Hello community,

here is the log from the commit of package mupdf for openSUSE:Factory checked 
in at 2018-02-14 09:19:33
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/mupdf (Old)
 and      /work/SRC/openSUSE:Factory/.mupdf.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "mupdf"

Wed Feb 14 09:19:33 2018 rev:34 rq:575495 version:1.12.0

Changes:
--------
--- /work/SRC/openSUSE:Factory/mupdf/mupdf.changes      2018-02-09 
15:44:47.757316198 +0100
+++ /work/SRC/openSUSE:Factory/.mupdf.new/mupdf.changes 2018-02-14 
09:19:39.033511290 +0100
@@ -1,0 +2,7 @@
+Mon Feb 12 07:53:53 UTC 2018 - kbabi...@suse.com
+
+- Add CVE-2018-1000051.patch: Fix a Use After Free vulnerability in
+  fz_keep_key_storable that can potentially result in DoS / remote
+  code execution (CVE-2018-1000051 bsc#1080531)
+
+-------------------------------------------------------------------

New:
----
  CVE-2018-1000051.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ mupdf.spec ++++++
--- /var/tmp/diff_new_pack.nmHLET/_old  2018-02-14 09:19:40.277466201 +0100
+++ /var/tmp/diff_new_pack.nmHLET/_new  2018-02-14 09:19:40.281466056 +0100
@@ -33,6 +33,7 @@
 Patch4:         CVE-2018-6187.patch
 Patch5:         CVE-2018-6192.patch
 Patch6:         CVE-2018-6544.patch
+Patch7:         CVE-2018-1000051.patch
 BuildRequires:  freetype2-devel
 BuildRequires:  gcc-c++
 BuildRequires:  jbig2dec-devel
@@ -74,6 +75,7 @@
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
+%patch7 -p1
 
 # do not use the inlined copies of build dpendencies except for mujs
 rm -rf $(ls -d thirdparty/*/ | grep -v mujs)

++++++ CVE-2018-1000051.patch ++++++
>From 321ba1de287016b0036bf4a56ce774ad11763384 Mon Sep 17 00:00:00 2001
From: Sebastian Rasmussen <seb...@gmail.com>
Date: Tue, 19 Dec 2017 23:47:47 +0100
Subject: [PATCH] Bug 698825: Do not drop borrowed colorspaces.

Previously the borrowed colorspace was dropped when updating annotation
appearances, leading to use after free warnings from valgrind/ASAN.
---
 source/pdf/pdf-appearance.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/source/pdf/pdf-appearance.c b/source/pdf/pdf-appearance.c
index 70f684f..d7a1ddd 100644
--- a/source/pdf/pdf-appearance.c
+++ b/source/pdf/pdf-appearance.c
@@ -2170,7 +2170,6 @@ void pdf_update_free_text_annot_appearance(fz_context 
*ctx, pdf_document *doc, p
        fz_device *dev = NULL;
        font_info font_rec;
        fz_text *text = NULL;
-       fz_colorspace *cs = NULL;
        fz_matrix page_ctm;
 
        pdf_page_transform(ctx, annot->page, NULL, &page_ctm);
@@ -2184,11 +2183,11 @@ void pdf_update_free_text_annot_appearance(fz_context 
*ctx, pdf_document *doc, p
        fz_var(dlist);
        fz_var(dev);
        fz_var(text);
-       fz_var(cs);
        fz_try(ctx)
        {
                char *contents = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, 
PDF_NAME_Contents));
                char *da = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, 
PDF_NAME_DA));
+               fz_colorspace *cs;
                fz_point pos;
                fz_rect rect;
 
@@ -2223,7 +2222,6 @@ void pdf_update_free_text_annot_appearance(fz_context 
*ctx, pdf_document *doc, p
                fz_drop_display_list(ctx, dlist);
                font_info_fin(ctx, &font_rec);
                fz_drop_text(ctx, text);
-               fz_drop_colorspace(ctx, cs);
        }
        fz_catch(ctx)
        {
@@ -2359,7 +2357,6 @@ void pdf_set_signature_appearance(fz_context *ctx, 
pdf_document *doc, pdf_annot
        fz_device *dev = NULL;
        font_info font_rec;
        fz_text *text = NULL;
-       fz_colorspace *cs = NULL;
        fz_path *path = NULL;
        fz_buffer *fzbuf = NULL;
        fz_matrix page_ctm;
@@ -2375,7 +2372,6 @@ void pdf_set_signature_appearance(fz_context *ctx, 
pdf_document *doc, pdf_annot
        fz_var(dlist);
        fz_var(dev);
        fz_var(text);
-       fz_var(cs);
        fz_var(fzbuf);
        fz_try(ctx)
        {
@@ -2384,6 +2380,7 @@ void pdf_set_signature_appearance(fz_context *ctx, 
pdf_document *doc, pdf_annot
                fz_rect logo_bounds;
                fz_matrix logo_tm;
                fz_rect rect;
+               fz_colorspace *cs = fz_device_rgb(ctx); /* Borrowed reference */
 
                pdf_to_rect(ctx, pdf_dict_get(ctx, annot->obj, PDF_NAME_Rect), 
&annot_rect);
                rect = annot_rect;
@@ -2396,7 +2393,6 @@ void pdf_set_signature_appearance(fz_context *ctx, 
pdf_document *doc, pdf_annot
                fz_bound_path(ctx, path, NULL, &fz_identity, &logo_bounds);
                center_rect_within_rect(&logo_bounds, &rect, &logo_tm);
                fz_concat(&logo_tm, &logo_tm, &page_ctm);
-               cs = fz_device_rgb(ctx); /* Borrowed reference */
                fz_fill_path(ctx, dev, path, 0, &logo_tm, cs, logo_color, 1.0f, 
NULL);
 
                get_font_info(ctx, doc, dr, da, &font_rec);
-- 
2.9.1



Reply via email to