Hello community,

here is the log from the commit of package mupdf for openSUSE:Factory checked 
in at 2016-07-28 23:43:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/mupdf (Old)
 and      /work/SRC/openSUSE:Factory/.mupdf.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "mupdf"

Changes:
--------
--- /work/SRC/openSUSE:Factory/mupdf/mupdf.changes      2016-05-05 
13:18:36.000000000 +0200
+++ /work/SRC/openSUSE:Factory/.mupdf.new/mupdf.changes 2016-07-28 
23:43:41.000000000 +0200
@@ -1,0 +2,5 @@
+Fri Jul 22 11:02:28 UTC 2016 - idon...@suse.com
+
+- Add CVE-2016-6265.patch to fix a use-after-free bsc#990195 
+
+-------------------------------------------------------------------

New:
----
  CVE-2016-6265.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ mupdf.spec ++++++
--- /var/tmp/diff_new_pack.DrIZB9/_old  2016-07-28 23:43:43.000000000 +0200
+++ /var/tmp/diff_new_pack.DrIZB9/_new  2016-07-28 23:43:43.000000000 +0200
@@ -29,6 +29,7 @@
 Source2:        mupdf.png
 # PATCH-FIX-OPENSUSE mupdf-fix-openjpeg2.patch g...@opensuse.org -- Fix build 
against openjpeg2 2.1 on openSUSE
 Patch0:         mupdf-fix-openjpeg2.patch
+Patch1:         CVE-2016-6265.patch
 BuildRequires:  freetype-devel
 BuildRequires:  gcc-c++
 BuildRequires:  jbig2dec-devel
@@ -69,6 +70,7 @@
 rm -rf $(ls -d thirdparty/*/ | grep -v mujs)
 
 %patch0 -p1
+%patch1 -p1
 
 mkdir docs/examples
 for src in docs/*.c; do

++++++ CVE-2016-6265.patch ++++++
X-Git-Url: 
http://git.ghostscript.com/?p=mupdf.git;a=blobdiff_plain;f=source%2Fpdf%2Fpdf-xref.c;h=32225998178b7c4d465046ff5158a3796103d73d;hp=576c315de2a30cfd553652bfa82521edb07043c2;hb=fa1936405b6a84e5c9bb440912c23d532772f958;hpb=e98091d56afdf1cf6c9a017fa0bd35dd0b8968f0

diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index 576c315..3222599 100644
--- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c
@@ -1184,8 +1184,14 @@ pdf_load_xref(fz_context *ctx, pdf_document *doc, 
pdf_lexbuf *buf)
                                fz_throw(ctx, FZ_ERROR_GENERIC, "object offset 
out of range: %d (%d 0 R)", (int)entry->ofs, i);
                }
                if (entry->type == 'o')
-                       if (entry->ofs <= 0 || entry->ofs >= xref_len || 
pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
-                               fz_throw(ctx, FZ_ERROR_GENERIC, "invalid 
reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i);
+               {
+                       /* Read this into a local variable here, because 
pdf_get_xref_entry
+                        * may solidify the xref, hence invalidating "entry", 
meaning we
+                        * need a stashed value for the throw. */
+                       fz_off_t ofs = entry->ofs;
+                       if (ofs <= 0 || ofs >= xref_len || 
pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
+                               fz_throw(ctx, FZ_ERROR_GENERIC, "invalid 
reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
+               }
        }
 }
 


Reply via email to