            delete yRef;
++            delete countRef;
++            delete outStr;
++            error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
++            return -1;
++        }
+         Dict *catDict = catObj.getDict();
+         intents = catDict->lookup("OutputIntents");
+         afObj = catDict->lookupNF("AcroForm").copy();
+@@ -295,6 +303,14 @@ int main(int argc, char *argv[])
+             }
+         }
+         Object pageCatObj = docs[i]->getXRef()->getCatalog();
++        if(!pageCatObj.isDict()){
++            fclose(f);
++            delete yRef;
++            delete countRef;
++            delete outStr;
++            error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
++            return -1;
++        }
+         Dict *pageCatDict = pageCatObj.getDict();
+         Object pageNames = pageCatDict->lookup("Names");
+         if (!pageNames.isNull() && pageNames.isDict()) {

SPECS/poppler.spec

@@ -4,7 +4,7 @@
 Summary: PDF rendering library
 Name:    poppler
 Version: 20.11.0
-Release: 6%{?dist}
+Release: 12%{?dist}
 License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
 URL:     http://poppler.freedesktop.org/
 Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@@ -33,6 +33,24 @@ Patch24: poppler-20.11.0-hints.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2124527
 Patch25: poppler-20.11.0-jbig-symbol-overflow.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189815
+Patch26: poppler-20.11.0-pdfunite-broken-document.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189811
+Patch27: poppler-20.11.0-pdfunite-check-isDict.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189814
+Patch28: poppler-20.11.0-check-isDict.patch
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2189810
+Patch29: poppler-20.11.0-XRef-check-isDict.patch
+
+# https://issues.redhat.com/browse/RHEL-4255
+Patch30: poppler-20.11.0-fix-crash-in-FoFiType1C.patch
+
+# https://issues.redhat.com/browse/RHEL-44330
+Patch31: poppler-20.11.0-pdfinfo-dests.patch
+
 BuildRequires: cmake
 BuildRequires: gettext-devel
 BuildRequires: pkgconfig(cairo)
@@ -237,6 +255,32 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
 %{_mandir}/man1/*
 
 %changelog
+* Fri Jul 26 2024 Marek Kasik <mkasik@redhat.com> - 20.11.0-12
+- Fix crash in broken documents when using -dests
+- Fix versions in changelog
+- Resolves: RHEL-44330
+
+* Thu Oct 12 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-11
+- Fix crashes in FoFiType1C
+- Rebuild for inclusion of poppler-glib-doc in CRB
+- Resolves: RHEL-4255, RHEL-4273
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-10
+- Check XRef's Catalog for being a Dict
+- Resolves: #2189816
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-9
+- Check isDict before calling getDict 2
+- Resolves: #2189837
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-8
+- Check isDict before calling getDict
+- Resolves: #2189823
+
+* Fri Jun  9 2023 Marek Kasik <mkasik@redhat.com> - 20.11.0-7
+- Don't crash in broken documents
+- Resolves: #2189844
+
 * Tue Sep 20 2022 Marek Kasik <mkasik@redhat.com> - 20.11.0-6
 - Check for overflow when computing number of symbols
 - in JBIG2 text region