fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349
(cherry picked from commit e17a8adea9404ab8c90fc5bb575e8210d1a36d6e)
This commit is contained in:
parent
990ab80ea3
commit
66ca6a7f90
37
backport-CVE-2020-23804.patch
Normal file
37
backport-CVE-2020-23804.patch
Normal file
@ -0,0 +1,37 @@
|
||||
From ec8a43c8df29fdd6f1228276160898ccd9401c92 Mon Sep 17 00:00:00 2001
|
||||
From: Albert Astals Cid <aacid@kde.org>
|
||||
Date: Sat, 4 Jul 2020 00:08:55 +0200
|
||||
Subject: [PATCH] Fix stack overflow with specially crafted files
|
||||
|
||||
The file is not malformed per se, it just has a huge XRefStm chain
|
||||
and we end up exhausting the stack space trying to parse them all.
|
||||
|
||||
Having more than 4096 XRefStm seems like won't really happen on real
|
||||
life so break the flow at that point
|
||||
|
||||
Fixes #936
|
||||
|
||||
---
|
||||
poppler/XRef.cc | 6 ++++++
|
||||
1 file changed, 6 insertions(+)
|
||||
|
||||
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
|
||||
index 5943bdd..fe8936e 100644
|
||||
--- a/poppler/XRef.cc
|
||||
+++ b/poppler/XRef.cc
|
||||
@@ -633,6 +633,12 @@ bool XRef::readXRefTable(Parser *parser, Goffset *pos, std::vector<Goffset> *fol
|
||||
ok = false;
|
||||
}
|
||||
}
|
||||
+ // Arbitrary limit because otherwise we exhaust the stack
|
||||
+ // calling readXRef + readXRefTable
|
||||
+ if (followedXRefStm->size() > 4096) {
|
||||
+ error(errSyntaxError, -1, "File has more than 4096 XRefStm, aborting");
|
||||
+ ok = false;
|
||||
+ }
|
||||
if (ok) {
|
||||
followedXRefStm->push_back(pos2);
|
||||
readXRef(&pos2, followedXRefStm, xrefStreamObjsNum);
|
||||
--
|
||||
2.33.0
|
||||
|
||||
26
backport-CVE-2022-37050.patch
Normal file
26
backport-CVE-2022-37050.patch
Normal file
@ -0,0 +1,26 @@
|
||||
From dcd5bd8238ea448addd102ff045badd0aca1b990 Mon Sep 17 00:00:00 2001
|
||||
From: crt <chluo@cse.cuhk.edu.hk>
|
||||
Date: Wed, 27 Jul 2022 08:40:02 +0000
|
||||
Subject: [PATCH] pdfseparate: Check XRef's Catalog for being a Dict
|
||||
|
||||
---
|
||||
poppler/PDFDoc.cc | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
|
||||
index 6e4b0f4..43de80e 100644
|
||||
--- a/poppler/PDFDoc.cc
|
||||
+++ b/poppler/PDFDoc.cc
|
||||
@@ -948,6 +948,10 @@ int PDFDoc::savePageAs(const GooString *name, int pageNo)
|
||||
|
||||
// get and mark output intents etc.
|
||||
Object catObj = getXRef()->getCatalog();
|
||||
+ if (!catObj.isDict()) {
|
||||
+ error(errSyntaxError, -1, "XRef's Catelog is not a dictionary");
|
||||
+ return errOpenFile;
|
||||
+ }
|
||||
Dict *catDict = catObj.getDict();
|
||||
Object pagesObj = catDict->lookup("Pages");
|
||||
Object afObj = catDict->lookupNF("AcroForm").copy();
|
||||
--
|
||||
2.33.0
|
||||
46
backport-CVE-2022-37051.patch
Normal file
46
backport-CVE-2022-37051.patch
Normal file
@ -0,0 +1,46 @@
|
||||
From 4631115647c1e4f0482ffe0491c2f38d2231337b Mon Sep 17 00:00:00 2001
|
||||
From: crt <chluo@cse.cuhk.edu.hk>
|
||||
Date: Fri, 29 Jul 2022 20:51:11 +0000
|
||||
Subject: [PATCH] Check isDict before calling getDict
|
||||
|
||||
Issue #1276
|
||||
---
|
||||
utils/pdfunite.cc | 16 ++++++++++++++++
|
||||
1 file changed, 16 insertions(+)
|
||||
|
||||
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
|
||||
index a8116e3..9735096 100644
|
||||
--- a/utils/pdfunite.cc
|
||||
+++ b/utils/pdfunite.cc
|
||||
@@ -210,6 +210,14 @@ int main (int argc, char *argv[])
|
||||
Object ocObj;
|
||||
if (docs.size() >= 1) {
|
||||
Object catObj = docs[0]->getXRef()->getCatalog();
|
||||
+ if(!catObj.isDict()){
|
||||
+ fclose(f);
|
||||
+ delete yRef;
|
||||
+ delete countRef;
|
||||
+ delete outStr;
|
||||
+ error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
|
||||
+ return -1;
|
||||
+ }
|
||||
Dict *catDict = catObj.getDict();
|
||||
intents = catDict->lookup("OutputIntents");
|
||||
afObj = catDict->lookupNF("AcroForm").copy();
|
||||
@@ -310,6 +318,14 @@ int main (int argc, char *argv[])
|
||||
}
|
||||
}
|
||||
Object pageCatObj = docs[i]->getXRef()->getCatalog();
|
||||
+ if(!pageCatObj.isDict()){
|
||||
+ fclose(f);
|
||||
+ delete yRef;
|
||||
+ delete countRef;
|
||||
+ delete outStr;
|
||||
+ error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
|
||||
+ return -1;
|
||||
+ }
|
||||
Dict *pageCatDict = pageCatObj.getDict();
|
||||
Object pageNames = pageCatDict->lookup("Names");
|
||||
if (!pageNames.isNull() && pageNames.isDict()) {
|
||||
--
|
||||
2.33.0
|
||||
245
backport-CVE-2022-37052.patch
Normal file
245
backport-CVE-2022-37052.patch
Normal file
@ -0,0 +1,245 @@
|
||||
From 8677500399fc2548fa816b619580c2c07915a98c Mon Sep 17 00:00:00 2001
|
||||
From: Albert Astals Cid <aacid@kde.org>
|
||||
Date: Fri, 29 Jul 2022 23:28:35 +0200
|
||||
Subject: [PATCH] pdfseparate: Account for XRef::add failing because we run out
|
||||
of memory
|
||||
|
||||
Fixes #1278
|
||||
---
|
||||
poppler/PDFDoc.cc | 63 ++++++++++++++++++++++++++++++++++++-----------
|
||||
poppler/PDFDoc.h | 6 ++---
|
||||
poppler/XRef.cc | 11 +++++++--
|
||||
poppler/XRef.h | 4 +--
|
||||
4 files changed, 62 insertions(+), 22 deletions(-)
|
||||
|
||||
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
|
||||
index 43de80e..fcc17a4 100644
|
||||
--- a/poppler/PDFDoc.cc
|
||||
+++ b/poppler/PDFDoc.cc
|
||||
@@ -962,7 +962,14 @@ int PDFDoc::savePageAs(const GooString *name, int pageNo)
|
||||
Object resourcesObj = pagesDict->lookup("Resources");
|
||||
if (resourcesObj.isDict())
|
||||
markPageObjects(resourcesObj.getDict(), yRef, countRef, 0, refPage->num, rootNum + 2);
|
||||
- markPageObjects(catDict, yRef, countRef, 0, refPage->num, rootNum + 2);
|
||||
+ if (!markPageObjects(catDict, yRef, countRef, 0, refPage->num, rootNum + 2)) {
|
||||
+ fclose(f);
|
||||
+ delete yRef;
|
||||
+ delete countRef;
|
||||
+ delete outStr;
|
||||
+ error(errSyntaxError, -1, "markPageObjects failed");
|
||||
+ return errDamaged;
|
||||
+ }
|
||||
|
||||
Dict *pageDict = page.getDict();
|
||||
if (resourcesObj.isNull() && !pageDict->hasKey("Resources")) {
|
||||
@@ -1681,7 +1688,7 @@ void PDFDoc::writeHeader(OutStream *outStr, int major, int minor)
|
||||
outStr->printf("%%%c%c%c%c\n", 0xE2, 0xE3, 0xCF, 0xD3);
|
||||
}
|
||||
|
||||
-void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
+bool PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
{
|
||||
bool deleteSet = false;
|
||||
if (!alreadyMarkedDicts) {
|
||||
@@ -1692,7 +1699,7 @@ void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned
|
||||
if (alreadyMarkedDicts->find(dict) != alreadyMarkedDicts->end()) {
|
||||
error(errSyntaxWarning, -1, "PDFDoc::markDictionnary: Found recursive dicts");
|
||||
if (deleteSet) delete alreadyMarkedDicts;
|
||||
- return;
|
||||
+ return true;
|
||||
} else {
|
||||
alreadyMarkedDicts->insert(dict);
|
||||
}
|
||||
@@ -1701,7 +1708,10 @@ void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned
|
||||
const char *key = dict->getKey(i);
|
||||
if (strcmp(key, "Annots") != 0) {
|
||||
Object obj1 = dict->getValNF(i).copy();
|
||||
- markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
+ }
|
||||
} else {
|
||||
Object annotsObj = dict->getValNF(i).copy();
|
||||
if (!annotsObj.isNull()) {
|
||||
@@ -1713,9 +1723,11 @@ void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned
|
||||
if (deleteSet) {
|
||||
delete alreadyMarkedDicts;
|
||||
}
|
||||
+
|
||||
+ return true;
|
||||
}
|
||||
|
||||
-void PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
+bool PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
{
|
||||
Array *array;
|
||||
|
||||
@@ -1724,25 +1736,37 @@ void PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
|
||||
array = obj->getArray();
|
||||
for (int i=0; i<array->getLength(); i++) {
|
||||
Object obj1 = array->getNF(i).copy();
|
||||
- markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
+ }
|
||||
}
|
||||
break;
|
||||
- case objDict:
|
||||
- markDictionnary (obj->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
- break;
|
||||
+ case objDict: {
|
||||
+ const bool success = markDictionnary(obj->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
+ }
|
||||
+ } break;
|
||||
case objStream:
|
||||
{
|
||||
Stream *stream = obj->getStream();
|
||||
- markDictionnary (stream->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ const bool success = markDictionnary(stream->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
+ }
|
||||
}
|
||||
break;
|
||||
case objRef:
|
||||
{
|
||||
if (obj->getRef().num + (int) numOffset >= xRef->getNumObjects() || xRef->getEntry(obj->getRef().num + numOffset)->type == xrefEntryFree) {
|
||||
if (getXRef()->getEntry(obj->getRef().num)->type == xrefEntryFree) {
|
||||
- return; // already marked as free => should be replaced
|
||||
+ return true; // already marked as free => should be replaced
|
||||
+ }
|
||||
+ const bool success = xRef->add(obj->getRef().num + numOffset, obj->getRef().gen, 0, true);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
}
|
||||
- xRef->add(obj->getRef().num + numOffset, obj->getRef().gen, 0, true);
|
||||
if (getXRef()->getEntry(obj->getRef().num)->type == xrefEntryCompressed) {
|
||||
xRef->getEntry(obj->getRef().num + numOffset)->type = xrefEntryCompressed;
|
||||
}
|
||||
@@ -1758,12 +1782,17 @@ void PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
|
||||
break;
|
||||
}
|
||||
Object obj1 = getXRef()->fetch(obj->getRef());
|
||||
- markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum);
|
||||
+ const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
+ }
|
||||
}
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
+
|
||||
+ return true;
|
||||
}
|
||||
|
||||
void PDFDoc::replacePageDict(int pageNo, int rotate,
|
||||
@@ -1803,7 +1832,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate,
|
||||
getXRef()->setModifiedObject(&page, *refPage);
|
||||
}
|
||||
|
||||
-void PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
+bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
{
|
||||
pageDict->remove("OpenAction");
|
||||
pageDict->remove("Outlines");
|
||||
@@ -1818,9 +1847,13 @@ void PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigne
|
||||
strcmp(key, "Annots") != 0 &&
|
||||
strcmp(key, "P") != 0 &&
|
||||
strcmp(key, "Root") != 0) {
|
||||
- markObject(&value, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ const bool success = markObject(&value, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
|
||||
+ if (unlikely(!success)) {
|
||||
+ return false;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
+ return true;
|
||||
}
|
||||
|
||||
bool PDFDoc::markAnnotations(Object *annotsObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts) {
|
||||
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
|
||||
index 80b6d60..b504004 100644
|
||||
--- a/poppler/PDFDoc.h
|
||||
+++ b/poppler/PDFDoc.h
|
||||
@@ -333,7 +333,7 @@ public:
|
||||
|
||||
// rewrite pageDict with MediaBox, CropBox and new page CTM
|
||||
void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
|
||||
- void markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
+ bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
|
||||
// write all objects used by pageDict to outStr
|
||||
@@ -355,8 +355,8 @@ public:
|
||||
|
||||
private:
|
||||
// insert referenced objects in XRef
|
||||
- void markDictionnary (Dict* dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts);
|
||||
- void markObject (Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
+ bool markDictionnary (Dict* dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts);
|
||||
+ bool markObject (Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
static void writeDictionnary (Dict* dict, OutStream* outStr, XRef *xRef, unsigned int numOffset, unsigned char *fileKey,
|
||||
CryptAlgorithm encAlgorithm, int keyLength, Ref ref, std::set<Dict*> *alreadyWrittenDicts);
|
||||
|
||||
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
|
||||
index 9d6b80f..5943bdd 100644
|
||||
--- a/poppler/XRef.cc
|
||||
+++ b/poppler/XRef.cc
|
||||
@@ -1298,11 +1298,17 @@ void XRef::add(Ref ref, Goffset offs, bool used)
|
||||
add(ref.num, ref.gen, offs, used);
|
||||
}
|
||||
|
||||
-void XRef::add(int num, int gen, Goffset offs, bool used) {
|
||||
+bool XRef::add(int num, int gen, Goffset offs, bool used) {
|
||||
xrefLocker();
|
||||
if (num >= size) {
|
||||
if (num >= capacity) {
|
||||
- entries = (XRefEntry *)greallocn(entries, num + 1, sizeof(XRefEntry));
|
||||
+ entries = (XRefEntry *)greallocn_checkoverflow(entries, num + 1, sizeof(XRefEntry));
|
||||
+ if (unlikely(entries == nullptr)) {
|
||||
+ size = 0;
|
||||
+ capacity = 0;
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
capacity = num + 1;
|
||||
}
|
||||
for (int i = size; i < num + 1; ++i) {
|
||||
@@ -1325,6 +1331,7 @@ void XRef::add(int num, int gen, Goffset offs, bool used) {
|
||||
e->type = xrefEntryFree;
|
||||
e->offset = 0;
|
||||
}
|
||||
+ return true;
|
||||
}
|
||||
|
||||
void XRef::setModifiedObject (const Object* o, Ref r) {
|
||||
diff --git a/poppler/XRef.h b/poppler/XRef.h
|
||||
index 5c0238b..207f02a 100644
|
||||
--- a/poppler/XRef.h
|
||||
+++ b/poppler/XRef.h
|
||||
@@ -14,7 +14,7 @@
|
||||
// under GPL version 2 or later
|
||||
//
|
||||
// Copyright (C) 2005 Brad Hards <bradh@frogmouth.net>
|
||||
-// Copyright (C) 2006, 2008, 2010-2013, 2017-2020 Albert Astals Cid <aacid@kde.org>
|
||||
+// Copyright (C) 2006, 2008, 2010-2013, 2017-2022 Albert Astals Cid <aacid@kde.org>
|
||||
// Copyright (C) 2007-2008 Julien Rebetez <julienr@svn.gnome.org>
|
||||
// Copyright (C) 2007 Carlos Garcia Campos <carlosgc@gnome.org>
|
||||
// Copyright (C) 2010 Ilya Gorenbein <igorenbein@finjan.com>
|
||||
@@ -196,7 +196,7 @@ public:
|
||||
void setModifiedObject(const Object* o, Ref r);
|
||||
Ref addIndirectObject (const Object* o);
|
||||
void removeIndirectObject(Ref r);
|
||||
- void add(int num, int gen, Goffset offs, bool used);
|
||||
+ bool add(int num, int gen, Goffset offs, bool used);
|
||||
void add(Ref ref, Goffset offs, bool used);
|
||||
|
||||
// Output XRef table to stream
|
||||
--
|
||||
2.33.0
|
||||
77
backport-CVE-2022-38349.patch
Normal file
77
backport-CVE-2022-38349.patch
Normal file
@ -0,0 +1,77 @@
|
||||
From 4564a002bcb6094cc460bc0d5ddff9423fe6dd28 Mon Sep 17 00:00:00 2001
|
||||
From: crt <chluo@cse.cuhk.edu.hk>
|
||||
Date: Sat, 13 Aug 2022 16:53:11 +0000
|
||||
Subject: [PATCH] pdfunite: Fix crash on broken files
|
||||
|
||||
---
|
||||
poppler/PDFDoc.cc | 6 +++++-
|
||||
poppler/PDFDoc.h | 2 +-
|
||||
utils/pdfunite.cc | 11 ++++++++---
|
||||
3 files changed, 14 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
|
||||
index fcc17a4..7beabe1 100644
|
||||
--- a/poppler/PDFDoc.cc
|
||||
+++ b/poppler/PDFDoc.cc
|
||||
@@ -1795,12 +1795,15 @@ bool PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
|
||||
return true;
|
||||
}
|
||||
|
||||
-void PDFDoc::replacePageDict(int pageNo, int rotate,
|
||||
+bool PDFDoc::replacePageDict(int pageNo, int rotate,
|
||||
const PDFRectangle *mediaBox,
|
||||
const PDFRectangle *cropBox)
|
||||
{
|
||||
Ref *refPage = getCatalog()->getPageRef(pageNo);
|
||||
Object page = getXRef()->fetch(*refPage);
|
||||
+ if (!page.isDict()) {
|
||||
+ return false;
|
||||
+ }
|
||||
Dict *pageDict = page.getDict();
|
||||
pageDict->remove("MediaBoxssdf");
|
||||
pageDict->remove("MediaBox");
|
||||
@@ -1830,6 +1833,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate,
|
||||
pageDict->add("TrimBox", std::move(trimBoxObject));
|
||||
pageDict->add("Rotate", Object(rotate));
|
||||
getXRef()->setModifiedObject(&page, *refPage);
|
||||
+ return true;
|
||||
}
|
||||
|
||||
bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
|
||||
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
|
||||
index b504004..1295d8a 100644
|
||||
--- a/poppler/PDFDoc.h
|
||||
+++ b/poppler/PDFDoc.h
|
||||
@@ -332,7 +332,7 @@ public:
|
||||
void *getGUIData() { return guiData; }
|
||||
|
||||
// rewrite pageDict with MediaBox, CropBox and new page CTM
|
||||
- void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
|
||||
+ bool replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
|
||||
bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
|
||||
void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
|
||||
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
|
||||
index 9735096..60cd227 100644
|
||||
--- a/utils/pdfunite.cc
|
||||
+++ b/utils/pdfunite.cc
|
||||
@@ -299,9 +299,14 @@ int main (int argc, char *argv[])
|
||||
const PDFRectangle *cropBox = nullptr;
|
||||
if (docs[i]->getCatalog()->getPage(j)->isCropped())
|
||||
cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
|
||||
- docs[i]->replacePageDict(j,
|
||||
- docs[i]->getCatalog()->getPage(j)->getRotate(),
|
||||
- docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
|
||||
+ if (!docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox)) {
|
||||
+ fclose(f);
|
||||
+ delete yRef;
|
||||
+ delete countRef;
|
||||
+ delete outStr;
|
||||
+ error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
|
||||
+ return -1;
|
||||
+ }
|
||||
Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
|
||||
Object page = docs[i]->getXRef()->fetch(*refPage);
|
||||
Dict *pageDict = page.getDict();
|
||||
--
|
||||
2.33.0
|
||||
34
poppler.spec
34
poppler.spec
@ -4,7 +4,7 @@
|
||||
Summary: PDF rendering library
|
||||
Name: poppler
|
||||
Version: 0.90.0
|
||||
Release: 5
|
||||
Release: 6
|
||||
License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
|
||||
URL: http://poppler.freedesktop.org/
|
||||
Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
|
||||
@ -17,6 +17,11 @@ Patch8: %{name}-gcc11.patch
|
||||
|
||||
Patch6001: backport-CVE-2022-38784.patch
|
||||
Patch6002: backport-CVE-2022-27337.patch
|
||||
Patch6003: backport-CVE-2020-23804.patch
|
||||
Patch6004: backport-CVE-2022-37050.patch
|
||||
Patch6005: backport-CVE-2022-37051.patch
|
||||
Patch6006: backport-CVE-2022-37052.patch
|
||||
Patch6007: backport-CVE-2022-38349.patch
|
||||
|
||||
BuildRequires: cmake
|
||||
BuildRequires: gcc-c++
|
||||
@ -86,29 +91,9 @@ BuildArch: noarch
|
||||
%description glib-doc
|
||||
This package provides documentation files for glib wrapper
|
||||
|
||||
%package qt
|
||||
Summary: Provides Qt4 wrapper for poppler
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
%{?_qt4:Requires: qt4 >= %{_qt4_version}}
|
||||
Obsoletes: poppler-qt4 < 0.16.0-3
|
||||
Provides: poppler-qt4 = %{version}-%{release}
|
||||
|
||||
%description qt
|
||||
This package provides Qt4 wrapper for poppler.
|
||||
|
||||
%package qt-devel
|
||||
Summary: Provides development files for Qt4 wrapper
|
||||
Requires: %{name}-qt = %{version}-%{release}
|
||||
Requires: %{name}-devel = %{version}-%{release}
|
||||
Obsoletes: poppler-qt4-devel < 0.16.0-3
|
||||
Provides: poppler-qt4-devel = %{version}-%{release}
|
||||
Requires: qt4-devel
|
||||
|
||||
%description qt-devel
|
||||
This package provides development files for Qt4 wrapper.
|
||||
|
||||
%package qt5
|
||||
Summary: Provides Qt5 wrapper for poppler
|
||||
Obsoletes: %{name}-qt <= 0.67.0-8
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description qt5
|
||||
@ -116,6 +101,7 @@ This package provides Qt5 wrapper for poppler.
|
||||
|
||||
%package qt5-devel
|
||||
Summary: Provides development files for Qt5 wrapper
|
||||
Obsoletes: %{name}-qt-devel <= 0.67.0-8
|
||||
Requires: %{name}-qt5 = %{version}-%{release}
|
||||
Requires: %{name}-devel = %{version}-%{release}
|
||||
Requires: qt5-qtbase-devel
|
||||
@ -235,6 +221,10 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%changelog
|
||||
* Wed Aug 30 2023 zhouwenpei <zhouwenpei1@h-partners.com> - 0.90.0-6
|
||||
- fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349,CVE-2020-23804
|
||||
- fix install error
|
||||
|
||||
* Thu May 25 2023 zhangpan <zhangpan103@h-partners.com> - 0.90.0-5
|
||||
- fix changelog error
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user