Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs.

[Mark H Weaver <mhw@netris.org>]

Leo Famulari <leo@famulari.name> writes:

> On Thu, Jan 12, 2017 at 07:59:40PM -0500, Mark H Weaver wrote:
>> Leo Famulari <leo@famulari.name> writes:
>> > If we can't graft it, we should build it on a branch on Hydra.
>> 
>> Here's what we can do: in addition to mupdf itself, we can also add a
>> graft for cups-filters (our only package that includes mupdf as an
>> input).  The replacement for cups-filters would change its mupdf input
>> to refer directly to the fixed version of mupdf.
>> 
>> What do you think?
>
> That's a good idea, and I started implementing it, but then I wondered
> how cups-filters was actually using mupdf. The cups-filters package is
> only 3.7 MB, while libmupdf.a is 44 MB.
>
> It turns out that the built cups-filters doesn't refer to mupdf at all;
> mupdf is not protected from the garbage collector if you install
> cups-filters.

Static linking copies segments of code and data from the *.a into
whatever is being linked (an executable or library).  So, buggy code
might be copied from libmupdf.a into 'cups-filters', with no references
to 'mupdf' remaining.  Also, the fact that cups-filters is smaller than
libmupdf.a doesn't prove that code wasn't copied from libmupdf.a.

      Thanks,
        Mark