me/guix
Archived
1
0
Fork 0
Code Activity

gnu: mupdf: Actually fix CVE-2017-15587.

Browse source 
The original fix could be removed by an optimizing compiler.

* gnu/packages/patches/mupdf-CVE-2017-15587.patch: Revise patch.
This commit is contained in:
Leo Famulari 2017-11-11 22:29:44 -05:00
parent 07cc9245e6
commit 882d921344
No known key found for this signature in database
GPG key ID: 2646FA30BACA7F08
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
gnu/packages/patches/mupdf-CVE-2017-15587.patch
View file

@ -3,11 +3,12 @@ Fix CVE-2017-15587.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15587 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15587
https://nandynarwhals.org/CVE-2017-15587/ https://nandynarwhals.org/CVE-2017-15587/
Copied from upstream: This patch is these two upstream commits squashed together:
<https://git.ghostscript.com/?p=mupdf.git;h=82df2631d7d0446b206ea6b434ea609b6c28b0e8> <https://git.ghostscript.com/?p=mupdf.git;h=82df2631d7d0446b206ea6b434ea609b6c28b0e8>
<https://git.ghostscript.com/?p=mupdf.git;h=d18bc728e46c5a5708f14d27c2b6c44e1d0c3232>
diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
index 66bd0ed..6292793 100644 index 66bd0ed8..89499e61 100644
--- a/source/pdf/pdf-xref.c --- a/source/pdf/pdf-xref.c
+++ b/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c
@@ -924,7 +924,7 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, fz @@ -924,7 +924,7 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, fz
@ -15,7 +16,10 @@ index 66bd0ed..6292793 100644
int i, n; int i, n;
- if (i0 < 0 || i1 < 0) - if (i0 < 0 || i1 < 0)
+ if (i0 < 0 || i1 < 0 || (i0+i1) < 0) + if (i0 < 0 || i1 < 0 || i0 > INT_MAX - i1)
fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index"); fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index");
//if (i0 + i1 > pdf_xref_len(ctx, doc)) //if (i0 + i1 > pdf_xref_len(ctx, doc))
// fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries"); // fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries");
--
2.15.0