From 882d921344a4881fcf9d2d2c8f290fe8766fef80 Mon Sep 17 00:00:00 2001 From: Leo Famulari Date: Sat, 11 Nov 2017 22:29:44 -0500 Subject: gnu: mupdf: Actually fix CVE-2017-15587. The original fix could be removed by an optimizing compiler. * gnu/packages/patches/mupdf-CVE-2017-15587.patch: Revise patch. --- gnu/packages/patches/mupdf-CVE-2017-15587.patch | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/gnu/packages/patches/mupdf-CVE-2017-15587.patch b/gnu/packages/patches/mupdf-CVE-2017-15587.patch index 5da7737ea1..7d24666756 100644 --- a/gnu/packages/patches/mupdf-CVE-2017-15587.patch +++ b/gnu/packages/patches/mupdf-CVE-2017-15587.patch @@ -3,11 +3,12 @@ Fix CVE-2017-15587. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15587 https://nandynarwhals.org/CVE-2017-15587/ -Copied from upstream: +This patch is these two upstream commits squashed together: + diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 66bd0ed..6292793 100644 +index 66bd0ed8..89499e61 100644 --- a/source/pdf/pdf-xref.c +++ b/source/pdf/pdf-xref.c @@ -924,7 +924,7 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, fz @@ -15,7 +16,10 @@ index 66bd0ed..6292793 100644 int i, n; - if (i0 < 0 || i1 < 0) -+ if (i0 < 0 || i1 < 0 || (i0+i1) < 0) ++ if (i0 < 0 || i1 < 0 || i0 > INT_MAX - i1) fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index"); //if (i0 + i1 > pdf_xref_len(ctx, doc)) // fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries"); +-- +2.15.0 + -- cgit v1.2.3