Date: Wed, 7 Dec 2005 11:36:24 -0200 (BRST) From: Marcus Alves Grando <mnag@FreeBSD.org> To: FreeBSD-gnats-submit@FreeBSD.org Cc: erwin@FreeBSD.org Subject: ports/90069: Update port: textproc/pdftohtml xpdf security issues Message-ID: <20051207133624.4287B8F@marcus.grupos.com.br> Resent-Message-ID: <200512071340.jB7De3XM098648@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 90069 >Category: ports >Synopsis: Update port: textproc/pdftohtml xpdf security issues >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Wed Dec 07 13:40:03 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Marcus Alves Grando >Release: FreeBSD 6.0-STABLE i386 >Organization: Grupos Internet S/A >Environment: System: FreeBSD marcus.grupos.com.br 6.0-STABLE FreeBSD 6.0-STABLE #16: Tue Dec 6 00:43:44 BRST 2005 root@marcus.grupos.com.br:/usr/obj/usr/src/sys/MARCUS i386 >Description: Backport xpdf vendor patch (affected part) Bump PORTREVISION portlint(1) Security: http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities http://secunia.com/advisories/17897/ CVE-2005-3191, CVE-2005-3192 >How-To-Repeat: >Fix: --- pdftohtml.patch begins here --- Index: Makefile =================================================================== RCS file: /home/pcvs/ports/textproc/pdftohtml/Makefile,v retrieving revision 1.16 diff -u -r1.16 Makefile --- Makefile 28 Jan 2005 13:51:09 -0000 1.16 +++ Makefile 7 Dec 2005 13:33:31 -0000 @@ -8,7 +8,7 @@ PORTNAME= pdftohtml PORTVERSION= 0.36 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= textproc MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} MASTER_SITE_SUBDIR= ${PORTNAME} @@ -22,7 +22,7 @@ GSPORT?= print/ghostscript-gnu .endif -RUN_DEPENDS= ${LOCALBASE}/bin/gs:${PORTSDIR}/${GSPORT} +RUN_DEPENDS+= ${LOCALBASE}/bin/gs:${PORTSDIR}/${GSPORT} PLIST_FILES= bin/pdftohtml WRKSRC= ${WRKDIR}/${DISTNAME} Index: files/patch-SA17897 =================================================================== RCS file: files/patch-SA17897 diff -N files/patch-SA17897 --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ files/patch-SA17897 7 Dec 2005 13:33:31 -0000 @@ -0,0 +1,93 @@ +--- xpdf/Stream.cc.orig Mon May 17 16:37:57 2004 ++++ xpdf/Stream.cc Tue Dec 6 18:05:14 2005 +@@ -407,18 +407,33 @@ + + StreamPredictor::StreamPredictor(Stream *strA, int predictorA, + int widthA, int nCompsA, int nBitsA) { ++ int totalBits; ++ + str = strA; + predictor = predictorA; + width = widthA; + nComps = nCompsA; + nBits = nBitsA; ++ predLine = NULL; ++ ok = gFalse; + + nVals = width * nComps; ++ totalBits = nVals * nBits; ++ if (totalBits == 0 || ++ (totalBits / nBits) / nComps != width || ++ totalBits + 7 < 0) { ++ return; ++ } + pixBytes = (nComps * nBits + 7) >> 3; +- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; ++ rowBytes = ((totalBits + 7) >> 3) + pixBytes; ++ if (rowBytes < 0) { ++ return; ++ } + predLine = (Guchar *)gmalloc(rowBytes); + memset(predLine, 0, rowBytes); + predIdx = rowBytes; ++ ++ ok = gTrue; + } + + StreamPredictor::~StreamPredictor() { +@@ -1012,6 +1027,10 @@ + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +@@ -2897,6 +2916,14 @@ + height = read16(); + width = read16(); + numComps = str->getChar(); ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } ++ if (numComps <= 0 || numComps > 4) { ++ error(getPos(), "Bad number of components in DCT stream", prec); ++ return gFalse; ++ } + if (prec != 8) { + error(getPos(), "Bad DCT precision %d", prec); + return gFalse; +@@ -3255,6 +3282,10 @@ + FilterStream(strA) { + if (predictor != 1) { + pred = new StreamPredictor(this, predictor, columns, colors, bits); ++ if (!pred->isOk()) { ++ delete pred; ++ pred = NULL; ++ } + } else { + pred = NULL; + } +--- xpdf/Stream.h.orig Mon May 17 16:37:57 2004 ++++ xpdf/Stream.h Tue Dec 6 18:05:14 2005 +@@ -233,6 +233,8 @@ + + ~StreamPredictor(); + ++ GBool isOk() { return ok; } ++ + int lookChar(); + int getChar(); + +@@ -250,6 +252,7 @@ + int rowBytes; // bytes per line + Guchar *predLine; // line buffer + int predIdx; // current index in predLine ++ GBool ok; + }; + + //------------------------------------------------------------------------ --- pdftohtml.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051207133624.4287B8F>