Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-0.7.git;a=commitdiff;h=03b42985ef78e70bbca3ee96bbb758e745a6c509
commit 03b42985ef78e70bbca3ee96bbb758e745a6c509 Author: voroskoi <[EMAIL PROTECTED]> Date: Sun Nov 11 19:15:34 2007 +0100 poppler-0.6-2sayshell1-x86_64 secfix relbump removed old MOAB patch SA27553.diff fixes #2561 added crash_fix.diff from upstream which fixes a crash with some pdfs diff --git a/source/xlib/poppler/FrugalBuild b/source/xlib/poppler/FrugalBuild index c72e608..e5504aa 100644 --- a/source/xlib/poppler/FrugalBuild +++ b/source/xlib/poppler/FrugalBuild @@ -3,7 +3,7 @@ pkgname=poppler pkgver=0.6 -pkgrel=1 +pkgrel=2sayshell1 pkgdesc="A PDF rendering library" url="http://poppler.freedesktop.org/"; depends=('libxext' 'fontconfig' 'libstdc++' 'cairo' 'libjpeg' 'libxrender' 'libpng') @@ -12,7 +12,7 @@ groups=('xlib') archs=('i686' 'x86_64') up2date="lynx -dump http://poppler.freedesktop.org/releases.html|grep tar.gz|sed -n 's/.*-\(.*\)\.t.*/\1/;1 p'" source=(http://poppler.freedesktop.org/$pkgname-$pkgver.tar.gz \ - 01-poppler.conf) + 01-poppler.conf SA27553.diff crash_fix.diff) options=('scriptlet') subpkgs=('poppler-glib' 'poppler-qt' 'poppler-pdftools' 'poppler-qt4') @@ -38,7 +38,9 @@ build() { Fsplit poppler-qt4 usr/lib/pkgconfig/poppler-qt4.* Fsplit poppler-qt4 usr/include/poppler/qt4/ } - sha1sums=('a40abb17b912d6ecd0e4ece609b74647b8d04279' \ - 'a048348d9a8c6d545714350d3ab66dc7028e4b7f') + 'a048348d9a8c6d545714350d3ab66dc7028e4b7f' \ + 'b35c086f95b2af31b344d76070bffe35537b1df9' \ + 'bc36fc906a8842483cc0f9be207958c2d71486c0') + # optimization OK diff --git a/source/xlib/poppler/MOAB-06-01-2007.diff b/source/xlib/poppler/MOAB-06-01-2007.diff deleted file mode 100644 index 5ac9d8f..0000000 --- a/source/xlib/poppler/MOAB-06-01-2007.diff +++ /dev/null @@ -1,63 +0,0 @@ -diff -Naur poppler-0.5.4.orig/poppler/Catalog.cc poppler-0.5.4/poppler/Catalog.cc ---- poppler-0.5.4.orig/poppler/Catalog.cc 2006-09-13 17:10:52.000000000 +0200 -+++ poppler-0.5.4/poppler/Catalog.cc 2007-01-19 18:56:23.000000000 +0100 -@@ -26,6 +26,12 @@ - #include "UGooString.h" - #include "Catalog.h" - -+// This define is used to limit the depth of recursive readPageTree calls -+// This is needed because the page tree nodes can reference their parents -+// leaving us in an infinite loop -+// Most sane pdf documents don't have a call depth higher than 10 -+#define MAX_CALL_DEPTH 1000 -+ - //------------------------------------------------------------------------ - // Catalog - //------------------------------------------------------------------------ -@@ -75,7 +81,7 @@ - pageRefs[i].num = -1; - pageRefs[i].gen = -1; - } -- numPages = readPageTree(pagesDict.getDict(), NULL, 0); -+ numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0); - if (numPages != numPages0) { - error(-1, "Page count in top-level pages object is incorrect"); - } -@@ -217,7 +223,7 @@ - return s; - } - --int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) { -+int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) { - Object kids; - Object kid; - Object kidRef; -@@ -262,9 +268,13 @@ - // This should really be isDict("Pages"), but I've seen at least one - // PDF file where the /Type entry is missing. - } else if (kid.isDict()) { -- if ((start = readPageTree(kid.getDict(), attrs1, start)) -- < 0) -- goto err2; -+ if (callDepth > MAX_CALL_DEPTH) { -+ error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH); -+ } else { -+ if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1)) -+ < 0) -+ goto err2; -+ } - } else { - error(-1, "Kid object (page %d) is wrong type (%s)", - start+1, kid.getTypeName()); -diff -Naur poppler-0.5.4.orig/poppler/Catalog.h poppler-0.5.4/poppler/Catalog.h ---- poppler-0.5.4.orig/poppler/Catalog.h 2006-01-23 15:43:36.000000000 +0100 -+++ poppler-0.5.4/poppler/Catalog.h 2007-01-19 18:56:43.000000000 +0100 -@@ -193,7 +193,7 @@ - PageMode pageMode; // page mode - PageLayout pageLayout; // page layout - -- int readPageTree(Dict *pages, PageAttrs *attrs, int start); -+ int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth); - Object *findDestInTree(Object *tree, GooString *name, Object *obj); - }; - diff --git a/source/xlib/poppler/SA27553.diff b/source/xlib/poppler/SA27553.diff new file mode 100644 index 0000000..9c84caf --- /dev/null +++ b/source/xlib/poppler/SA27553.diff @@ -0,0 +1,643 @@ +diff --git a/poppler/Stream.cc b/poppler/Stream.cc +index ed46586..85d46bf 100644 +--- a/poppler/Stream.cc ++++ b/poppler/Stream.cc +@@ -1251,23 +1251,26 @@ CCITTFaxStream::CCITTFaxStream(Stream *strA, int encodingA, GBool endOfLineA, + columns = columnsA; + if (columns < 1) { + columns = 1; +- } +- if (columns + 4 <= 0) { +- columns = INT_MAX - 4; ++ } else if (columns > INT_MAX - 2) { ++ columns = INT_MAX - 2; + } + rows = rowsA; + endOfBlock = endOfBlockA; + black = blackA; +- refLine = (short *)gmallocn(columns + 3, sizeof(short)); +- codingLine = (short *)gmallocn(columns + 2, sizeof(short)); ++ // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns ++ // ---> max codingLine size = columns + 1 ++ // refLine has one extra guard entry at the end ++ // ---> max refLine size = columns + 2 ++ codingLine = (int *)gmallocn(columns + 1, sizeof(int)); ++ refLine = (int *)gmallocn(columns + 2, sizeof(int)); + + eof = gFalse; + row = 0; + nextLine2D = encoding < 0; + inputBits = 0; +- codingLine[0] = 0; +- codingLine[1] = refLine[2] = columns; +- a0 = 1; ++ codingLine[0] = columns; ++ a0i = 0; ++ outputBits = 0; + + buf = EOF; + } +@@ -1286,9 +1289,9 @@ void CCITTFaxStream::reset() { + row = 0; + nextLine2D = encoding < 0; + inputBits = 0; +- codingLine[0] = 0; +- codingLine[1] = columns; +- a0 = 1; ++ codingLine[0] = columns; ++ a0i = 0; ++ outputBits = 0; + buf = EOF; + + // skip any initial zero bits and end-of-line marker, and get the 2D +@@ -1305,211 +1308,230 @@ void CCITTFaxStream::reset() { + } + } + ++inline void CCITTFaxStream::addPixels(int a1, int blackPixels) { ++ if (a1 > codingLine[a0i]) { ++ if (a1 > columns) { ++ error(getPos(), "CCITTFax row is wrong length (%d)", a1); ++ err = gTrue; ++ a1 = columns; ++ } ++ if ((a0i & 1) ^ blackPixels) { ++ ++a0i; ++ } ++ codingLine[a0i] = a1; ++ } ++} ++ ++inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) { ++ if (a1 > codingLine[a0i]) { ++ if (a1 > columns) { ++ error(getPos(), "CCITTFax row is wrong length (%d)", a1); ++ err = gTrue; ++ a1 = columns; ++ } ++ if ((a0i & 1) ^ blackPixels) { ++ ++a0i; ++ } ++ codingLine[a0i] = a1; ++ } else if (a1 < codingLine[a0i]) { ++ if (a1 < 0) { ++ error(getPos(), "Invalid CCITTFax code"); ++ err = gTrue; ++ a1 = 0; ++ } ++ while (a0i > 0 && a1 <= codingLine[a0i - 1]) { ++ --a0i; ++ } ++ codingLine[a0i] = a1; ++ } ++} ++ + int CCITTFaxStream::lookChar() { + short code1, code2, code3; +- int a0New; +- GBool err, gotEOL; +- int ret; +- int bits, i; ++ int b1i, blackPixels, i, bits; ++ GBool gotEOL; + +- // if at eof just return EOF +- if (eof && codingLine[a0] >= columns) { +- return EOF; ++ if (buf != EOF) { ++ return buf; + } + + // read the next row +- err = gFalse; +- if (codingLine[a0] >= columns) { ++ if (outputBits == 0) { ++ ++ // if at eof just return EOF ++ if (eof) { ++ return EOF; ++ } ++ ++ err = gFalse; + + // 2-D encoding + if (nextLine2D) { +- // state: +- // a0New = current position in coding line (0 <= a0New <= columns) +- // codingLine[a0] = last change in coding line +- // (black-to-white if a0 is even, +- // white-to-black if a0 is odd) +- // refLine[b1] = next change in reference line of opposite color +- // to a0 +- // invariants: +- // 0 <= codingLine[a0] <= a0New +- // <= refLine[b1] <= refLine[b1+1] <= columns +- // 0 <= a0 <= columns+1 +- // refLine[0] = 0 +- // refLine[n] = refLine[n+1] = columns +- // -- for some 1 <= n <= columns+1 +- // end condition: +- // 0 = codingLine[0] <= codingLine[1] < codingLine[2] < ... +- // < codingLine[n-1] < codingLine[n] = columns +- // -- where 1 <= n <= columns+1 + for (i = 0; codingLine[i] < columns; ++i) { + refLine[i] = codingLine[i]; + } +- refLine[i] = refLine[i + 1] = columns; +- b1 = 1; +- a0New = codingLine[a0 = 0] = 0; +- do { ++ refLine[i++] = columns; ++ refLine[i] = columns; ++ codingLine[0] = 0; ++ a0i = 0; ++ b1i = 0; ++ blackPixels = 0; ++ // invariant: ++ // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] ++ // <= columns ++ // exception at left edge: ++ // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible ++ // exception at right edge: ++ // refLine[b1i] = refLine[b1i+1] = columns is possible ++ while (codingLine[a0i] < columns) { + code1 = getTwoDimCode(); + switch (code1) { + case twoDimPass: +- if (refLine[b1] < columns) { +- a0New = refLine[b1 + 1]; +- b1 += 2; ++ addPixels(refLine[b1i + 1], blackPixels); ++ if (refLine[b1i + 1] < columns) { ++ b1i += 2; + } + break; + case twoDimHoriz: +- if ((a0 & 1) == 0) { +- code1 = code2 = 0; ++ code1 = code2 = 0; ++ if (blackPixels) { + do { +- code1 += code3 = getWhiteCode(); ++ code1 += code3 = getBlackCode(); + } while (code3 >= 64); + do { +- code2 += code3 = getBlackCode(); ++ code2 += code3 = getWhiteCode(); + } while (code3 >= 64); + } else { +- code1 = code2 = 0; + do { +- code1 += code3 = getBlackCode(); ++ code1 += code3 = getWhiteCode(); + } while (code3 >= 64); + do { +- code2 += code3 = getWhiteCode(); ++ code2 += code3 = getBlackCode(); + } while (code3 >= 64); + } +- if (code1 > 0 || code2 > 0) { +- if (a0New + code1 <= columns) { +- codingLine[a0 + 1] = a0New + code1; +- } else { +- codingLine[a0 + 1] = columns; +- } +- ++a0; +- if (codingLine[a0] + code2 <= columns) { +- codingLine[a0 + 1] = codingLine[a0] + code2; +- } else { +- codingLine[a0 + 1] = columns; +- } +- ++a0; +- a0New = codingLine[a0]; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ addPixels(codingLine[a0i] + code1, blackPixels); ++ if (codingLine[a0i] < columns) { ++ addPixels(codingLine[a0i] + code2, blackPixels ^ 1); ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; ++ } ++ break; ++ case twoDimVertR3: ++ addPixels(refLine[b1i] + 3, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } + } + break; +- case twoDimVert0: +- if (refLine[b1] < columns) { +- a0New = codingLine[++a0] = refLine[b1]; +- ++b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ case twoDimVertR2: ++ addPixels(refLine[b1i] + 2, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } +- } else { +- a0New = codingLine[++a0] = columns; + } + break; + case twoDimVertR1: +- if (refLine[b1] + 1 < columns) { +- a0New = codingLine[++a0] = refLine[b1] + 1; +- ++b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ addPixels(refLine[b1i] + 1, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } +- } else { +- a0New = codingLine[++a0] = columns; + } + break; +- case twoDimVertL1: +- if (refLine[b1] - 1 > a0New || (a0 == 0 && refLine[b1] == 1)) { +- a0New = codingLine[++a0] = refLine[b1] - 1; +- --b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ case twoDimVert0: ++ addPixels(refLine[b1i], blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } + } + break; +- case twoDimVertR2: +- if (refLine[b1] + 2 < columns) { +- a0New = codingLine[++a0] = refLine[b1] + 2; +- ++b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ case twoDimVertL3: ++ addPixelsNeg(refLine[b1i] - 3, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } +- } else { +- a0New = codingLine[++a0] = columns; + } + break; + case twoDimVertL2: +- if (refLine[b1] - 2 > a0New || (a0 == 0 && refLine[b1] == 2)) { +- a0New = codingLine[++a0] = refLine[b1] - 2; +- --b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ addPixelsNeg(refLine[b1i] - 2, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; + } +- } +- break; +- case twoDimVertR3: +- if (refLine[b1] + 3 < columns) { +- a0New = codingLine[++a0] = refLine[b1] + 3; +- ++b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } +- } else { +- a0New = codingLine[++a0] = columns; + } + break; +- case twoDimVertL3: +- if (refLine[b1] - 3 > a0New || (a0 == 0 && refLine[b1] == 3)) { +- a0New = codingLine[++a0] = refLine[b1] - 3; +- --b1; +- while (refLine[b1] <= a0New && refLine[b1] < columns) { +- b1 += 2; ++ case twoDimVertL1: ++ addPixelsNeg(refLine[b1i] - 1, blackPixels); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < columns) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { ++ b1i += 2; + } + } + break; + case EOF: ++ addPixels(columns, 0); + eof = gTrue; +- codingLine[a0 = 0] = columns; +- return EOF; ++ break; + default: + error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1); ++ addPixels(columns, 0); + err = gTrue; + break; + } +- } while (codingLine[a0] < columns); ++ } + + // 1-D encoding + } else { +- codingLine[a0 = 0] = 0; +- while (1) { ++ codingLine[0] = 0; ++ a0i = 0; ++ blackPixels = 0; ++ while (codingLine[a0i] < columns) { + code1 = 0; +- do { +- code1 += code3 = getWhiteCode(); +- } while (code3 >= 64); +- codingLine[a0+1] = codingLine[a0] + code1; +- ++a0; +- if (codingLine[a0] >= columns) { +- break; +- } +- code2 = 0; +- do { +- code2 += code3 = getBlackCode(); +- } while (code3 >= 64); +- codingLine[a0+1] = codingLine[a0] + code2; +- ++a0; +- if (codingLine[a0] >= columns) { +- break; ++ if (blackPixels) { ++ do { ++ code1 += code3 = getBlackCode(); ++ } while (code3 >= 64); ++ } else { ++ do { ++ code1 += code3 = getWhiteCode(); ++ } while (code3 >= 64); + } ++ addPixels(codingLine[a0i] + code1, blackPixels); ++ blackPixels ^= 1; + } + } + +- if (codingLine[a0] != columns) { +- error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]); +- // force the row to be the correct length +- while (codingLine[a0] > columns) { +- --a0; +- } +- codingLine[++a0] = columns; +- err = gTrue; +- } +- + // byte-align the row + if (byteAlign) { + inputBits &= ~7; +@@ -1568,14 +1590,17 @@ int CCITTFaxStream::lookChar() { + // this if we know the stream contains end-of-line markers because + // the "just plow on" technique tends to work better otherwise + } else if (err && endOfLine) { +- do { ++ while (1) { ++ code1 = lookBits(13); + if (code1 == EOF) { + eof = gTrue; + return EOF; + } ++ if ((code1 >> 1) == 0x001) { ++ break; ++ } + eatBits(1); +- code1 = lookBits(13); +- } while ((code1 >> 1) != 0x001); ++ } + eatBits(12); + if (encoding > 0) { + eatBits(1); +@@ -1583,11 +1608,11 @@ int CCITTFaxStream::lookChar() { + } + } + +- a0 = 0; +- outputBits = codingLine[1] - codingLine[0]; +- if (outputBits == 0) { +- a0 = 1; +- outputBits = codingLine[2] - codingLine[1]; ++ // set up for output ++ if (codingLine[0] > 0) { ++ outputBits = codingLine[a0i = 0]; ++ } else { ++ outputBits = codingLine[a0i = 1]; + } + + ++row; +@@ -1595,39 +1620,43 @@ int CCITTFaxStream::lookChar() { + + // get a byte + if (outputBits >= 8) { +- ret = ((a0 & 1) == 0) ? 0xff : 0x00; +- if ((outputBits -= 8) == 0) { +- ++a0; +- if (codingLine[a0] < columns) { +- outputBits = codingLine[a0 + 1] - codingLine[a0]; +- } ++ buf = (a0i & 1) ? 0x00 : 0xff; ++ outputBits -= 8; ++ if (outputBits == 0 && codingLine[a0i] < columns) { ++ ++a0i; ++ outputBits = codingLine[a0i] - codingLine[a0i - 1]; + } + } else { + bits = 8; +- ret = 0; ++ buf = 0; + do { + if (outputBits > bits) { +- i = bits; +- bits = 0; +- if ((a0 & 1) == 0) { +- ret |= 0xff >> (8 - i); ++ buf <<= bits; ++ if (!(a0i & 1)) { ++ buf |= 0xff >> (8 - bits); + } +- outputBits -= i; ++ outputBits -= bits; ++ bits = 0; + } else { +- i = outputBits; +- bits -= outputBits; +- if ((a0 & 1) == 0) { +- ret |= (0xff >> (8 - i)) << bits; ++ buf <<= outputBits; ++ if (!(a0i & 1)) { ++ buf |= 0xff >> (8 - outputBits); + } ++ bits -= outputBits; + outputBits = 0; +- ++a0; +- if (codingLine[a0] < columns) { +- outputBits = codingLine[a0 + 1] - codingLine[a0]; ++ if (codingLine[a0i] < columns) { ++ ++a0i; ++ outputBits = codingLine[a0i] - codingLine[a0i - 1]; ++ } else if (bits > 0) { ++ buf <<= bits; ++ bits = 0; + } + } +- } while (bits > 0 && codingLine[a0] < columns); ++ } while (bits); ++ } ++ if (black) { ++ buf ^= 0xff; + } +- buf = black ? (ret ^ 0xff) : ret; + return buf; + } + +@@ -1669,6 +1698,9 @@ short CCITTFaxStream::getWhiteCode() { + code = 0; // make gcc happy + if (endOfBlock) { + code = lookBits(12); ++ if (code == EOF) { ++ return 1; ++ } + if ((code >> 5) == 0) { + p = &whiteTab1[code]; + } else { +@@ -1681,6 +1713,9 @@ short CCITTFaxStream::getWhiteCode() { + } else { + for (n = 1; n <= 9; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 9) { + code <<= 9 - n; + } +@@ -1692,6 +1727,9 @@ short CCITTFaxStream::getWhiteCode() { + } + for (n = 11; n <= 12; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 12) { + code <<= 12 - n; + } +@@ -1717,6 +1755,9 @@ short CCITTFaxStream::getBlackCode() { + code = 0; // make gcc happy + if (endOfBlock) { + code = lookBits(13); ++ if (code == EOF) { ++ return 1; ++ } + if ((code >> 7) == 0) { + p = &blackTab1[code]; + } else if ((code >> 9) == 0 && (code >> 7) != 0) { +@@ -1731,6 +1772,9 @@ short CCITTFaxStream::getBlackCode() { + } else { + for (n = 2; n <= 6; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 6) { + code <<= 6 - n; + } +@@ -1742,6 +1786,9 @@ short CCITTFaxStream::getBlackCode() { + } + for (n = 7; n <= 12; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 12) { + code <<= 12 - n; + } +@@ -1755,6 +1802,9 @@ short CCITTFaxStream::getBlackCode() { + } + for (n = 10; n <= 13; ++n) { + code = lookBits(n); ++ if (code == EOF) { ++ return 1; ++ } + if (n < 13) { + code <<= 13 - n; + } +@@ -1971,6 +2021,12 @@ void DCTStream::reset() { + // allocate a buffer for the whole image + bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; + bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight; ++ if (bufWidth <= 0 || bufHeight <= 0 || ++ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { ++ error(getPos(), "Invalid image size in DCT stream"); ++ y = height; ++ return; ++ } + for (i = 0; i < numComps; ++i) { + frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int)); + memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int)); +@@ -3041,6 +3097,11 @@ GBool DCTStream::readScanInfo() { + } + scanInfo.firstCoeff = str->getChar(); + scanInfo.lastCoeff = str->getChar(); ++ if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 || ++ scanInfo.firstCoeff > scanInfo.lastCoeff) { ++ error(getPos(), "Bad DCT coefficient numbers in scan info block"); ++ return gFalse; ++ } + c = str->getChar(); + scanInfo.ah = (c >> 4) & 0x0f; + scanInfo.al = c & 0x0f; +diff --git a/poppler/Stream.h b/poppler/Stream.h +index 647057f..5b176f8 100644 +--- a/poppler/Stream.h ++++ b/poppler/Stream.h +@@ -526,13 +526,15 @@ private: + int row; // current row + int inputBuf; // input buffer + int inputBits; // number of bits in input buffer +- short *refLine; // reference line changing elements +- int b1; // index into refLine +- short *codingLine; // coding line changing elements +- int a0; // index into codingLine ++ int *codingLine; // coding line changing elements ++ int *refLine; // reference line changing elements ++ int a0i; // index into codingLine ++ GBool err; // error on current line + int outputBits; // remaining ouput bits + int buf; // character buffer + ++ void addPixels(int a1, int black); ++ void addPixelsNeg(int a1, int black); + short getTwoDimCode(); + short getWhiteCode(); + short getBlackCode(); diff --git a/source/xlib/poppler/crash_fix.diff b/source/xlib/poppler/crash_fix.diff new file mode 100644 index 0000000..6061232 --- /dev/null +++ b/source/xlib/poppler/crash_fix.diff @@ -0,0 +1,91 @@ +diff --git a/poppler/Stream.cc b/poppler/Stream.cc +index 85d46bf..3e44e27 100644 +--- a/poppler/Stream.cc ++++ b/poppler/Stream.cc +@@ -1261,14 +1261,18 @@ CCITTFaxStream::CCITTFaxStream(Stream *strA, int encodingA, GBool endOfLineA, + // ---> max codingLine size = columns + 1 + // refLine has one extra guard entry at the end + // ---> max refLine size = columns + 2 +- codingLine = (int *)gmallocn(columns + 1, sizeof(int)); +- refLine = (int *)gmallocn(columns + 2, sizeof(int)); ++ codingLine = (int *)gmallocn_checkoverflow(columns + 1, sizeof(int)); ++ refLine = (int *)gmallocn_checkoverflow(columns + 2, sizeof(int)); + +- eof = gFalse; ++ if (codingLine != NULL && refLine != NULL) { ++ eof = gFalse; ++ codingLine[0] = columns; ++ } else { ++ eof = gTrue; ++ } + row = 0; + nextLine2D = encoding < 0; + inputBits = 0; +- codingLine[0] = columns; + a0i = 0; + outputBits = 0; + +@@ -1285,11 +1289,16 @@ void CCITTFaxStream::reset() { + short code1; + + str->reset(); +- eof = gFalse; ++ ++ if (codingLine != NULL && refLine != NULL) { ++ eof = gFalse; ++ codingLine[0] = columns; ++ } else { ++ eof = gTrue; ++ } + row = 0; + nextLine2D = encoding < 0; + inputBits = 0; +- codingLine[0] = columns; + a0i = 0; + outputBits = 0; + buf = EOF; +diff --git a/goo/gmem.cc b/goo/gmem.cc +index f1f8f5f..3dce8ea 100644 +--- a/goo/gmem.cc ++++ b/goo/gmem.cc +@@ -172,6 +172,24 @@ void *gmallocn(int nObjs, int objSize) GMEM_EXCEP { + return gmalloc(n); + } + ++void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP { ++ int n; ++ ++ if (nObjs == 0) { ++ return NULL; ++ } ++ n = nObjs * objSize; ++ if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { ++#if USE_EXCEPTIONS ++ throw GMemException(); ++#else ++ fprintf(stderr, "Bogus memory allocation size\n"); ++ return NULL; ++#endif ++ } ++ return gmalloc(n); ++} ++ + void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP { + int n; + +diff --git a/goo/gmem.h b/goo/gmem.h +index ebe1455..39c2334 100644 +--- a/goo/gmem.h ++++ b/goo/gmem.h +@@ -49,8 +49,11 @@ extern void *grealloc(void *p, size_t size) GMEM_EXCEP; + * and size. The result is similar to allocating nObjs * objSize + * bytes, but there is an additional error check that the total size + * doesn't overflow an int. ++ * The gmallocn_checkoverflow variant returns NULL instead of exiting ++ * the application if a overflow is detected + */ + extern void *gmallocn(int nObjs, int objSize) GMEM_EXCEP; ++extern void *gmallocn_checkoverflow(int nObjs, int objSize) GMEM_EXCEP; + extern void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP; + + /* _______________________________________________ Frugalware-git mailing list Frugalware-git@frugalware.org http://frugalware.org/mailman/listinfo/frugalware-git
