Darcsweb-Url: http://darcs.frugalware.org/darcsweb/darcsweb.cgi?r=frugalware-0.5;a=darcs_commitdiff;h=20070119112959-dd049-3146dbf72e0c190f19ee461d972051190a74ed16.gz;
[koffice-1.5.2-3siwenna1-i686 voroskoi <[EMAIL PROTECTED]>**20070119112959 secfic relbump, closes #1630 ] { addfile ./source/kde-extra/koffice/koffce-xpdf-CVE-2007-0104.diff hunk ./source/kde-extra/koffice/FrugalBuild 1 -# Last Modified: Wed, 06 Sep 2006 07:55:35 +0200 hunk ./source/kde-extra/koffice/FrugalBuild 7 -pkgrel=2 +pkgrel=3siwenna1 hunk ./source/kde-extra/koffice/FrugalBuild 17 - koffice-1.5-gcc-bug-workaround) -sha1sums=('e35bd08adfb3bf6acf195dd176147de1d6cf215a' \ - '06b4a301d475235ec6cd7967c97c339830d201b7') + koffice-1.5-gcc-bug-workaround koffce-xpdf-CVE-2007-0104.diff) hunk ./source/kde-extra/koffice/FrugalBuild 36 +sha1sums=('e35bd08adfb3bf6acf195dd176147de1d6cf215a' \ + '06b4a301d475235ec6cd7967c97c339830d201b7' \ + 'ea27b9ea212d1263444b6610c84dd8ee34865ded') hunk ./source/kde-extra/koffice/koffce-xpdf-CVE-2007-0104.diff 1 +------------------------------------------------------------------------ +r622463 | aacid | 2007-01-11 23:05:54 +0100 (Thu, 11 Jan 2007) | 2 lines +Changed paths: + M /branches/koffice/1.6/koffice/filters/kword/pdf/xpdf/xpdf/Catalog.cc + M /branches/koffice/1.6/koffice/filters/kword/pdf/xpdf/xpdf/Catalog.h + +Commiting the patch agreed between kpdf and poppler developers to fix MOAB-06-01-2007 issue. + +------------------------------------------------------------------------ +Index: filters/kword/pdf/xpdf/xpdf/Catalog.cc +=================================================================== +--- koffice/filters/kword/pdf/xpdf/xpdf/Catalog.cc (revision 622462) ++++ filters/kword/pdf/xpdf/xpdf/Catalog.cc (revision 622463) +@@ -24,6 +24,12 @@ + #include "Link.h" + #include "Catalog.h" + ++// This define is used to limit the depth of recursive readPageTree calls ++// This is needed because the page tree nodes can reference their parents ++// leaving us in an infinite loop ++// Most sane pdf documents don't have a call depth higher than 10 ++#define MAX_CALL_DEPTH 1000 ++ + //------------------------------------------------------------------------ + // Catalog + //------------------------------------------------------------------------ +@@ -77,7 +83,7 @@ Catalog::Catalog(XRef *xrefA) { + pageRefs[i].num = -1; + pageRefs[i].gen = -1; + } +- numPages = readPageTree(pagesDict.getDict(), NULL, 0); ++ numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0); + if (numPages != numPages0) { + error(-1, "Page count in top-level pages object is incorrect"); + } +@@ -171,7 +177,7 @@ GString *Catalog::readMetadata() { + return s; + } + +-int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) { ++int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) { + Object kids; + Object kid; + Object kidRef; +@@ -221,9 +227,13 @@ int Catalog::readPageTree(Dict *pagesDic + // This should really be isDict("Pages"), but I've seen at least one + // PDF file where the /Type entry is missing. + } else if (kid.isDict()) { +- if ((start = readPageTree(kid.getDict(), attrs1, start)) +- < 0) +- goto err2; ++ if (callDepth > MAX_CALL_DEPTH) { ++ error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH); ++ } else { ++ if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1)) ++ < 0) ++ goto err2; ++ } + } else { + error(-1, "Kid object (page %d) is wrong type (%s)", + start+1, kid.getTypeName()); +Index: filters/kword/pdf/xpdf/xpdf/Catalog.h +=================================================================== +--- koffice/filters/kword/pdf/xpdf/xpdf/Catalog.h (revision 622462) ++++ filters/kword/pdf/xpdf/xpdf/Catalog.h (revision 622463) +@@ -82,7 +82,7 @@ private: + Object outline; // outline dictionary + GBool ok; // true if catalog is valid + +- int readPageTree(Dict *pages, PageAttrs *attrs, int start); ++ int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth); + Object *findDestInTree(Object *tree, GString *name, Object *obj); + }; + } _______________________________________________ Frugalware-darcs mailing list Frugalware-darcs@frugalware.org http://frugalware.org/mailman/listinfo/frugalware-darcs