From owner-svn-ports-all@freebsd.org Wed Oct 12 00:11:09 2016 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 441A8C0E4AB; Wed, 12 Oct 2016 00:11:09 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 086BDBFD; Wed, 12 Oct 2016 00:11:08 +0000 (UTC) (envelope-from feld@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u9C0B84b090968; Wed, 12 Oct 2016 00:11:08 GMT (envelope-from feld@FreeBSD.org) Received: (from feld@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u9C0B7xE090961; Wed, 12 Oct 2016 00:11:07 GMT (envelope-from feld@FreeBSD.org) Message-Id: <201610120011.u9C0B7xE090961@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: feld set sender to feld@FreeBSD.org using -f From: Mark Felder Date: Wed, 12 Oct 2016 00:11:07 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r423807 - in head/graphics: llpp mupdf mupdf/files zathura-pdf-mupdf X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Oct 2016 00:11:09 -0000 Author: feld Date: Wed Oct 12 00:11:07 2016 New Revision: 423807 URL: https://svnweb.freebsd.org/changeset/ports/423807 Log: graphics/mupdf: Patch to resolve CVEs PR: 212207 MFH: 2016Q4 Security: CVE-2016-6525 Security: CVE-2016-6265 Added: head/graphics/mupdf/files/patch-source_pdf_pdf-shade.c (contents, props changed) head/graphics/mupdf/files/patch-source_pdf_pdf-xref.c (contents, props changed) Modified: head/graphics/llpp/Makefile head/graphics/mupdf/Makefile head/graphics/mupdf/files/patch-scripts_fontdump.c head/graphics/mupdf/files/patch-source__fitz__load-jpx.c head/graphics/zathura-pdf-mupdf/Makefile Modified: head/graphics/llpp/Makefile ============================================================================== --- head/graphics/llpp/Makefile Wed Oct 12 00:10:51 2016 (r423806) +++ head/graphics/llpp/Makefile Wed Oct 12 00:11:07 2016 (r423807) @@ -3,7 +3,7 @@ PORTNAME= llpp PORTVERSION= 22 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= graphics MASTER_SITES= http://repo.or.cz/llpp.git/snapshot/ DISTNAME= 561dc5673cea431e930668b0d87b0c4b31a36b39 Modified: head/graphics/mupdf/Makefile ============================================================================== --- head/graphics/mupdf/Makefile Wed Oct 12 00:10:51 2016 (r423806) +++ head/graphics/mupdf/Makefile Wed Oct 12 00:11:07 2016 (r423807) @@ -3,6 +3,7 @@ PORTNAME= mupdf PORTVERSION= 1.9a +PORTREVISION= 1 DISTVERSIONSUFFIX= -source PORTEPOCH= 1 CATEGORIES= graphics Modified: head/graphics/mupdf/files/patch-scripts_fontdump.c ============================================================================== --- head/graphics/mupdf/files/patch-scripts_fontdump.c Wed Oct 12 00:10:51 2016 (r423806) +++ head/graphics/mupdf/files/patch-scripts_fontdump.c Wed Oct 12 00:11:07 2016 (r423807) @@ -1,4 +1,4 @@ ---- scripts/fontdump.c.orig 2016-06-12 09:11:56 UTC +--- scripts/fontdump.c.orig 2016-04-21 11:14:32 UTC +++ scripts/fontdump.c @@ -50,7 +50,6 @@ main(int argc, char **argv) fprintf(fo, "#ifndef __STRICT_ANSI__\n"); Modified: head/graphics/mupdf/files/patch-source__fitz__load-jpx.c ============================================================================== --- head/graphics/mupdf/files/patch-source__fitz__load-jpx.c Wed Oct 12 00:10:51 2016 (r423806) +++ head/graphics/mupdf/files/patch-source__fitz__load-jpx.c Wed Oct 12 00:11:07 2016 (r423807) @@ -1,4 +1,4 @@ ---- source/fitz/load-jpx.c.orig 2015-04-16 08:57:45 UTC +--- source/fitz/load-jpx.c.orig 2016-04-21 11:14:32 UTC +++ source/fitz/load-jpx.c @@ -1,14 +1,6 @@ #include "mupdf/fitz.h" Added: head/graphics/mupdf/files/patch-source_pdf_pdf-shade.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/graphics/mupdf/files/patch-source_pdf_pdf-shade.c Wed Oct 12 00:11:07 2016 (r423807) @@ -0,0 +1,17 @@ +$OpenBSD: patch-source_pdf_pdf-shade_c,v 1.1 2016/08/27 20:58:48 jca Exp $ + + CVE-2016-6525 + + http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e;hp=fa1936405b6a84e5c9bb440912c23d532772f958 + +--- source/pdf/pdf-shade.c.orig 2016-04-21 11:14:32 UTC ++++ source/pdf/pdf-shade.c +@@ -206,7 +206,7 @@ pdf_load_mesh_params(fz_context *ctx, pd + obj = pdf_dict_get(ctx, dict, PDF_NAME_Decode); + if (pdf_array_len(ctx, obj) >= 6) + { +- n = (pdf_array_len(ctx, obj) - 4) / 2; ++ n = fz_mini(FZ_MAX_COLORS, (pdf_array_len(ctx, obj) - 4) / 2); + shade->u.m.x0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 0)); + shade->u.m.x1 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 1)); + shade->u.m.y0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 2)); Added: head/graphics/mupdf/files/patch-source_pdf_pdf-xref.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/graphics/mupdf/files/patch-source_pdf_pdf-xref.c Wed Oct 12 00:11:07 2016 (r423807) @@ -0,0 +1,25 @@ +$OpenBSD: patch-source_pdf_pdf-xref_c,v 1.1 2016/08/27 20:58:48 jca Exp $ + + CVE-2016-6265 + + http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa1936405b6a84e5c9bb440912c23d532772f958 + +--- source/pdf/pdf-xref.c.orig 2016-04-21 11:14:32 UTC ++++ source/pdf/pdf-xref.c +@@ -1191,8 +1191,14 @@ pdf_load_xref(fz_context *ctx, pdf_docum + fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", (int)entry->ofs, i); + } + if (entry->type == 'o') +- if (entry->ofs <= 0 || entry->ofs >= xref_len || pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n') +- fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i); ++ { ++ /* Read this into a local variable here, because pdf_get_xref_entry ++ * may solidify the xref, hence invalidating "entry", meaning we ++ * need a stashed value for the throw. */ ++ fz_off_t ofs = entry->ofs; ++ if (ofs <= 0 || ofs >= xref_len || pdf_get_xref_entry(ctx, doc, ofs)->type != 'n') ++ fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i); ++ } + } + } + Modified: head/graphics/zathura-pdf-mupdf/Makefile ============================================================================== --- head/graphics/zathura-pdf-mupdf/Makefile Wed Oct 12 00:10:51 2016 (r423806) +++ head/graphics/zathura-pdf-mupdf/Makefile Wed Oct 12 00:11:07 2016 (r423807) @@ -3,7 +3,7 @@ PORTNAME= zathura-pdf-mupdf PORTVERSION= 0.3.0 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= graphics MASTER_SITES= http://pwmt.org/projects/zathura-pdf-mupdf/download/