fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349

(cherry picked from commit e17a8adea9404ab8c90fc5bb575e8210d1a36d6e)
This commit is contained in:
zhouwenpei 2023-08-25 17:21:38 +08:00 committed by openeuler-sync-bot
parent 990ab80ea3
commit 66ca6a7f90
6 changed files with 443 additions and 22 deletions

View File

@ -0,0 +1,37 @@
From ec8a43c8df29fdd6f1228276160898ccd9401c92 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Sat, 4 Jul 2020 00:08:55 +0200
Subject: [PATCH] Fix stack overflow with specially crafted files
The file is not malformed per se, it just has a huge XRefStm chain
and we end up exhausting the stack space trying to parse them all.
Having more than 4096 XRefStm seems like won't really happen on real
life so break the flow at that point
Fixes #936
---
poppler/XRef.cc | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 5943bdd..fe8936e 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -633,6 +633,12 @@ bool XRef::readXRefTable(Parser *parser, Goffset *pos, std::vector<Goffset> *fol
ok = false;
}
}
+ // Arbitrary limit because otherwise we exhaust the stack
+ // calling readXRef + readXRefTable
+ if (followedXRefStm->size() > 4096) {
+ error(errSyntaxError, -1, "File has more than 4096 XRefStm, aborting");
+ ok = false;
+ }
if (ok) {
followedXRefStm->push_back(pos2);
readXRef(&pos2, followedXRefStm, xrefStreamObjsNum);
--
2.33.0

View File

@ -0,0 +1,26 @@
From dcd5bd8238ea448addd102ff045badd0aca1b990 Mon Sep 17 00:00:00 2001
From: crt <chluo@cse.cuhk.edu.hk>
Date: Wed, 27 Jul 2022 08:40:02 +0000
Subject: [PATCH] pdfseparate: Check XRef's Catalog for being a Dict
---
poppler/PDFDoc.cc | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index 6e4b0f4..43de80e 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -948,6 +948,10 @@ int PDFDoc::savePageAs(const GooString *name, int pageNo)
// get and mark output intents etc.
Object catObj = getXRef()->getCatalog();
+ if (!catObj.isDict()) {
+ error(errSyntaxError, -1, "XRef's Catelog is not a dictionary");
+ return errOpenFile;
+ }
Dict *catDict = catObj.getDict();
Object pagesObj = catDict->lookup("Pages");
Object afObj = catDict->lookupNF("AcroForm").copy();
--
2.33.0

View File

@ -0,0 +1,46 @@
From 4631115647c1e4f0482ffe0491c2f38d2231337b Mon Sep 17 00:00:00 2001
From: crt <chluo@cse.cuhk.edu.hk>
Date: Fri, 29 Jul 2022 20:51:11 +0000
Subject: [PATCH] Check isDict before calling getDict
Issue #1276
---
utils/pdfunite.cc | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
index a8116e3..9735096 100644
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -210,6 +210,14 @@ int main (int argc, char *argv[])
Object ocObj;
if (docs.size() >= 1) {
Object catObj = docs[0]->getXRef()->getCatalog();
+ if(!catObj.isDict()){
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
+ return -1;
+ }
Dict *catDict = catObj.getDict();
intents = catDict->lookup("OutputIntents");
afObj = catDict->lookupNF("AcroForm").copy();
@@ -310,6 +318,14 @@ int main (int argc, char *argv[])
}
}
Object pageCatObj = docs[i]->getXRef()->getCatalog();
+ if(!pageCatObj.isDict()){
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "XRef's Catalog is not a dictionary.");
+ return -1;
+ }
Dict *pageCatDict = pageCatObj.getDict();
Object pageNames = pageCatDict->lookup("Names");
if (!pageNames.isNull() && pageNames.isDict()) {
--
2.33.0

View File

@ -0,0 +1,245 @@
From 8677500399fc2548fa816b619580c2c07915a98c Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Fri, 29 Jul 2022 23:28:35 +0200
Subject: [PATCH] pdfseparate: Account for XRef::add failing because we run out
of memory
Fixes #1278
---
poppler/PDFDoc.cc | 63 ++++++++++++++++++++++++++++++++++++-----------
poppler/PDFDoc.h | 6 ++---
poppler/XRef.cc | 11 +++++++--
poppler/XRef.h | 4 +--
4 files changed, 62 insertions(+), 22 deletions(-)
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index 43de80e..fcc17a4 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -962,7 +962,14 @@ int PDFDoc::savePageAs(const GooString *name, int pageNo)
Object resourcesObj = pagesDict->lookup("Resources");
if (resourcesObj.isDict())
markPageObjects(resourcesObj.getDict(), yRef, countRef, 0, refPage->num, rootNum + 2);
- markPageObjects(catDict, yRef, countRef, 0, refPage->num, rootNum + 2);
+ if (!markPageObjects(catDict, yRef, countRef, 0, refPage->num, rootNum + 2)) {
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "markPageObjects failed");
+ return errDamaged;
+ }
Dict *pageDict = page.getDict();
if (resourcesObj.isNull() && !pageDict->hasKey("Resources")) {
@@ -1681,7 +1688,7 @@ void PDFDoc::writeHeader(OutStream *outStr, int major, int minor)
outStr->printf("%%%c%c%c%c\n", 0xE2, 0xE3, 0xCF, 0xD3);
}
-void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
+bool PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
{
bool deleteSet = false;
if (!alreadyMarkedDicts) {
@@ -1692,7 +1699,7 @@ void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned
if (alreadyMarkedDicts->find(dict) != alreadyMarkedDicts->end()) {
error(errSyntaxWarning, -1, "PDFDoc::markDictionnary: Found recursive dicts");
if (deleteSet) delete alreadyMarkedDicts;
- return;
+ return true;
} else {
alreadyMarkedDicts->insert(dict);
}
@@ -1701,7 +1708,10 @@ void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned
const char *key = dict->getKey(i);
if (strcmp(key, "Annots") != 0) {
Object obj1 = dict->getValNF(i).copy();
- markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ if (unlikely(!success)) {
+ return false;
+ }
} else {
Object annotsObj = dict->getValNF(i).copy();
if (!annotsObj.isNull()) {
@@ -1713,9 +1723,11 @@ void PDFDoc::markDictionnary (Dict* dict, XRef * xRef, XRef *countRef, unsigned
if (deleteSet) {
delete alreadyMarkedDicts;
}
+
+ return true;
}
-void PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
+bool PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
{
Array *array;
@@ -1724,25 +1736,37 @@ void PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
array = obj->getArray();
for (int i=0; i<array->getLength(); i++) {
Object obj1 = array->getNF(i).copy();
- markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ if (unlikely(!success)) {
+ return false;
+ }
}
break;
- case objDict:
- markDictionnary (obj->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
- break;
+ case objDict: {
+ const bool success = markDictionnary(obj->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ if (unlikely(!success)) {
+ return false;
+ }
+ } break;
case objStream:
{
Stream *stream = obj->getStream();
- markDictionnary (stream->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ const bool success = markDictionnary(stream->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ if (unlikely(!success)) {
+ return false;
+ }
}
break;
case objRef:
{
if (obj->getRef().num + (int) numOffset >= xRef->getNumObjects() || xRef->getEntry(obj->getRef().num + numOffset)->type == xrefEntryFree) {
if (getXRef()->getEntry(obj->getRef().num)->type == xrefEntryFree) {
- return; // already marked as free => should be replaced
+ return true; // already marked as free => should be replaced
+ }
+ const bool success = xRef->add(obj->getRef().num + numOffset, obj->getRef().gen, 0, true);
+ if (unlikely(!success)) {
+ return false;
}
- xRef->add(obj->getRef().num + numOffset, obj->getRef().gen, 0, true);
if (getXRef()->getEntry(obj->getRef().num)->type == xrefEntryCompressed) {
xRef->getEntry(obj->getRef().num + numOffset)->type = xrefEntryCompressed;
}
@@ -1758,12 +1782,17 @@ void PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
break;
}
Object obj1 = getXRef()->fetch(obj->getRef());
- markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum);
+ const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum);
+ if (unlikely(!success)) {
+ return false;
+ }
}
break;
default:
break;
}
+
+ return true;
}
void PDFDoc::replacePageDict(int pageNo, int rotate,
@@ -1803,7 +1832,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate,
getXRef()->setModifiedObject(&page, *refPage);
}
-void PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
+bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
{
pageDict->remove("OpenAction");
pageDict->remove("Outlines");
@@ -1818,9 +1847,13 @@ void PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigne
strcmp(key, "Annots") != 0 &&
strcmp(key, "P") != 0 &&
strcmp(key, "Root") != 0) {
- markObject(&value, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ const bool success = markObject(&value, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+ if (unlikely(!success)) {
+ return false;
+ }
}
}
+ return true;
}
bool PDFDoc::markAnnotations(Object *annotsObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts) {
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
index 80b6d60..b504004 100644
--- a/poppler/PDFDoc.h
+++ b/poppler/PDFDoc.h
@@ -333,7 +333,7 @@ public:
// rewrite pageDict with MediaBox, CropBox and new page CTM
void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
- void markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
+ bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
// write all objects used by pageDict to outStr
@@ -355,8 +355,8 @@ public:
private:
// insert referenced objects in XRef
- void markDictionnary (Dict* dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts);
- void markObject (Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
+ bool markDictionnary (Dict* dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts);
+ bool markObject (Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
static void writeDictionnary (Dict* dict, OutStream* outStr, XRef *xRef, unsigned int numOffset, unsigned char *fileKey,
CryptAlgorithm encAlgorithm, int keyLength, Ref ref, std::set<Dict*> *alreadyWrittenDicts);
diff --git a/poppler/XRef.cc b/poppler/XRef.cc
index 9d6b80f..5943bdd 100644
--- a/poppler/XRef.cc
+++ b/poppler/XRef.cc
@@ -1298,11 +1298,17 @@ void XRef::add(Ref ref, Goffset offs, bool used)
add(ref.num, ref.gen, offs, used);
}
-void XRef::add(int num, int gen, Goffset offs, bool used) {
+bool XRef::add(int num, int gen, Goffset offs, bool used) {
xrefLocker();
if (num >= size) {
if (num >= capacity) {
- entries = (XRefEntry *)greallocn(entries, num + 1, sizeof(XRefEntry));
+ entries = (XRefEntry *)greallocn_checkoverflow(entries, num + 1, sizeof(XRefEntry));
+ if (unlikely(entries == nullptr)) {
+ size = 0;
+ capacity = 0;
+ return false;
+ }
+
capacity = num + 1;
}
for (int i = size; i < num + 1; ++i) {
@@ -1325,6 +1331,7 @@ void XRef::add(int num, int gen, Goffset offs, bool used) {
e->type = xrefEntryFree;
e->offset = 0;
}
+ return true;
}
void XRef::setModifiedObject (const Object* o, Ref r) {
diff --git a/poppler/XRef.h b/poppler/XRef.h
index 5c0238b..207f02a 100644
--- a/poppler/XRef.h
+++ b/poppler/XRef.h
@@ -14,7 +14,7 @@
// under GPL version 2 or later
//
// Copyright (C) 2005 Brad Hards <bradh@frogmouth.net>
-// Copyright (C) 2006, 2008, 2010-2013, 2017-2020 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2006, 2008, 2010-2013, 2017-2022 Albert Astals Cid <aacid@kde.org>
// Copyright (C) 2007-2008 Julien Rebetez <julienr@svn.gnome.org>
// Copyright (C) 2007 Carlos Garcia Campos <carlosgc@gnome.org>
// Copyright (C) 2010 Ilya Gorenbein <igorenbein@finjan.com>
@@ -196,7 +196,7 @@ public:
void setModifiedObject(const Object* o, Ref r);
Ref addIndirectObject (const Object* o);
void removeIndirectObject(Ref r);
- void add(int num, int gen, Goffset offs, bool used);
+ bool add(int num, int gen, Goffset offs, bool used);
void add(Ref ref, Goffset offs, bool used);
// Output XRef table to stream
--
2.33.0

View File

@ -0,0 +1,77 @@
From 4564a002bcb6094cc460bc0d5ddff9423fe6dd28 Mon Sep 17 00:00:00 2001
From: crt <chluo@cse.cuhk.edu.hk>
Date: Sat, 13 Aug 2022 16:53:11 +0000
Subject: [PATCH] pdfunite: Fix crash on broken files
---
poppler/PDFDoc.cc | 6 +++++-
poppler/PDFDoc.h | 2 +-
utils/pdfunite.cc | 11 ++++++++---
3 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index fcc17a4..7beabe1 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -1795,12 +1795,15 @@ bool PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
return true;
}
-void PDFDoc::replacePageDict(int pageNo, int rotate,
+bool PDFDoc::replacePageDict(int pageNo, int rotate,
const PDFRectangle *mediaBox,
const PDFRectangle *cropBox)
{
Ref *refPage = getCatalog()->getPageRef(pageNo);
Object page = getXRef()->fetch(*refPage);
+ if (!page.isDict()) {
+ return false;
+ }
Dict *pageDict = page.getDict();
pageDict->remove("MediaBoxssdf");
pageDict->remove("MediaBox");
@@ -1830,6 +1833,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate,
pageDict->add("TrimBox", std::move(trimBoxObject));
pageDict->add("Rotate", Object(rotate));
getXRef()->setModifiedObject(&page, *refPage);
+ return true;
}
bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
index b504004..1295d8a 100644
--- a/poppler/PDFDoc.h
+++ b/poppler/PDFDoc.h
@@ -332,7 +332,7 @@ public:
void *getGUIData() { return guiData; }
// rewrite pageDict with MediaBox, CropBox and new page CTM
- void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
+ bool replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
index 9735096..60cd227 100644
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -299,9 +299,14 @@ int main (int argc, char *argv[])
const PDFRectangle *cropBox = nullptr;
if (docs[i]->getCatalog()->getPage(j)->isCropped())
cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
- docs[i]->replacePageDict(j,
- docs[i]->getCatalog()->getPage(j)->getRotate(),
- docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+ if (!docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox)) {
+ fclose(f);
+ delete yRef;
+ delete countRef;
+ delete outStr;
+ error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
+ return -1;
+ }
Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
Object page = docs[i]->getXRef()->fetch(*refPage);
Dict *pageDict = page.getDict();
--
2.33.0

View File

@ -4,7 +4,7 @@
Summary: PDF rendering library
Name: poppler
Version: 0.90.0
Release: 5
Release: 6
License: (GPLv2 or GPLv3) and GPLv2+ and LGPLv2+ and MIT
URL: http://poppler.freedesktop.org/
Source0: http://poppler.freedesktop.org/poppler-%{version}.tar.xz
@ -17,6 +17,11 @@ Patch8: %{name}-gcc11.patch
Patch6001: backport-CVE-2022-38784.patch
Patch6002: backport-CVE-2022-27337.patch
Patch6003: backport-CVE-2020-23804.patch
Patch6004: backport-CVE-2022-37050.patch
Patch6005: backport-CVE-2022-37051.patch
Patch6006: backport-CVE-2022-37052.patch
Patch6007: backport-CVE-2022-38349.patch
BuildRequires: cmake
BuildRequires: gcc-c++
@ -86,29 +91,9 @@ BuildArch: noarch
%description glib-doc
This package provides documentation files for glib wrapper
%package qt
Summary: Provides Qt4 wrapper for poppler
Requires: %{name} = %{version}-%{release}
%{?_qt4:Requires: qt4 >= %{_qt4_version}}
Obsoletes: poppler-qt4 < 0.16.0-3
Provides: poppler-qt4 = %{version}-%{release}
%description qt
This package provides Qt4 wrapper for poppler.
%package qt-devel
Summary: Provides development files for Qt4 wrapper
Requires: %{name}-qt = %{version}-%{release}
Requires: %{name}-devel = %{version}-%{release}
Obsoletes: poppler-qt4-devel < 0.16.0-3
Provides: poppler-qt4-devel = %{version}-%{release}
Requires: qt4-devel
%description qt-devel
This package provides development files for Qt4 wrapper.
%package qt5
Summary: Provides Qt5 wrapper for poppler
Obsoletes: %{name}-qt <= 0.67.0-8
Requires: %{name} = %{version}-%{release}
%description qt5
@ -116,6 +101,7 @@ This package provides Qt5 wrapper for poppler.
%package qt5-devel
Summary: Provides development files for Qt5 wrapper
Obsoletes: %{name}-qt-devel <= 0.67.0-8
Requires: %{name}-qt5 = %{version}-%{release}
Requires: %{name}-devel = %{version}-%{release}
Requires: qt5-qtbase-devel
@ -235,6 +221,10 @@ test "$(pkg-config --modversion poppler-splash)" = "%{version}"
%{_mandir}/man1/*
%changelog
* Wed Aug 30 2023 zhouwenpei <zhouwenpei1@h-partners.com> - 0.90.0-6
- fix CVE-2022-37050,CVE-2022-37051,CVE-2022-37052,CVE-2022-38349,CVE-2020-23804
- fix install error
* Thu May 25 2023 zhangpan <zhangpan103@h-partners.com> - 0.90.0-5
- fix changelog error