diff options
| author | Kei Kebreau <kkebreau@posteo.net> | 2021-03-04 19:43:17 -0500 |
|---|---|---|
| committer | Kei Kebreau <kkebreau@posteo.net> | 2021-03-04 20:12:07 -0500 |
| commit | 6891f95739c733df217ceaf5d0787cbed380ec1c (patch) | |
| tree | 96fc985c5f8bcd12995a1db17845db64422a1613 | |
| parent | d5a8e530d794beb0e162a124ea3068887b920556 (diff) | |
| download | guix-6891f95739c733df217ceaf5d0787cbed380ec1c.tar guix-6891f95739c733df217ceaf5d0787cbed380ec1c.tar.gz | |
gnu: mupdf: Fix CVE-2021-3407.
* gnu/packages/pdf.scm (mupdf)[source]: Add patch.
* gnu/packages/patches/mupdf-CVE-2021-3407.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
| -rw-r--r-- | gnu/local.mk | 1 | ||||
| -rw-r--r-- | gnu/packages/patches/mupdf-CVE-2021-3407.patch | 51 | ||||
| -rw-r--r-- | gnu/packages/pdf.scm | 3 |
3 files changed, 54 insertions, 1 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 3557d9f429..25afb99618 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -1382,6 +1382,7 @@ dist_patch_DATA = \ %D%/packages/patches/mumps-shared-mumps.patch \ %D%/packages/patches/mumps-shared-pord.patch \ %D%/packages/patches/mupdf-fix-linkage.patch \ + %D%/packages/patches/mupdf-CVE-2021-3407.patch \ %D%/packages/patches/mupen64plus-ui-console-notice.patch \ %D%/packages/patches/mupen64plus-video-z64-glew-correct-path.patch \ %D%/packages/patches/musl-cross-locale.patch \ diff --git a/gnu/packages/patches/mupdf-CVE-2021-3407.patch b/gnu/packages/patches/mupdf-CVE-2021-3407.patch new file mode 100644 index 0000000000..9f901517c5 --- /dev/null +++ b/gnu/packages/patches/mupdf-CVE-2021-3407.patch @@ -0,0 +1,51 @@ +This patch came from https://git.ghostscript.com/?p=mupdf.git;a=patch;h=cee7cefc610d42fd383b3c80c12cbc675443176a +and fixes CVE-2021-3407. + +From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001 +From: Robin Watts <Robin.Watts@artifex.com> +Date: Fri, 22 Jan 2021 17:05:15 +0000 +Subject: [PATCH] Bug 703366: Fix double free of object during linearization. + +This appears to happen because we parse an illegal object from +a broken file and assign it to object 0, which is defined to +be free. + +Here, we fix the parsing code so this can't happen. +--- + source/pdf/pdf-parse.c | 6 ++++++ + source/pdf/pdf-xref.c | 2 ++ + 2 files changed, 8 insertions(+) + +diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c +index 7abc8c3d4..5761c3351 100644 +--- a/source/pdf/pdf-parse.c ++++ b/source/pdf/pdf-parse.c +@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc, + fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num); + } + gen = buf->i; ++ if (gen < 0 || gen >= 65536) ++ { ++ if (try_repair) ++ *try_repair = 1; ++ fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen); ++ } + + tok = pdf_lex(ctx, file, buf); + if (tok != PDF_TOK_OBJ) +diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c +index 1b2bdcd59..30197b4b8 100644 +--- a/source/pdf/pdf-xref.c ++++ b/source/pdf/pdf-xref.c +@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) + { + ofs = fz_tell(ctx, doc->file); + trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL); ++ if (num == 0) ++ fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n"); + } + fz_catch(ctx) + { +-- +2.17.1 + diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm index daea7ee8ad..e81c3caf87 100644 --- a/gnu/packages/pdf.scm +++ b/gnu/packages/pdf.scm @@ -724,7 +724,8 @@ extracting content or merging files.") "mupdf-" version "-source.tar.xz")) (sha256 (base32 "16m5sksil22sshxy70xkslsb2qhvcqb1d95i9savnhds1xn4ybar")) - (patches (search-patches "mupdf-fix-linkage.patch")) + (patches (search-patches "mupdf-fix-linkage.patch" + "mupdf-CVE-2021-3407.patch")) (modules '((guix build utils))) (snippet '(begin |