Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mupdf for openSUSE:Factory checked in at 2026-11-07 23:34:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mupdf (Old) and /work/SRC/openSUSE:Factory/.mupdf.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mupdf" Sat Nov 7 23:34:33 2026 rev:83 rq:1396081 version:1.28.6 Changes: -------- --- /work/SRC/openSUSE:Factory/mupdf/mupdf.changes 2026-10-30 18:19:00.545117899 +0100 +++ /work/SRC/openSUSE:Factory/.mupdf.new.3759290/mupdf.changes 2026-11-07 23:36:04.952152290 +0100 @@ -1,0 +2,11 @@ +Sat Nov 7 18:30:44 UTC 2026 - Martin Pluskal <[email protected]> + +- Repack Source0 with mupdf-prune-tarball.sh: drop the unused + thirdparty/zxing-cpp tree and the Windows-only lcms2 fuzzers.exp + (prebuilt binaries no Linux build uses); no source changes. +- Add mupdf-709768-double-free.patch (upstream Bug 709768, + boo#1285930, CVE-2026-112036): NULL the char list pointer + after freeing so a crafted signature object cannot double-free + it. + +------------------------------------------------------------------- Old: ---- mupdf-1.28.6-source.tar.gz New: ---- mupdf-1.28.6-pruned-source.tar.gz mupdf-709768-double-free.patch mupdf-prune-tarball.sh ----------(New B)---------- New: (prebuilt binaries no Linux build uses); no source changes. - Add mupdf-709768-double-free.patch (upstream Bug 709768, boo#1285930, CVE-2026-112036): NULL the char list pointer ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mupdf.spec ++++++ --- /var/tmp/diff_new_pack.JNugZu/_old 2026-11-07 23:36:07.331250896 +0100 +++ /var/tmp/diff_new_pack.JNugZu/_new 2026-11-07 23:36:07.335251062 +0100 @@ -27,9 +27,13 @@ Summary: PDF and XPS Viewer and Parser and Rendering Library License: AGPL-3.0-or-later URL: https://mupdf.com/ -Source0: https://mupdf.com/downloads/archive/%{name}-%{version}-source.tar.gz +# Repacked upstream tarball (see mupdf-prune-tarball.sh): drops the unused +# thirdparty/zxing-cpp tree and the Windows-only lcms2 fuzzers.exp, which +# no Linux build uses. No source changes besides that pruning. +Source0: %{name}-%{version}-pruned-source.tar.gz Source1: %{name}.desktop Source2: %{name}-gl.desktop +Source3: mupdf-prune-tarball.sh Patch0: mupdf-no-strip.patch # Build against the system cmark-gfm instead of the vendored thirdparty copy. # Upstream 1.28.5 wires up USE_SYSTEM_CMARK_GFM itself (and fixed the @@ -38,6 +42,9 @@ # registry.h that the system library does not install. # PATCH-FIX-OPENSUSE mupdf-system-cmark-gfm.patch [email protected] -- link cmark-gfm-extensions, declare cmark_release_plugins Patch1: mupdf-system-cmark-gfm.patch +# NULL list pointer after free (upstream Bug 709768, boo#1285930). +# PATCH-FIX-UPSTREAM mupdf-709768-double-free.patch -- commit 3984925b660a +Patch2: mupdf-709768-double-free.patch BuildRequires: desktop-file-utils BuildRequires: fdupes BuildRequires: gcc-c++ ++++++ mupdf-709768-double-free.patch ++++++ Upstream commit 3984925b660a (Bug 709768): clear list pointer to avoid double free when a crafted PDF signature object has two reference dicts (one specific field, one /All). Without the NULL, the second free_char_list() call frees the stale pointer. PATCH-FIX-UPSTREAM mupdf-709768-double-free.patch -- Bug 709768, boo#1285930 (CVE-2026-112036) --- mupdf-1.28.6-source/source/pdf/pdf-xref.c.orig +++ mupdf-1.28.6-source/source/pdf/pdf-xref.c @@ -4180,6 +4180,7 @@ for (i = c->len-1; i >= 0; i--) fz_free(ctx, c->list[i]); fz_free(ctx, c->list); + c->list = NULL; c->len = 0; c->max = 0; } ++++++ mupdf-prune-tarball.sh ++++++ #!/bin/sh # Rebuild Source0 from the upstream release tarball minus the prebuilt # binaries no Linux build uses (references/specfile-guidelines.md "Spec # file — general rules": a file the build never uses is removed from the # sources). Run at packager time; the output is committed as Source0. # # sh mupdf-prune-tarball.sh <version> <output-dir> # # - downloads https://mupdf.com/downloads/archive/mupdf-<v>-source.tar.gz # (sha256 pinned below) and repacks it with only these deletions: # - thirdparty/zxing-cpp/: barcode support builds with barcode=yes, which # the spec never passes (FZ_ENABLE_BARCODE=0); %prep already deletes # the whole directory. Contains the Android gradle-wrapper.jar whose # Java classes no source exception can cover. # - thirdparty/lcms2/fuzzers/fuzzers.exp: Windows MSVC export object for # the lcms2 fuzzer; unreferenced by the Linux build. # - the inner top directory (mupdf-<v>-source) and member order are unchanged, # so %autosetup needs no new options; ownership is root:root. set -eu v="${1:?usage: $0 <version> <output-dir>}" out="${2:?usage: $0 <version> <output-dir>}" url="https://mupdf.com/downloads/archive/mupdf-${v}-source.tar.gz"; # sha256 of the upstream tarball for each repacked version: case "$v" in 1.28.6) sha="dc85000640a45d90ca9b77b061f6ca67cce0c4d4fbecf8819647baf573eef101" ;; *) echo "no pinned sha256 for version $v" >&2; exit 2 ;; esac tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT curl -fsSL --retry 3 -o "$tmp/upstream.tar.gz" "$url" echo "$sha $tmp/upstream.tar.gz" | sha256sum -c - tar -xzf "$tmp/upstream.tar.gz" -C "$tmp" rm -rf "$tmp/mupdf-${v}-source/thirdparty/zxing-cpp" rm -f "$tmp/mupdf-${v}-source/thirdparty/lcms2/fuzzers/fuzzers.exp" tar --owner=0 --group=0 --numeric-owner \ -czf "$out/mupdf-${v}-pruned-source.tar.gz" -C "$tmp" "mupdf-${v}-source" sha256sum "$out/mupdf-${v}-pruned-source.tar.gz"
