all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
blob 1fa6dc34669e9c3deb680ebb9d9f65e7c97ae3da 2942 bytes (raw)
name: gnu/packages/patches/mupdf-CVE-2017-5991.patch 	 # note: path name is non-authoritative(*)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
 
Fix CVE-2017-5991:

https://bugs.ghostscript.com/show_bug.cgi?id=697500
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5991
https://security-tracker.debian.org/tracker/CVE-2017-5991

Patch lifted from upstream source repository:

http://git.ghostscript.com/?p=mupdf.git;h=1912de5f08e90af1d9d0a9791f58ba3afdb9d465

From 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 Mon Sep 17 00:00:00 2001
From: Robin Watts <robin.watts@artifex.com>
Date: Thu, 9 Feb 2017 15:49:15 +0000
Subject: [PATCH] Bug 697500: Fix NULL ptr access.

Cope better with errors during rendering - avoid letting the
gstate stack get out of sync.

This avoids us ever getting into the situation of popping
a clip when we should be popping a mask or a group. This was
causing an unexpected case in the painting.
---
 source/pdf/pdf-op-run.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/source/pdf/pdf-op-run.c b/source/pdf/pdf-op-run.c
index a3ea895d..f1eac8d3 100644
--- a/source/pdf/pdf-op-run.c
+++ b/source/pdf/pdf-op-run.c
@@ -1213,6 +1213,7 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 	pdf_run_processor *pr = (pdf_run_processor *)proc;
 	pdf_gstate *gstate = NULL;
 	int oldtop = 0;
+	int oldbot = -1;
 	fz_matrix local_transform = *transform;
 	softmask_save softmask = { NULL };
 	int gparent_save;
@@ -1232,16 +1233,17 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 	fz_var(cleanup_state);
 	fz_var(gstate);
 	fz_var(oldtop);
+	fz_var(oldbot);
 
 	gparent_save = pr->gparent;
 	pr->gparent = pr->gtop;
+	oldtop = pr->gtop;
 
 	fz_try(ctx)
 	{
 		pdf_gsave(ctx, pr);
 
 		gstate = pr->gstate + pr->gtop;
-		oldtop = pr->gtop;
 
 		pdf_xobject_bbox(ctx, xobj, &xobj_bbox);
 		pdf_xobject_matrix(ctx, xobj, &xobj_matrix);
@@ -1302,12 +1304,25 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 
 		doc = pdf_get_bound_document(ctx, xobj->obj);
 
+		oldbot = pr->gbot;
+		pr->gbot = pr->gtop;
+
 		pdf_process_contents(ctx, (pdf_processor*)pr, doc, resources, xobj->obj, NULL);
 	}
 	fz_always(ctx)
 	{
+		/* Undo any gstate mismatches due to the pdf_process_contents call */
+		if (oldbot != -1)
+		{
+			while (pr->gtop > pr->gbot)
+			{
+				pdf_grestore(ctx, pr);
+			}
+			pr->gbot = oldbot;
+		}
+
 		if (cleanup_state >= 3)
-			pdf_grestore(ctx, pr); /* Remove the clippath */
+			pdf_grestore(ctx, pr); /* Remove the state we pushed for the clippath */
 
 		/* wrap up transparency stacks */
 		if (transparency)
@@ -1341,13 +1356,8 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 		pr->gstate[pr->gparent].ctm = gparent_save_ctm;
 		pr->gparent = gparent_save;
 
-		if (gstate)
-		{
-			while (oldtop < pr->gtop)
-				pdf_grestore(ctx, pr);
-
+		while (oldtop < pr->gtop)
 			pdf_grestore(ctx, pr);
-		}
 
 		pdf_unmark_obj(ctx, xobj->obj);
 	}
-- 
2.12.0


debug log:

solving 1fa6dc346 ...
found 1fa6dc346 in https://git.savannah.gnu.org/cgit/guix.git

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.