Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs.

[Leo Famulari <leo@famulari.name>]

[-- Attachment #1: Type: text/plain, Size: 2760 bytes --]

On Thu, Jan 12, 2017 at 07:59:40PM -0500, Mark H Weaver wrote:
> Leo Famulari <leo@famulari.name> writes:
> > If we can't graft it, we should build it on a branch on Hydra.
> 
> Here's what we can do: in addition to mupdf itself, we can also add a
> graft for cups-filters (our only package that includes mupdf as an
> input).  The replacement for cups-filters would change its mupdf input
> to refer directly to the fixed version of mupdf.
> 
> What do you think?

That's a good idea, and I started implementing it, but then I wondered
how cups-filters was actually using mupdf. The cups-filters package is
only 3.7 MB, while libmupdf.a is 44 MB.

It turns out that the built cups-filters doesn't refer to mupdf at all;
mupdf is not protected from the garbage collector if you install
cups-filters.

I found two source files that use mupdf, 'filter/mupdftoraster.c' and
'filter/pdftops.c'.

From the cups-filters ./configure summary [0]:

------
mutool:          yes
mutool-path:     system
ippfind-path:    system
imagefilters:    yes
jpeg:            yes
pdftocairo-path: system
pdftops:         hybrid
------

The pdftops hybrid mode uses Poppler and Ghostscript, so we're not
affected here:

------
  if (renderer == HYBRID)
  {
    if (make_model[0] &&
        (!strncasecmp(make_model, "Brother", 7) ||
         !strncasecmp(make_model, "Dell", 4) ||
         strcasestr(make_model, "Minolta") ||
         (!strncasecmp(make_model, "Apple", 5) &&
          (ptr = strcasestr(make_model, "LaserWriter")) &&
          (ptr = strcasestr(ptr + 11, "12")) &&
          (ptr = strcasestr(ptr + 2, "640")))))
    {    
      fprintf(stderr, "DEBUG: Switching to Poppler's pdftops instead of Ghostscript for Brother, Minolta, Konica Minolta, Dell, and Apple LaserWriter 12/640 to work around bugs in the printer's PS interpreters\n");
      renderer = PDFTOPS;
    }    
    else 
      renderer = GS;
[...]
------
source:
<http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/annotate/head:/filter/pdftops.c#L467>

'filter/mupdfraster.c' involves the use of the mutool program. Does
the configuration option 'mutool-path: system' mean that it looks for
mutool on PATH?

config.log [1] has:
#define CUPS_MUTOOL "mutool"

And I can't find a store reference for mupdf with `hexdump -C
lib/cups/filter/mupdftoraster`; that's only file that `grep -ri mutool`
matches. 

Should we make cups-filters refer to mutool by an absolute path?

[0]
https://mirror.hydra.gnu.org/log/xlb7k5l3l4gq12z4fmg5i59y5hdzn472-cups-filters-1.13.1

[1]
config.log also has this line:

#define CUPS_POPPLER_PDFTOPS "/usr/bin/pdftops"'

This does get into the built 'lib/cups/filter/pdftops'.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]