Raw OCR Engine
35ba96cfab
Security fixes backported from upstream tesseract 5.5.3-2.fc44
(Sandro Mani). All patches are upstream GitHub commits adapted
from 5.3.4 to 4.1.1, accounting for autotools build, C-style
memory management ('Emalloc'/'Efree'/'free'), 'STRING' type
instead of 'std::string', 'TessResultCallback2' instead of
'std::function', and C-style free functions instead of C++
destructors.
CVE-2026-88047 (upstream 1bda5079): stack buffer overflow in
'ReadNormProtos' unichar extraction.
Adapted: stripped 'Makefile.am' and 'unittest/CMakeLists.txt'
hunks. The 'src/classify/normmatch.cpp' fix applied cleanly.
CVE-2026-88048 (upstream 103dc134): 'FullyConnected' weight
matrix dimension validation at load.
Applied cleanly — no adaptation needed.
CVE-2026-88049 (upstream b494ac18): LSTM gate matrix dimension
validation against 'na_'/'no_' at load.
Applied cleanly — no adaptation needed.
CVE-2026-88051 (upstream 56e09ca1): 'GenericVector::read' heap
out-of-bounds on callback form.
Adapted: stripped 'Makefile.am' hunks (line offset mismatch).
The 'src/ccutil/genericvector.h' fix applied cleanly.
CVE-2026-88052 (upstream 2d04d640): 'UNICHARSET::load_via_fgets'
desync id validation.
Applied cleanly — no adaptation needed.
CVE-2026-88053 (upstream 8b057468): 'ReadIntTemplates' reads
'NumClassPruners', 'NumClasses', and 'NumProtoSets' from the
untrusted inttemp component of a .traineddata file and uses them
as loop bounds writing pointers into fixed-size arrays
('ClassPruners[]', 'Class[]', 'ProtoSets[]'). A crafted file
with counts larger than the array capacity causes heap
out-of-bounds pointer writes during legacy engine initialization.
Adapted: the upstream commit includes extensive refactoring
(#define -> constexpr, C-arrays -> 'std::array', macros -> inline
constexpr functions, 'enum' -> 'enum class', 'SettupPass' rename,
constructor member-init rewrites) across 12 files / 288 insertions.
Only the security-relevant validation logic and failure propagation
chain were backported (7 files / 106 insertions):
- 'intproto.cpp': validate 'unicharset_size', 'NumClassPruners',
'NumClasses', per-class 'NumProtos'/'NumProtoSets'/'NumConfigs',
and old-format class ids against array capacities; clamp
free-function loop bounds to array capacity; 'memset' zero-init
of 'ClassPruners[]' in 'NewIntTemplates()'; null guard in
'free_int_class()'.
- 'adaptive.cpp': validate 'NumTempProtos' and 'NumConfigs' in
'ReadAdaptedClass'; null-check 'ReadIntTemplates' and
'ReadAdaptedClass' returns in 'ReadAdaptedTemplates'; reset
'Class[]' after raw 'FRead'; null guard in 'free_adapted_class()';
'TempProtos = NIL_LIST' init before cleanup.
- 'adaptmatch.cpp': propagate 'ReadIntTemplates' failure through
'InitAdaptiveClassifier' (void -> bool); handle null
'ReadAdaptedTemplates' gracefully.
- 'tface.cpp': propagate failure through 'program_editup'
(void -> bool).
- 'tessedit.cpp': check 'program_editup' return in
'init_tesseract_internal'.
- 'classify.h', 'wordrec.h': update function signatures.
Stripped unittest and 'Makefile.am' hunks.
Additional 4.1.1 differences vs 5.3.4: 'Emalloc'/'Efree' instead
of 'new'/'delete' for 'ADAPT_TEMPLATES'; C-style free functions
('free_int_class', 'free_int_templates', 'free_adapted_class',
'free_adapted_templates') instead of destructors; 'cprintf'
instead of 'tprintf' for progress output; 'const char *' instead
of 'const std::string &' for 'program_editup' parameter; explicit
'delete[] IndexFor/ClassIdFor/TempClassPruner' cleanup in error
paths (no RAII).
4.1.1-only fix: 'Class->ProtoLengths = nullptr' before
'free_int_class()' in per-class validation error path.
'Emalloc' returns uninitialized memory; without this,
'free_int_class()' would call 'Efree()' on a garbage pointer.
Not needed in 5.3.4 where 'ProtoLengths' is 'std::vector<uint8_t>'.
Resolves: RHEL-257373 RHEL-257386 RHEL-257406 RHEL-257603 RHEL-257566 RHEL-257575
Co-Authored-By: Claude AI <noreply@anthropic.com>
|
||
|---|---|---|
| .gitignore | ||
| gating.yaml | ||
| sources | ||
| tesseract-CVE-2026-88047.patch | ||
| tesseract-CVE-2026-88048.patch | ||
| tesseract-CVE-2026-88049.patch | ||
| tesseract-CVE-2026-88051.patch | ||
| tesseract-CVE-2026-88052.patch | ||
| tesseract-CVE-2026-88053.patch | ||
| tesseract.spec | ||
| tesseract_datadir.patch | ||
| upstream_2f4d2f4bf45c363785d7bf1da29b6628f8939a72.patch | ||