rpms/transfig
7
0
Fork 0
Code Issues Pull Requests Releases Activity

New upstream release 3.2.7b

Browse Source 
Add patch fixing CVE-2019-19746 (rhbz#1787040)
Add patch fixing CVE-2019-19797 (rhbz#1786726)
This commit is contained in:
Hans de Goede 2020-01-15 22:29:34 +01:00
parent 3bc7a54ebb
commit cccfee3cdc
12 changed files with 2738 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -3,3 +3,4 @@ transfig.3.2.5c.tar.gz
/fig2dev-3.2.6.tar.xz
/fig2dev-3.2.6a.tar.xz
/fig2dev-3.2.7a.tar.xz
/fig2dev-3.2.7b.tar.xz

77
0001-Embed-png-and-jpeg-images-unchanged-into-pdfs.patch Normal file
View File

@ -0,0 +1,77 @@
From 841c88cdd31eece97a929fbc01902a33d6168b00 Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Sun, 10 Nov 2019 22:53:23 +0100
Subject: [PATCH 1/8] Embed png and jpeg images unchanged into pdfs
Before, with the "-dAutoFilterColorImages=false -dColorImageFilter=/DCTEncode"
switches to pdf, png-files were re-encoded to jpegs.
---
CHANGES | 9 ++++++++-
fig2dev/dev/genpdf.c | 6 ++----
version.m4 | 6 +++---
3 files changed, 13 insertions(+), 8 deletions(-)
diff --git a/CHANGES b/CHANGES
index 2a9c1fb..2cdfda0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,14 @@ Changes to fig2dev
===============================================================================
Version 3.2
===============================================================================
-Patchlevel 7b (Oct 2019)
+Patchlevel Xx (Xxx 20xx)
+
+BUGS FIXED:
+ o Embed images in pdfs with their original compression type, i.e., leave
+ the gs switch "-dAutoFilterColorImages" at its default value "true".
+
+-------------------------------------
+Patchlevel 7b (Nov 2019)
NEW FEATURES:
o A X color database is not needed, but can be provided. The location of
diff --git a/fig2dev/dev/genpdf.c b/fig2dev/dev/genpdf.c
index d5b3a5a..1ddaa40 100644
--- a/fig2dev/dev/genpdf.c
+++ b/fig2dev/dev/genpdf.c
@@ -91,10 +91,8 @@ genpdf_start(F_compound *objects)
*/
/* -o ... is equivalent to -dBATCH -dNOPAUSE, see ghostscript Use.htm
and -dBATCH is equivalent to -c quit */
- sprintf(com, "%s -q -sAutoRotatePages=None "
- "-dAutoFilterColorImages=false -dColorImageFilter=/DCTEncode "
- "-sDEVICE=pdfwrite -dPDFSETTINGS=/prepress -o '%s' -",
- GSEXE, ofile);
+ sprintf(com, "%s -q -sAutoRotatePages=None -sDEVICE=pdfwrite "
+ "-dPDFSETTINGS=/prepress -o '%s' -", GSEXE, ofile);
(void) signal(SIGPIPE, pdf_broken_pipe);
if ((tfp = popen(com, "w")) == 0) {
fprintf(stderr, "fig2dev: Cannot open pipe to ghostscript\n");
diff --git a/version.m4 b/version.m4
index faf88ad..fa546d9 100644
--- a/version.m4
+++ b/version.m4
@@ -2,7 +2,7 @@ dnl Fig2dev: Translate Fig code to various Devices
dnl Copyright (c) 1991 by Micah Beck
dnl Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
dnl Parts Copyright (c) 1989-2015 by Brian V. Smith
-dnl Parts Copyright (c) 2015-2018 by Thomas Loimer
+dnl Parts Copyright (c) 2015-2019 by Thomas Loimer
dnl
dnl Any party obtaining a copy of these files is granted, free of charge, a
dnl full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -22,8 +22,8 @@ dnl Thus, configure.ac can remain unchanged between different versions.
dnl The values in this file are set by update_version_m4 if
dnl ./configure is called with --enable_versioning.
-m4_define([FIG_VERSION], [3.2.7b])
+m4_define([FIG_VERSION], [3.2.7b-dev])
dnl AC_INIT does not have access to shell variables.
dnl Therefore, define RELEASEDATE as a macro.
-m4_define([RELEASEDATE], [Oct 2019])
+m4_define([RELEASEDATE], [Nov 2019])
--
2.24.1

71
0002-Allow-fig-2-text-ending-with-multiple-A-ticket-55.patch Normal file
View File

@ -0,0 +1,71 @@
From 19db5fe6f77ebad91af4b4ef0defd61bd0bb358f Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Wed, 4 Dec 2019 17:56:04 +0100
Subject: [PATCH 2/8] Allow fig 2 text ending with multiple ^A, ticket #55
---
CHANGES | 2 ++
fig2dev/read.c | 4 ++--
fig2dev/tests/read.at | 11 +++++++++++
3 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/CHANGES b/CHANGES
index 2cdfda0..edd0843 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,8 @@ Version 3.2
Patchlevel Xx (Xxx 20xx)
BUGS FIXED:
+ Ticket numbers refer to https://sourceforge.net/p/mcj/tickets/#.
+ o Allow Fig v2 text strings ending with multiple ^A. Ticket #55.
o Embed images in pdfs with their original compression type, i.e., leave
the gs switch "-dAutoFilterColorImages" at its default value "true".
diff --git a/fig2dev/read.c b/fig2dev/read.c
index af84531..09bd17d 100644
--- a/fig2dev/read.c
+++ b/fig2dev/read.c
@@ -3,7 +3,7 @@
* Copyright (c) 1991 by Micah Beck
* Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
* Parts Copyright (c) 1989-2015 by Brian V. Smith
- * Parts Copyright (c) 2015-2018 by Thomas Loimer
+ * Parts Copyright (c) 2015-2019 by Thomas Loimer
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -1328,7 +1328,7 @@ read_textobject(FILE *fp)
If we do not find the CONTROL-A on this line then this must
be a multi-line text object and we will have to read more. */
- n = sscanf(buf,"%*d%d%d%lf%d%d%d%lf%d%lf%lf%d%d%[^\1]%[\1]",
+ n = sscanf(buf,"%*d%d%d%lf%d%d%d%lf%d%lf%lf%d%d%[^\1]%1[\1]",
&t->type, &t->font, &t->size, &t->pen,
&t->color, &t->depth, &t->angle,
&t->flags, &t->height, &t->length,
diff --git a/fig2dev/tests/read.at b/fig2dev/tests/read.at
index a606de0..c36d07a 100644
--- a/fig2dev/tests/read.at
+++ b/fig2dev/tests/read.at
@@ -359,6 +359,17 @@ EOF
], 0, ignore)
AT_CLEANUP
+AT_SETUP([allow text ending with multiple ^A, ticket #55])
+AT_KEYWORDS([read.c])
+AT_CHECK([fig2dev -L box <<EOF
+#FIG 2
+1200 2
+4 2 0 0 1 0 0 390 306 110 376 639 5 Text
+EOF
+], 1, ignore, [Invalid text object at line 2.
+])
+AT_CLEANUP
+
AT_BANNER([Dynamically allocate picture file name.])
AT_SETUP([prepend fig file path to picture file name])
--
2.24.1

89
0003-Reject-huge-arrow-types-ticket-57.patch Normal file
View File

@ -0,0 +1,89 @@
From 3065abc7b4f740ed6532322843531317de782a26 Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Tue, 10 Dec 2019 13:17:36 +0100
Subject: [PATCH 3/8] Reject huge arrow types, ticket #57
An arrow type being large enough would pass the test for
a valid type by integer overflow.
---
CHANGES | 1 +
fig2dev/arrow.c | 13 ++++++++-----
fig2dev/tests/read.at | 12 ++++++++++++
3 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/CHANGES b/CHANGES
index edd0843..964dc84 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ Patchlevel Xx (Xxx 20xx)
BUGS FIXED:
Ticket numbers refer to https://sourceforge.net/p/mcj/tickets/#.
+ o Reject huge arrow types causing integer overflow. Ticket #57.
o Allow Fig v2 text strings ending with multiple ^A. Ticket #55.
o Embed images in pdfs with their original compression type, i.e., leave
the gs switch "-dAutoFilterColorImages" at its default value "true".
diff --git a/fig2dev/arrow.c b/fig2dev/arrow.c
index a8e7fd0..34bcf18 100644
--- a/fig2dev/arrow.c
+++ b/fig2dev/arrow.c
@@ -1,9 +1,10 @@
/*
* Fig2dev: Translate Fig code to various Devices
- * Copyright (c) 1985 by Supoj Sutantavibul
* Copyright (c) 1991 by Micah Beck
- * Parts Copyright (c) 1989-2002 by Brian V. Smith
- * Parts Copyright (c) 2015-2018 by Thomas Loimer
+ * Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
+ * Parts Copyright (c) 1989-2015 by Brian V. Smith
+ * Parts Copyright (c) 2015-2019 by Thomas Loimer
+ *
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -78,7 +79,9 @@ make_arrow(int type, int style, double thickness, double wid, double ht)
{
F_arrow *a;
- if (style < 0 || style > 1 || type < 0 || (type + 1) * 2 > NUMARROWS)
+ if (style < 0 || style > 1 || type < 0 ||
+ /* beware of int overflow */
+ type > NUMARROWS || (type + 1) * 2 > NUMARROWS)
return NULL;
if (NULL == (Arrow_malloc(a))) {
put_msg(Err_mem);
@@ -90,7 +93,7 @@ make_arrow(int type, int style, double thickness, double wid, double ht)
a->type = type;
a->style = style;
- a->thickness = thickness*THICK_SCALE;
+ a->thickness = thickness * THICK_SCALE;
a->wid = wid;
a->ht = ht;
return a;
diff --git a/fig2dev/tests/read.at b/fig2dev/tests/read.at
index c36d07a..e9a71a3 100644
--- a/fig2dev/tests/read.at
+++ b/fig2dev/tests/read.at
@@ -135,6 +135,18 @@ A single point with a backward arrow - remove the arrow.
])
AT_CLEANUP
+AT_SETUP([reject huge arrow-type, ticket #57])
+AT_KEYWORDS(arrow.c arrow)
+AT_CHECK([fig2dev -L box <<EOF
+FIG_FILE_TOP
+2 1 0 1 -1 -1 50 -1 -1 0. 0 0 0 1 0 2
+ 10000000000000 0 1 60 120
+0 0 600 0
+EOF
+], 1, ignore, [Invalid forward arrow at line 11.
+])
+AT_CLEANUP
+
AT_SETUP([reject negative font type])
AT_KEYWORDS(read.c font)
AT_CHECK([fig2dev -L box <<EOF
--
2.24.1

85
0004-Convert-polygons-with-too-few-points-to-polylines.patch Normal file
View File

@ -0,0 +1,85 @@
From c379fe50574e5b5dd6e17f15d8473c5713d1b823 Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Wed, 11 Dec 2019 21:36:46 +0100
Subject: [PATCH 4/8] Convert polygons with too few points to polylines
As a side effect, this also fixes ticket #56.
---
CHANGES | 1 +
fig2dev/read.c | 16 ++++++++++++++++
fig2dev/tests/read.at | 11 +++++++++++
3 files changed, 28 insertions(+)
diff --git a/CHANGES b/CHANGES
index 964dc84..b2f7006 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ Patchlevel Xx (Xxx 20xx)
BUGS FIXED:
Ticket numbers refer to https://sourceforge.net/p/mcj/tickets/#.
+ o Convert polygons having too few points to polylines. Ticket #56.
o Reject huge arrow types causing integer overflow. Ticket #57.
o Allow Fig v2 text strings ending with multiple ^A. Ticket #55.
o Embed images in pdfs with their original compression type, i.e., leave
diff --git a/fig2dev/read.c b/fig2dev/read.c
index 09bd17d..9500091 100644
--- a/fig2dev/read.c
+++ b/fig2dev/read.c
@@ -793,8 +793,10 @@ read_ellipseobject(void)
/*
* Sanitize line objects. Return 0 on success, -1 otherwise.
* On error, call free_linestorage(l) after sanitize_lineobject().
+ *
* polylines: remove fill, if less than 3 points
* remove arrows, if only one point
+ * polygons: convert to polyline if less than 3 unique points
* rectangles, polygons: last point must coincide with first point
* rectangle: convert to polygon, if not 5 points
* rectangle with rounded corners: error, if not 5 points
@@ -854,6 +856,20 @@ sanitize_lineobject(
q->y = l->points->y;
}
+ if (l->type == T_POLYGON) {
+ int npts;
+
+ q = l->points;
+ for (npts = 1; q->next && npts < 4; q = q->next)
+ ++npts;
+ if (npts < 4 ) {
+ put_msg("A polygon with %d points at line %d - convert to a polyline.",
+ npts, line_no);
+ l->type = T_POLYLINE;
+ return 0;
+ }
+ }
+
if (l->type == T_BOX || l->type == T_ARC_BOX || l->type == T_PIC_BOX) {
int npts = 1;
for (q = l->points; q->next; q = q->next)
diff --git a/fig2dev/tests/read.at b/fig2dev/tests/read.at
index e9a71a3..4ef8747 100644
--- a/fig2dev/tests/read.at
+++ b/fig2dev/tests/read.at
@@ -147,6 +147,17 @@ EOF
])
AT_CLEANUP
+AT_SETUP([convert short polygon to polyline, ticket #56])
+AT_KEYWORDS(read.c polygon)
+AT_CHECK([fig2dev -L ptk <<EOF
+FIG_FILE_TOP
+2 3 0 1 -1 -1 50 -1 -1 0.0 0 0 -1 0 0 1
+ 0 0
+EOF
+], 0, ignore, [A polygon with 1 points at line 11 - convert to a polyline.
+])
+AT_CLEANUP
+
AT_SETUP([reject negative font type])
AT_KEYWORDS(read.c font)
AT_CHECK([fig2dev -L box <<EOF
--
2.24.1

324
0005-Correctly-scan-embedded-pdfs-for-MediaBox-value.patch Normal file
View File

@ -0,0 +1,324 @@
From f116dfdff70c6a289a86e93f6b2fe64a54198534 Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Sat, 14 Dec 2019 23:10:04 +0100
Subject: [PATCH 5/8] Correctly scan embedded pdfs for /MediaBox value
This applies two patches from the opensuse source rpm,
https://download.opensuse.org/repositories/openSUSE:/Factory/standard/src/xfig-3.2.7b-1.1.src.rpm
transfig.3.2.5-binderman.dif and transfig.3.2.5d-mediaboxrealnb.dif.
---
CHANGES | 1 +
fig2dev/dev/readeps.c | 31 ++++++++------
fig2dev/tests/Makefile.am | 15 ++++---
fig2dev/tests/bitmaps.at | 5 +++
fig2dev/tests/data/cross.pdf | 62 +++++++++++++++++++++++++++
fig2dev/tests/test2.c | 82 ++++++++++++++++++++++++++++++++++++
transfig/sys.c | 3 ++
7 files changed, 182 insertions(+), 17 deletions(-)
create mode 100644 fig2dev/tests/data/cross.pdf
create mode 100644 fig2dev/tests/test2.c
diff --git a/CHANGES b/CHANGES
index b2f7006..4a414fa 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,7 @@ Patchlevel Xx (Xxx 20xx)
BUGS FIXED:
Ticket numbers refer to https://sourceforge.net/p/mcj/tickets/#.
+ o Correctly scan embedded pdfs for /MediaBox value.
o Convert polygons having too few points to polylines. Ticket #56.
o Reject huge arrow types causing integer overflow. Ticket #57.
o Allow Fig v2 text strings ending with multiple ^A. Ticket #55.
diff --git a/fig2dev/dev/readeps.c b/fig2dev/dev/readeps.c
index ec25504..502f4bb 100644
--- a/fig2dev/dev/readeps.c
+++ b/fig2dev/dev/readeps.c
@@ -1,7 +1,9 @@
/*
* Fig2dev: Translate Fig code to various Devices
- * Parts Copyright (c) 1989-2007 by Brian V. Smith
- * Parts Copyright (c) 2015-2017 by Thomas Loimer
+ * Copyright (c) 1991 by Micah Beck
+ * Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
+ * Parts Copyright (c) 1989-2015 by Brian V. Smith
+ * Parts Copyright (c) 2015-2019 by Thomas Loimer
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -83,18 +85,23 @@ read_eps_pdf(FILE *file, int filetype, F_pic *pic, int *llx, int* lly,
while (fgets(buf, BUFSIZ, file) != NULL) {
/* look for /MediaBox for pdf file */
if (pdf_flag) {
- if (!strncmp(buf, "/MediaBox", 9)) { /* look for the MediaBox spec */
- c = strchr(buf, '[') + 1;
- if (c && sscanf(c, "%d %d %d %d", llx, lly, &urx, &ury) < 4)
- {
- *llx = *lly = 0;
- urx = paperdef[0].width*72;
- ury = paperdef[0].height*72;
- put_msg("Bad MediaBox in imported PDF file %s, assuming %s size",
- pic->file, metric? "A4" : "Letter" );
+ for (c = buf; (c = strchr(c,'/')); ++c) {
+ if (!strncmp(c, "/MediaBox", 9)) {
+ c = strchr(c, '[');
+ if (c && sscanf(c + 1, "%d %d %d %d",
+ llx, lly, &urx, &ury) < 4) {
+ *llx = *lly = 0;
+ urx = paperdef[0].width*72;
+ ury = paperdef[0].height*72;
+ put_msg("Bad MediaBox in imported PDF file %s, assuming %s size",
+ pic->file, metric? "A4" : "Letter" );
+ }
+ pic->bit_size.x = urx - (*llx);
+ pic->bit_size.y = ury - (*lly);
+ break;
}
}
- /* look for bounding box for EPS file */
+ /* look for bounding box for EPS file */
} else if (!nested && !strncmp(buf, "%%BoundingBox:", 14)) {
c = buf + 14;
/* skip past white space */
diff --git a/fig2dev/tests/Makefile.am b/fig2dev/tests/Makefile.am
index 4b83e0b..389f984 100644
--- a/fig2dev/tests/Makefile.am
+++ b/fig2dev/tests/Makefile.am
@@ -4,7 +4,7 @@
# Copyright (c) 1991 by Micah Beck
# Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
# Parts Copyright (c) 1989-2015 by Brian V. Smith
-# Parts Copyright (c) 2015-2018 by Thomas Loimer
+# Parts Copyright (c) 2015-2019 by Thomas Loimer
#
# Any party obtaining a copy of these files is granted, free of charge, a
# full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -16,7 +16,7 @@
# and this permission notice remain intact.
# fig2dev/tests/Makefile.am
-# Author: Thomas Loimer, 2016-2018.
+# Author: Thomas Loimer, 2016-2019.
# testsuite and package.m4 must be distributed, hence they are
@@ -39,8 +39,8 @@ $(srcdir)/package.m4: $(top_srcdir)/configure.ac
echo 'm4_define([AT_PACKAGE_URL], [@PACKAGE_URL@])'; \
} >'$(srcdir)/package.m4'
-check_PROGRAMS = test1
-# test1 calls malloc(). AC_FUNC_MALLOC may replace malloc() by rpl_malloc()
+check_PROGRAMS = test1 test2
+# test1 called malloc(). AC_FUNC_MALLOC may replace malloc() by rpl_malloc()
# which is defined in malloc.o. The latter is contained in $(LIBOBJS) in
# ${LIBOBJDIR}. Specifically, ./configure CFLAGS="-fsanitize=address" causes
# this replacment. Unfortunately, using test1_LDADD, causes make distcheck to
@@ -54,9 +54,14 @@ check_PROGRAMS = test1
# keep the definitions below in sync with those in ../dev/Makefile.am
if ENABLE_I18N
-AM_CPPFLAGS = -DI18N_DATADIR="\"$(i18ndir)\""
+test1_CPPFLAGS = -DI18N_DATADIR="\"$(i18ndir)\""
endif
+test2_CPPFLAGS = -I$(top_srcdir)/fig2dev
+test2_LDADD = $(top_builddir)/fig2dev/dev/readeps.$(OBJEXT)
+test2_DEPENDENCIES = $(test2_LDADD)
+
+
check-local: atconfig $(TESTSUITE) atlocal
$(SHELL) '$(TESTSUITE)' INSTALLCHECK=no $(TESTSUITEFLAGS)
diff --git a/fig2dev/tests/bitmaps.at b/fig2dev/tests/bitmaps.at
index 91d5b54..1fea0f8 100644
--- a/fig2dev/tests/bitmaps.at
+++ b/fig2dev/tests/bitmaps.at
@@ -235,3 +235,8 @@ EOF`
# 1433 on ubuntu 16.04.2 with ghostscript 9.18
AT_CHECK([test $blackpixels -gt 1431 && test $blackpixels -lt 1494])
AT_CLEANUP
+
+AT_SETUP([find /MediaBox in pdf file])
+AT_KEYWORDS(pdf)
+AT_CHECK(["$abs_builddir"/test2 "$srcdir/data/cross.pdf"], 0, ignore)
+AT_CLEANUP
diff --git a/fig2dev/tests/data/cross.pdf b/fig2dev/tests/data/cross.pdf
new file mode 100644
index 0000000..e1e7e4d
--- /dev/null
+++ b/fig2dev/tests/data/cross.pdf
@@ -0,0 +1,62 @@
+%PDF-1.4
+5 0 obj
+<</Length 6 0 R/Filter /FlateDecode>>
+stream
+xœMŠ± €0 {Oñ'Qüxj`
+R
+Ö$„Ð'<27>n‡i‚=¼^št±B ZÂ)†AÜÔ„×Ð’{4ñLõDDÖæؾçWÞ§°j_ã.³Œrdô?endstream
+endobj
+6 0 obj
+91
+endobj
+4 0 obj
+<</Type/Page/MediaBox [0 0 72 72]
+/Parent 3 0 R
+/Resources<</ProcSet[/PDF]
+/ExtGState 8 0 R
+>>
+/Contents 5 0 R
+>>
+endobj
+3 0 obj
+<< /Type /Pages /Kids [
+4 0 R
+] /Count 1
+>>
+endobj
+1 0 obj
+<</Type /Catalog /Pages 3 0 R
+>>
+endobj
+7 0 obj
+<</Type/ExtGState
+/BM/Normal
+/OPM 1
+/TK true>>endobj
+8 0 obj
+<</R7
+7 0 R>>
+endobj
+2 0 obj
+<</Producer(GPL Ghostscript 9.27)
+/CreationDate(D:20191110165654+01'00')
+/ModDate(D:20191110165654+01'00')
+/Creator( XeTeX 2019.11.10:1656)>>endobj
+xref
+0 9
+0000000000 65535 f
+0000000376 00000 n
+0000000514 00000 n
+0000000317 00000 n
+0000000188 00000 n
+0000000009 00000 n
+0000000170 00000 n
+0000000424 00000 n
+0000000485 00000 n
+trailer
+<< /Size 10 /Root 1 0 R /Info 2 0 R
+/ID [<EAB28CF54E276D36634D7BBB3C4603B7><EAB28CF54E276D36634D7BBB3C4603B7>]
+>>
+startxref
+670
+%%EOF
diff --git a/fig2dev/tests/test2.c b/fig2dev/tests/test2.c
new file mode 100644
index 0000000..04e92d7
--- /dev/null
+++ b/fig2dev/tests/test2.c
@@ -0,0 +1,82 @@
+/*
+ * Fig2dev: Translate Fig code to various Devices
+ * Copyright (c) 1991 by Micah Beck
+ * Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
+ * Parts Copyright (c) 1989-2015 by Brian V. Smith
+ * Parts Copyright (c) 2015-2019 by Thomas Loimer
+ *
+ * Any party obtaining a copy of these files is granted, free of charge, a
+ * full and unrestricted irrevocable, world-wide, paid up, royalty-free,
+ * nonexclusive right and license to deal in this software and documentation
+ * files (the "Software"), including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense and/or sell copies
+ * of the Software, and to permit persons who receive copies from any such
+ * party to do so, with the only requirement being that the above copyright
+ * and this permission notice remain intact.
+ *
+ */
+
+/*
+ * test2.c: Check, whether read_pdf() finds the bounding box of a pdf file.
+ * Author: Thomas Loimer, 2019-12-14
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "bool.h"
+#include "object.h"
+
+/* the function to be tested, in $(top_srcdir)/fig2dev/dev/readeps.c */
+extern int read_pdf(FILE *file, int type, F_pic *pic, int *llx, int *lly);
+
+/* symbols that are needed when calling read_pdf() */
+int urx = 0;
+int ury = 0;
+int metric = 0;
+FILE *tfp;
+const struct _paperdef /* from fig2dev.h */
+{
+ char *name;
+ int width;
+ int height;
+} paperdef[1] = {{"letter", 8, 12}};
+
+
+void put_msg(const char *fmt, const char *file, const char *size)
+{
+ fprintf(stderr, fmt, file, size);
+}
+
+int
+main(int argc, char *argv[])
+{
+ (void) argc;
+ int llx = -1;
+ int lly = -1;
+ FILE *file;
+ F_pic pic;
+
+ tfp = stdout;
+ pic.file = argv[1];
+
+ file = fopen(argv[1], "rb");
+ if (file == NULL) {
+ fprintf(stderr, "Test file %s not found.\n", argv[1]);
+ exit(EXIT_FAILURE);
+ }
+
+ if (read_pdf(file, 0, &pic, &llx, &lly) == 1 &&
+ pic.bit_size.x != 10 && pic.bit_size.y != 10) {
+ fprintf(stdout, "read_pdf found: width = %d, height = %d\n",
+ pic.bit_size.x, pic.bit_size.y);
+ exit(EXIT_SUCCESS);
+ } else {
+ exit(EXIT_FAILURE);
+ }
+}
diff --git a/transfig/sys.c b/transfig/sys.c
index c070ee6..30e8d3d 100644
--- a/transfig/sys.c
+++ b/transfig/sys.c
@@ -2,6 +2,8 @@
* TransFig: Facility for Translating Fig code
* Copyright (c) 1991 by Micah Beck
* Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
+ * Parts Copyright (c) 1989-2015 by Brian V. Smith
+ * Parts Copyright (c) 2015-2019 by Thomas Loimer
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -39,6 +41,7 @@ sysls(void)
i += 1;
c = fgetc(ls);
}
+ pclose(ls);
sysbuf[i] = '\0';
return sysbuf;
}
--
2.24.1

30
0006-fig2dev-version-prints-version-information.patch Normal file
View File

@ -0,0 +1,30 @@
From 560e633910a28f81b6607cf81e53026ac96034bf Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Sun, 15 Dec 2019 21:32:18 +0100
Subject: [PATCH 6/8] "fig2dev --version" prints version information
---
fig2dev/fig2dev.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/fig2dev/fig2dev.c b/fig2dev/fig2dev.c
index 0866a71..479b484 100644
--- a/fig2dev/fig2dev.c
+++ b/fig2dev/fig2dev.c
@@ -218,6 +218,13 @@ get_args(int argc, char *argv[])
if (argc == 1)
fprintf(stderr, Usage, prog, prog);
+
+ /* print the version, for the comfort of the autotest tests */
+ if (!strcmp(argv[1], "--version")) {
+ printf("fig2dev Version %s\n", PACKAGE_VERSION);
+ exit(EXIT_SUCCESS);
+ }
+
/* sum of all arguments */
while ((c = fig_getopt(argc, argv, ARGSTRING)) != EOF) {
--
2.24.1

173
0007-Use-getopt-from-standard-libraries-if-available.patch Normal file
View File

@ -0,0 +1,173 @@
From 93795dd396730c80e63767dede7777f4cb7dc383 Mon Sep 17 00:00:00 2001
From: Thomas Loimer <thomas.loimer@tuwien.ac.at>
Date: Sun, 15 Dec 2019 21:34:34 +0100
Subject: [PATCH 7/8] Use getopt() from standard libraries, if available
---
configure.ac | 10 +++++-----
fig2dev/Makefile.am | 2 +-
fig2dev/Nmakefile | 6 +++---
fig2dev/fig2dev.c | 12 +++++++-----
fig2dev/{ => lib}/getopt.c | 12 +++---------
5 files changed, 19 insertions(+), 23 deletions(-)
rename fig2dev/{ => lib}/getopt.c (91%)
diff --git a/configure.ac b/configure.ac
index e88b27a..8e955ee 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5,7 +5,7 @@ AC_COPYRIGHT([Fig2dev: Translate Fig code to various Devices
Copyright (c) 1991 by Micah Beck
Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
Parts Copyright (c) 1989-2015 by Brian V. Smith
-Parts Copyright (c) 2015-2018 by Thomas Loimer
+Parts Copyright (c) 2015-2019 by Thomas Loimer
Any party obtaining a copy of these files is granted, free of charge, a
full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -19,7 +19,7 @@ and this permission notice remain intact.
#
# configure.ac
-# Author: Thomas Loimer, 2015-2018.
+# Author: Thomas Loimer, 2015-2019.
#
dnl Define m4 variables for use in AC_INIT and AC_DEFINE below.
@@ -366,9 +366,9 @@ AS_IF([test "$tl_cv_func__setmode" = yes],
# Check for functions and, if not found, use the corresponding
# replacement, e.g., strstr.c, in the top srcdir. Sets, e.g.,
-# HAVE_STRSTR. Any modern system should have these functions, so
-# this are obsolete checks.
-AC_REPLACE_FUNCS([isascii strstr strchr strrchr strcasecmp strncasecmp \
+# HAVE_STRSTR. Except possibly getopt(), any modern system should have these
+# functions, so all except one are obsolete checks.
+AC_REPLACE_FUNCS([getopt isascii strstr strchr strrchr strcasecmp strncasecmp \
strdup strndup])
# Place the replacement functions into this dir.
diff --git a/fig2dev/Makefile.am b/fig2dev/Makefile.am
index d00ac54..70ae569 100644
--- a/fig2dev/Makefile.am
+++ b/fig2dev/Makefile.am
@@ -39,7 +39,7 @@ bin_PROGRAMS = fig2dev
fig2dev_SOURCES = alloc.h arrow.c bool.h bound.h bound.c colors.h colors.c \
creationdate.h creationdate.c drivers.h fig2dev.h fig2dev.c free.h free.c \
iso2tex.c localmath.h localmath.c object.h read1_3.c read.h read.c \
- trans_spline.h trans_spline.c pi.h getopt.c
+ trans_spline.h trans_spline.c pi.h
# CONFIG_HEADER is config.h, which contains PACKAGE_VERSION. If that
# changes, fig2dev should take up the new version string.
diff --git a/fig2dev/Nmakefile b/fig2dev/Nmakefile
index 7623e40..bba38c9 100644
--- a/fig2dev/Nmakefile
+++ b/fig2dev/Nmakefile
@@ -2,7 +2,7 @@
# Copyright (c) 1991 by Micah Beck
# Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
# Parts Copyright (c) 1989-2015 by Brian V. Smith
-# Parts Copyright (c) 2015-2018 by Thomas Loimer
+# Parts Copyright (c) 2015-2019 by Thomas Loimer
#
# Any party obtaining a copy of these files is granted, free of charge, a
# full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -14,7 +14,7 @@
# and this permission notice remain intact.
# fig2dev/Nmakefile
-# Author: Thomas Loimer, 2018.
+# Author: Thomas Loimer, 2018, 2019.
#############################################################
#
@@ -84,7 +84,7 @@ CFLAGS = /I. /Idev /nologo /W1 /DWIN32 /D_BIND_TO_CURRENT_VCLIBS_VERSION=1 \
REPL_LIBS = lib/strndup.c
FIG2DEV_SRCS = arrow.c bound.c colors.c creationdate.c fig2dev.c free.c \
- getopt.c iso2tex.c localmath.c read.c read1_3.c trans_spline.c \
+ iso2tex.c localmath.c read.c read1_3.c trans_spline.c \
dev/asc85ec.c dev/genbitmaps.c dev/genbox.c dev/gencgm.c dev/gendxf.c \
dev/genemf.c dev/genepic.c dev/gengbx.c dev/genge.c dev/genibmgl.c \
dev/genlatex.c dev/genmap.c dev/genmf.c dev/genmp.c dev/genpdf.c \
diff --git a/fig2dev/fig2dev.c b/fig2dev/fig2dev.c
index 479b484..d8c5e2a 100644
--- a/fig2dev/fig2dev.c
+++ b/fig2dev/fig2dev.c
@@ -29,6 +29,7 @@
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
+#include <unistd.h>
#include <locale.h>
/* In Windows, _setmode() is declared in <io.h>, O_BINARY in <fcntl.h>. It
* accepts two arguments and sets file mode to text or binary. */
@@ -44,10 +45,11 @@
#include "bound.h"
#include "read.h"
-/* the three lines below could go into a getopt.h file */
-extern int fig_getopt(int nargc, char **nargv, char *ostr); /* getopt.c */
-extern char *optarg; /* getopt.c */
-extern int optind; /* getopt.c */
+#ifndef HAVE_GETOPT
+extern int getopt(int argc, char *argv[], const char *ostr);
+extern char *optarg;
+extern int optind;
+#endif
char Err_badarg[] = "Argument -%c unknown to %s driver.";
char Err_mem[] = "Running out of memory.";
@@ -226,7 +228,7 @@ get_args(int argc, char *argv[])
}
/* sum of all arguments */
- while ((c = fig_getopt(argc, argv, ARGSTRING)) != EOF) {
+ while ((c = getopt(argc, argv, ARGSTRING)) != EOF) {
/* global (all drivers) option handling */
switch (c) {
diff --git a/fig2dev/getopt.c b/fig2dev/lib/getopt.c
similarity index 91%
rename from fig2dev/getopt.c
rename to fig2dev/lib/getopt.c
index 867a9fe..f3d1845 100644
--- a/fig2dev/getopt.c
+++ b/fig2dev/lib/getopt.c
@@ -2,8 +2,8 @@
* Fig2dev: Translate Fig code to various Devices
* Copyright (c) 1991 by Micah Beck
* Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
- * Parts Copyright (c) 1989-2007 by Brian V. Smith
- * Parts Copyright (c) 2015-2017 by Thomas Loimer
+ * Parts Copyright (c) 1989-2015 by Brian V. Smith
+ * Parts Copyright (c) 2015-2019 by Thomas Loimer
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -37,12 +37,6 @@
#include <stdio.h>
#include <string.h>
-/*
-#ifndef lint
-static char sccsfid[] = "@(#) getopt.c 5.0 (UTZoo) 1985";
-#endif
-*/
-
#define ARGCH (int)':'
#define BADCH (int)'?'
#define EMSG ""
@@ -59,7 +53,7 @@ char *optarg; /* argument associated with option */
fputc(optc,stderr); fputc('\n',stderr); return BADCH
int
-fig_getopt(int nargc, char **nargv, char *ostr)
+getopt(int nargc, char **nargv, const char *ostr)
{
static char *place = EMSG; /* option letter processing */
char *oli; /* option letter list index */
--
2.24.1

1857
0008-Replace-most-calls-to-fgets-by-getline-in-read.c.patch Normal file
View File

File diff suppressed because it is too large Load Diff

2
sources
View File

@ -1 +1 @@
SHA512 (fig2dev-3.2.7a.tar.xz) = 63c7316cf40a276e7c602ab8e20d8b26f582f201597327f83d1957839a80cdd0666cc6a886a7eb7f615090d740c89bb3d2858c49d33df36e31ed7c1beabf6a43
SHA512 (fig2dev-3.2.7b.tar.xz) = 134023febf935e76bd5e45695e3718f6af823297743045cf5aaf91136047d8f217785cd150667aa893f8424430bf60e36cad907419118f27fee75aafb02cbe41

1
transfig.rpmlintrc Normal file
View File

@ -0,0 +1 @@
addFilter("W: spelling-error.*")

35
transfig.spec
View File

@ -1,17 +1,26 @@
Name: transfig
Version: 3.2.7a
Release: 3%{?dist}
Version: 3.2.7b
Release: 1%{?dist}
Epoch: 1
Summary: Utility for converting FIG files (made by xfig) to other formats
License: MIT
URL: https://sourceforge.net/projects/mcj/
Source0: http://downloads.sourceforge.net/mcj/fig2dev-%{version}.tar.xz
# Patches from upstream for CVE-2019-19746 and CVE-2019-19797 + deps
Patch1: 0001-Embed-png-and-jpeg-images-unchanged-into-pdfs.patch
Patch2: 0002-Allow-fig-2-text-ending-with-multiple-A-ticket-55.patch
Patch3: 0003-Reject-huge-arrow-types-ticket-57.patch
Patch4: 0004-Convert-polygons-with-too-few-points-to-polylines.patch
Patch5: 0005-Correctly-scan-embedded-pdfs-for-MediaBox-value.patch
Patch6: 0006-fig2dev-version-prints-version-information.patch
Patch7: 0007-Use-getopt-from-standard-libraries-if-available.patch
Patch8: 0008-Replace-most-calls-to-fgets-by-getline-in-read.c.patch
Requires: ghostscript
Requires: bc
Requires: netpbm-progs
BuildRequires: gcc
BuildRequires: gcc libtool
BuildRequires: libpng-devel
BuildRequires: libjpeg-devel
BuildRequires: libXpm-devel
@ -27,27 +36,41 @@ environments).
Install transfig if you need a utility for translating FIG or PIC
figures into certain graphics languages.
%prep
%autosetup -p1 -n fig2dev-%{version}
autoreconf -i
# Fix the manpage not being in UTF-8
iconv -f ISO-8859-15 -t UTF-8 man/fig2dev.1.in -o fig2dev.1.in.new
touch -r man/fig2dev.1.in fig2dev.1.in.new
mv fig2dev.1.in.new man/fig2dev.1.in
%build
%configure --enable-transfig
make %{?_smp_mflags}
%make_build
%install
%make_install
%files
%doc transfig/doc/manual.pdf
%doc CHANGES transfig/doc/manual.pdf
%{_bindir}/transfig
%{_bindir}/fig2dev
%{_bindir}/fig2ps2tex
%{_bindir}/pic2tpic
%{_datadir}/fig2dev/i18n/*.ps
%{_datadir}/fig2dev/rgb.txt
%{_mandir}/man1/*.1.gz
%changelog
* Wed Jan 15 2020 Hans de Goede <hdegoede@redhat.com> - 1:3.2.7b-1
- New upstream release 3.2.7b
- Add patch fixing CVE-2019-19746 (rhbz#1787040)
- Add patch fixing CVE-2019-19797 (rhbz#1786726)
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.2.7a-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild