Hello community, here is the log from the commit of package mupdf for openSUSE:Factory checked in at 2016-07-28 23:43:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mupdf (Old) and /work/SRC/openSUSE:Factory/.mupdf.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mupdf" Changes: -------- --- /work/SRC/openSUSE:Factory/mupdf/mupdf.changes 2016-05-05 13:18:36.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.mupdf.new/mupdf.changes 2016-07-28 23:43:41.000000000 +0200 @@ -1,0 +2,5 @@ +Fri Jul 22 11:02:28 UTC 2016 - idon...@suse.com + +- Add CVE-2016-6265.patch to fix a use-after-free bsc#990195 + +------------------------------------------------------------------- New: ---- CVE-2016-6265.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mupdf.spec ++++++ --- /var/tmp/diff_new_pack.DrIZB9/_old 2016-07-28 23:43:43.000000000 +0200 +++ /var/tmp/diff_new_pack.DrIZB9/_new 2016-07-28 23:43:43.000000000 +0200 @@ -29,6 +29,7 @@ Source2: mupdf.png # PATCH-FIX-OPENSUSE mupdf-fix-openjpeg2.patch g...@opensuse.org -- Fix build against openjpeg2 2.1 on openSUSE Patch0: mupdf-fix-openjpeg2.patch +Patch1: CVE-2016-6265.patch BuildRequires: freetype-devel BuildRequires: gcc-c++ BuildRequires: jbig2dec-devel @@ -69,6 +70,7 @@ rm -rf $(ls -d thirdparty/*/ | grep -v mujs) %patch0 -p1 +%patch1 -p1 mkdir docs/examples for src in docs/*.c; do ++++++ CVE-2016-6265.patch ++++++ X-Git-Url: http://git.ghostscript.com/?p=mupdf.git;a=blobdiff_plain;f=source%2Fpdf%2Fpdf-xref.c;h=32225998178b7c4d465046ff5158a3796103d73d;hp=576c315de2a30cfd553652bfa82521edb07043c2;hb=fa1936405b6a84e5c9bb440912c23d532772f958;hpb=e98091d56afdf1cf6c9a017fa0bd35dd0b8968f0 diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c index 576c315..3222599 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -1184,8 +1184,14 @@ pdf_load_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", (int)entry->ofs, i); } if (entry->type == 'o') - if (entry->ofs <= 0 || entry->ofs >= xref_len || pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n') - fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i); + { + /* Read this into a local variable here, because pdf_get_xref_entry + * may solidify the xref, hence invalidating "entry", meaning we + * need a stashed value for the throw. */ + fz_off_t ofs = entry->ofs; + if (ofs <= 0 || ofs >= xref_len || pdf_get_xref_entry(ctx, doc, ofs)->type != 'n') + fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i); + } } }