diff --git a/office/misc/mupdf/actions.py b/office/misc/mupdf/actions.py index 083b8062b0..0c1539b5b9 100644 --- a/office/misc/mupdf/actions.py +++ b/office/misc/mupdf/actions.py @@ -1,24 +1,31 @@ #!/usr/bin/python # -*- coding: utf-8 -*- - +# # Licensed under the GNU General Public License, version 3. -# See the file http://www.gnu.org/copyleft/gpl.txt +# See the file https://www.gnu.org/licenses/gpl-3.0.txt from pisi.actionsapi import get from pisi.actionsapi import autotools from pisi.actionsapi import pisitools from pisi.actionsapi import shelltools +i = ''.join([ + 'USE_SYSTEM_LIBS=yes ', + 'USE_SYSTEM_GLUT=no ', + 'USE_SYSTEM_LCMS2=no ', + 'USE_SYSTEM_GUMBO=no ', + 'USE_SYSTEM_JBIG2DEC=no ']) + def build(): + shelltools.export("CFLAGS", "%s -fcommon" % get.CFLAGS()) shelltools.system("sed '/TOFU_CJK /c #define TOFU_CJK 1/' -i include/mupdf/fitz/config.h") shelltools.system("sed -i '/ttc/s/^/#/' Makefile") - autotools.make("prefix=/usr") + autotools.make("prefix=/usr %s" % i) # remove bundled packages, use our system libraries -# shelltools.system("rm -rf thirdparty/{curl,freeglut,freetype,harfbuzz,jbig2dec,lcms2,libjpeg,mujs,openjpeg,zlib}") + shelltools.system("rm -rf thirdparty/{curl,freetype,harfbuzz,libjpeg,openjpeg,zlib}") def install(): - autotools.rawInstall("DESTDIR=%s prefix=/usr" % get.installDIR()) - pisitools.removeDir("/usr/lib") + autotools.rawInstall("DESTDIR=%s prefix=/usr %s" % (get.installDIR(), i)) - pisitools.dodoc("CHANGES", "README", "COPYING") + pisitools.dodoc("CHANGES", "COPYING", "README") diff --git a/office/misc/mupdf/files/32e4e8b4bcbacbf92af7c.patch b/office/misc/mupdf/files/32e4e8b4bcbacbf92af7c.patch new file mode 100644 index 0000000000..d19f0593a1 --- /dev/null +++ b/office/misc/mupdf/files/32e4e8b4bcbacbf92af7c.patch @@ -0,0 +1,41 @@ +From 32e4e8b4bcbacbf92af7c88337efae21986d9603 Mon Sep 17 00:00:00 2001 +From: Robin Watts +Date: Thu, 8 Oct 2020 18:10:28 +0100 +Subject: [PATCH] Bug 702958: Fix overflow in fz_clear_pixmap_with_value. + +--- + source/fitz/pixmap.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/source/fitz/pixmap.c b/source/fitz/pixmap.c +index 66873d214..80d8bb62f 100644 +--- a/source/fitz/pixmap.c ++++ b/source/fitz/pixmap.c +@@ -555,7 +555,8 @@ void + fz_clear_pixmap_with_value(fz_context *ctx, fz_pixmap *pix, int value) + { + unsigned char *s; +- int w, h, n, stride, len; ++ int w, h, n; ++ ptrdiff_t stride, len; + int alpha = pix->alpha; + + w = pix->w; +@@ -572,7 +573,7 @@ fz_clear_pixmap_with_value(fz_context *ctx, fz_pixmap *pix, int value) + + n = pix->n; + stride = pix->stride; +- len = w * n; ++ len = (ptrdiff_t)w * n; + + s = pix->samples; + if (value == 255 || !alpha) +@@ -584,7 +585,7 @@ fz_clear_pixmap_with_value(fz_context *ctx, fz_pixmap *pix, int value) + } + while (h--) + { +- memset(s, value, (unsigned int)len); ++ memset(s, value, len); + s += stride; + } + } diff --git a/office/misc/mupdf/files/b82e9b6d6b46877e5c376.patch b/office/misc/mupdf/files/b82e9b6d6b46877e5c376.patch new file mode 100644 index 0000000000..dc4000b4cd --- /dev/null +++ b/office/misc/mupdf/files/b82e9b6d6b46877e5c376.patch @@ -0,0 +1,102 @@ +From b82e9b6d6b46877e5c3763cc3bc641c66fa7eb54 Mon Sep 17 00:00:00 2001 +From: Robin Watts +Date: Thu, 8 Oct 2020 16:15:40 +0100 +Subject: [PATCH] Bug 701297: Harden populate_ui against unexpected repairs. + +We count the number of layers, and allocate space for them in +an array. We then walk the tree reading details of those layers +in. If we hit a problem that causes a repair while reading the +information, the number of layers can magically increase. In +the existing code we run off the end of the array. + +In the new code we watch for hitting the end of the array and +realloc as required. +--- + source/pdf/pdf-layer.c | 32 +++++++++++++++++++++++++------- + 1 file changed, 25 insertions(+), 7 deletions(-) + +diff --git a/source/pdf/pdf-layer.c b/source/pdf/pdf-layer.c +index 177f0c947..b8e9d7cad 100644 +--- a/source/pdf/pdf-layer.c ++++ b/source/pdf/pdf-layer.c +@@ -104,10 +104,27 @@ count_entries(fz_context *ctx, pdf_obj *obj) + } + + static pdf_ocg_ui * +-populate_ui(fz_context *ctx, pdf_ocg_descriptor *desc, pdf_ocg_ui *ui, pdf_obj *order, int depth, pdf_obj *rbgroups, pdf_obj *locked) ++get_ocg_ui(fz_context *ctx, pdf_ocg_descriptor *desc, int fill) ++{ ++ if (fill == desc->num_ui_entries) ++ { ++ /* Number of layers changed while parsing; ++ * probably due to a repair. */ ++ int newsize = desc->num_ui_entries * 2; ++ if (newsize == 0) ++ newsize = 4; /* Arbitrary non-zero */ ++ desc->ui = fz_realloc_array(ctx, desc->ui, newsize, pdf_ocg_ui); ++ desc->num_ui_entries = newsize; ++ } ++ return &desc->ui[fill]; ++} ++ ++static int ++populate_ui(fz_context *ctx, pdf_ocg_descriptor *desc, int fill, pdf_obj *order, int depth, pdf_obj *rbgroups, pdf_obj *locked) + { + int len = pdf_array_len(ctx, order); + int i, j; ++ pdf_ocg_ui *ui; + + for (i = 0; i < len; i++) + { +@@ -118,7 +135,7 @@ populate_ui(fz_context *ctx, pdf_ocg_descriptor *desc, pdf_ocg_ui *ui, pdf_obj * + continue; + + fz_try(ctx) +- ui = populate_ui(ctx, desc, ui, o, depth+1, rbgroups, locked); ++ fill = populate_ui(ctx, desc, fill, o, depth+1, rbgroups, locked); + fz_always(ctx) + pdf_unmark_obj(ctx, o); + fz_catch(ctx) +@@ -126,14 +143,14 @@ populate_ui(fz_context *ctx, pdf_ocg_descriptor *desc, pdf_ocg_ui *ui, pdf_obj * + + continue; + } +- ui->depth = depth; + if (pdf_is_string(ctx, o)) + { ++ ui = get_ocg_ui(ctx, desc, fill++); ++ ui->depth = depth; + ui->ocg = -1; + ui->name = pdf_to_str_buf(ctx, o); + ui->button_flags = PDF_LAYER_UI_LABEL; + ui->locked = 1; +- ui++; + continue; + } + +@@ -144,13 +161,14 @@ populate_ui(fz_context *ctx, pdf_ocg_descriptor *desc, pdf_ocg_ui *ui, pdf_obj * + } + if (j == desc->len) + continue; /* OCG not found in main list! Just ignore it */ ++ ui = get_ocg_ui(ctx, desc, fill++); ++ ui->depth = depth; + ui->ocg = j; + ui->name = pdf_dict_get_string(ctx, o, PDF_NAME(Name), NULL); + ui->button_flags = pdf_array_contains(ctx, o, rbgroups) ? PDF_LAYER_UI_RADIOBOX : PDF_LAYER_UI_CHECKBOX; + ui->locked = pdf_array_contains(ctx, o, locked); +- ui++; + } +- return ui; ++ return fill; + } + + static void +@@ -188,7 +206,7 @@ load_ui(fz_context *ctx, pdf_ocg_descriptor *desc, pdf_obj *ocprops, pdf_obj *oc + desc->ui = Memento_label(fz_calloc(ctx, count, sizeof(pdf_ocg_ui)), "pdf_ocg_ui"); + fz_try(ctx) + { +- (void)populate_ui(ctx, desc, desc->ui, order, 0, rbgroups, locked); ++ desc->num_ui_entries = populate_ui(ctx, desc, 0, order, 0, rbgroups, locked); + } + fz_catch(ctx) + { diff --git a/office/misc/mupdf/files/fix-build-on-big-endian.patch b/office/misc/mupdf/files/fix-build-on-big-endian.patch new file mode 100644 index 0000000000..db54e44758 --- /dev/null +++ b/office/misc/mupdf/files/fix-build-on-big-endian.patch @@ -0,0 +1,95 @@ +diff --git a/thirdparty/lcms2/include/lcms2mt_plugin.h b/thirdparty/lcms2/include/lcms2mt_plugin.h +--- a/thirdparty/lcms2/include/lcms2mt_plugin.h ++++ b/thirdparty/lcms2/include/lcms2mt_plugin.h +@@ -97,7 +97,7 @@ CMSAPI void CMSEXPORT _cmsMAT3eval(cmsContext ContextID, cmsVEC3* + // MD5 low level ------------------------------------------------------------------------------------- + + CMSAPI cmsHANDLE CMSEXPORT cmsMD5alloc(cmsContext ContextID); +-CMSAPI void CMSEXPORT cmsMD5add(cmsHANDLE Handle, const cmsUInt8Number* buf, cmsUInt32Number len); ++CMSAPI void CMSEXPORT cmsMD5add(cmsContext ContextID, cmsHANDLE Handle, const cmsUInt8Number* buf, cmsUInt32Number len); + CMSAPI void CMSEXPORT cmsMD5finish(cmsContext ContextID, cmsProfileID* ProfileID, cmsHANDLE Handle); + + // Error logging ------------------------------------------------------------------------------------- +diff --git a/thirdparty/lcms2/src/cmsmd5.c b/thirdparty/lcms2/src/cmsmd5.c +--- a/thirdparty/lcms2/src/cmsmd5.c ++++ b/thirdparty/lcms2/src/cmsmd5.c +@@ -29,7 +29,7 @@ + #ifdef CMS_USE_BIG_ENDIAN + + static +-void byteReverse(cmsUInt8Number * buf, cmsUInt32Number longs) ++void byteReverse(cmsContext ContextID, cmsUInt8Number * buf, cmsUInt32Number longs) + { + do { + +@@ -42,7 +42,7 @@ void byteReverse(cmsUInt8Number * buf, cmsUInt32Number longs) + } + + #else +-#define byteReverse(buf, len) ++#define byteReverse(ContextID, buf, len) + #endif + + +@@ -166,7 +166,7 @@ cmsHANDLE CMSEXPORT cmsMD5alloc(cmsContext ContextID) + return (cmsHANDLE) ctx; + } + +-void CMSEXPORT cmsMD5add(cmsHANDLE Handle, const cmsUInt8Number* buf, cmsUInt32Number len) ++void CMSEXPORT cmsMD5add(cmsContext ContextID, cmsHANDLE Handle, const cmsUInt8Number* buf, cmsUInt32Number len) + { + _cmsMD5* ctx = (_cmsMD5*) Handle; + cmsUInt32Number t; +@@ -190,7 +190,7 @@ void CMSEXPORT cmsMD5add(cmsHANDLE Handle, const cmsUInt8Number* buf, cmsUInt32N + } + + memmove(p, buf, t); +- byteReverse(ctx->in, 16); ++ byteReverse(ContextID, ctx->in, 16); + + cmsMD5_Transform(ctx->buf, (cmsUInt32Number *) ctx->in); + buf += t; +@@ -199,7 +199,7 @@ void CMSEXPORT cmsMD5add(cmsHANDLE Handle, const cmsUInt8Number* buf, cmsUInt32N + + while (len >= 64) { + memmove(ctx->in, buf, 64); +- byteReverse(ctx->in, 16); ++ byteReverse(ContextID, ctx->in, 16); + cmsMD5_Transform(ctx->buf, (cmsUInt32Number *) ctx->in); + buf += 64; + len -= 64; +@@ -225,21 +225,21 @@ void CMSEXPORT cmsMD5finish(cmsContext ContextID, cmsProfileID* ProfileID, cmsH + if (count < 8) { + + memset(p, 0, count); +- byteReverse(ctx->in, 16); ++ byteReverse(ContextID, ctx->in, 16); + cmsMD5_Transform(ctx->buf, (cmsUInt32Number *) ctx->in); + + memset(ctx->in, 0, 56); + } else { + memset(p, 0, count - 8); + } +- byteReverse(ctx->in, 14); ++ byteReverse(ContextID, ctx->in, 14); + + ((cmsUInt32Number *) ctx->in)[14] = ctx->bits[0]; + ((cmsUInt32Number *) ctx->in)[15] = ctx->bits[1]; + + cmsMD5_Transform(ctx->buf, (cmsUInt32Number *) ctx->in); + +- byteReverse((cmsUInt8Number *) ctx->buf, 4); ++ byteReverse(ContextID, (cmsUInt8Number *) ctx->buf, 4); + memmove(ProfileID ->ID8, ctx->buf, 16); + + _cmsFree(ContextID, ctx); +@@ -284,7 +284,7 @@ cmsBool CMSEXPORT cmsMD5computeID(cmsContext ContextID, cmsHPROFILE hProfile) + if (MD5 == NULL) goto Error; + + // Add all bytes +- cmsMD5add(MD5, Mem, BytesNeeded); ++ cmsMD5add(ContextID, MD5, Mem, BytesNeeded); + + // Temp storage is no longer needed + _cmsFree(ContextID, Mem); + diff --git a/office/misc/mupdf/files/mupdf-1.12.0-consolidated_fixes-1.patch b/office/misc/mupdf/files/mupdf-1.12.0-consolidated_fixes-1.patch deleted file mode 100644 index 6a4b0cf50b..0000000000 --- a/office/misc/mupdf/files/mupdf-1.12.0-consolidated_fixes-1.patch +++ /dev/null @@ -1,87 +0,0 @@ -Submitted By: Bruce Dubbs -Date: 2017-12-17 -Initial Package Version: 1.12.0 -Upstream Status: Not submitted -Origin: Arch Linux, rolled forward for openjpeg-2.3 -Description: Fixes for openjpeg-2.2 -Update: 2017-10-15 Change include directory to openjpeg-2.3 - -Consolidated patch for installing shared libraries. -Original patch by Ken Moffat - -diff -Naur mupdf-1.12.0-source.orig/Makefile mupdf-1.12.0-source/Makefile ---- mupdf-1.12.0-source.orig/Makefile 2017-12-13 08:00:30.000000000 -0600 -+++ mupdf-1.12.0-source/Makefile 2017-12-17 18:07:39.809057239 -0600 -@@ -14,7 +14,7 @@ - # Do not specify CFLAGS or LIBS on the make invocation line - specify - # XCFLAGS or XLIBS instead. Make ignores any lines in the makefile that - # set a variable that was set on the command line. --CFLAGS += $(XCFLAGS) -Iinclude -+CFLAGS += $(XCFLAGS) -Iinclude -fPIC - LIBS += $(XLIBS) -lm - - LIBS += $(FREETYPE_LIBS) -@@ -312,9 +312,9 @@ - - # --- Library --- - --MUPDF_LIB = $(OUT)/libmupdf.a --THIRD_LIB = $(OUT)/libmupdfthird.a --THREAD_LIB = $(OUT)/libmuthreads.a -+MUPDF_LIB = $(OUT)/libmupdf.so -+THIRD_LIB = $(OUT)/libmupdfthird.so -+THREAD_LIB = $(OUT)/libmuthreads.so - - MUPDF_OBJ := \ - $(FITZ_OBJ) \ -@@ -343,11 +343,14 @@ - - THREAD_OBJ := $(THREAD_OBJ) - --$(MUPDF_LIB) : $(MUPDF_OBJ) -+$(MUPDF_LIB) : $(MUPDF_OBJ) $(THIRD_LIB) $(THREAD_LIB) -+ $(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf.so -Wl,--no-undefined - $(THIRD_LIB) : $(THIRD_OBJ) -+ $(LINK_CMD) -shared -Wl,-soname -Wl,libmupdfthird.so -Wl,--no-undefined - $(THREAD_LIB) : $(THREAD_OBJ) -+ $(LINK_CMD) -shared -Wl,-soname -Wl,libmuthreads.so -Wl,--no-undefined -lpthread - --INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB) -+INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB) $(THREAD_LIB) - - # --- Tools and Apps --- - -diff -Naur mupdf-1.12.0-source.orig/source/fitz/load-jpx.c mupdf-1.12.0-source/source/fitz/load-jpx.c ---- mupdf-1.12.0-source.orig/source/fitz/load-jpx.c 2017-12-13 08:00:30.000000000 -0600 -+++ mupdf-1.12.0-source/source/fitz/load-jpx.c 2017-12-17 18:03:03.259071255 -0600 -@@ -445,14 +445,18 @@ - - #else /* HAVE_LURATECH */ - -+#ifdef __cplusplus -+extern "C" -+{ - #define OPJ_STATIC - #define OPJ_HAVE_INTTYPES_H - #if !defined(_MSC_VER) || _MSC_VER >= 1600 - #define OPJ_HAVE_STDINT_H - #endif -+#endif - #define USE_JPIP - --#include -+#include - - struct fz_jpxd_s - { -@@ -930,6 +934,10 @@ - *yresp = state.yres; - } - -+#ifdef __cplusplus -+} -+#endif -+ - #endif /* HAVE_LURATECH */ - - #else /* FZ_ENABLE_JPX */ diff --git a/office/misc/mupdf/files/mupdf-1.12.0-security-roundup.patch b/office/misc/mupdf/files/mupdf-1.12.0-security-roundup.patch deleted file mode 100644 index c4ad2ec5cb..0000000000 --- a/office/misc/mupdf/files/mupdf-1.12.0-security-roundup.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 22339500c243e564eadf564b5ae2925e1caf44a9 Mon Sep 17 00:00:00 2001 -From: Sebastian Rasmussen -Date: Sun, 21 Jan 2018 21:08:07 +0100 -Subject: [PATCH] Bug 698889: Handle unterminated PDF arrays gracefully. - -Thanks to oss-fuzz for reporting this. ---- - source/pdf/pdf-parse.c | 3 +++ - 1 file changed, 3 insertions(+) - -From 2a1611030030e18010a0ab1d69eda0359eb5f585 Mon Sep 17 00:00:00 2001 -From: Sebastian Rasmussen -Date: Wed, 13 Dec 2017 21:14:19 +0100 -Subject: [PATCH] Validate that /Size in trailer is in range. - ---- - source/pdf/pdf-xref.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -From 5722ebc5823381ee57c525cbc0d4dc627009979d Mon Sep 17 00:00:00 2001 -From: Tor Andersson -Date: Fri, 1 Dec 2017 16:25:39 +0100 -Subject: [PATCH] Fix 698787: avoid using "system()" to copy files. - ---- - platform/x11/x11_main.c | 35 ++++++++++++++++++++++++++++++----- - 1 file changed, 30 insertions(+), 5 deletions(-) - -From d9bc8c6f7fb2e3ec7035bebaaee0edcf59287705 Mon Sep 17 00:00:00 2001 -From: Sebastian Rasmussen -Date: Mon, 22 Jan 2018 17:56:20 +0100 -Subject: [PATCH] Bug 698885: When parsing PDF version, make sure to initialize - buffer. - -Thanks to oss-fuzz for reporting this. ---- - source/pdf/pdf-xref.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c -index ff741dc..7904ebd 100644 ---- a/source/pdf/pdf-parse.c -+++ b/source/pdf/pdf-parse.c -@@ -401,6 +401,9 @@ pdf_parse_array(fz_context *ctx, pdf_document *doc, fz_stream *file, pdf_lexbuf - - switch (tok) - { -+ case PDF_TOK_EOF: -+ fz_throw(ctx, FZ_ERROR_SYNTAX, "array not closed before end of file"); -+ - case PDF_TOK_CLOSE_ARRAY: - op = ary; - goto end; -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index f2ba5a5..392adf3 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -748,8 +748,8 @@ pdf_xref_size_from_old_trailer(fz_context *ctx, pdf_document *doc, pdf_lexbuf *b - trailer = pdf_parse_dict(ctx, doc, doc->file, buf); - - size = pdf_to_int(ctx, pdf_dict_get(ctx, trailer, PDF_NAME_Size)); -- if (!size) -- fz_throw(ctx, FZ_ERROR_GENERIC, "trailer missing Size entry"); -+ if (size < 0 || size > PDF_MAX_OBJECT_NUMBER + 1) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "trailer Size entry out of range"); - } - fz_always(ctx) - { -diff --git a/platform/x11/x11_main.c b/platform/x11/x11_main.c -index fe2daa8..edbb9fa 100644 ---- a/platform/x11/x11_main.c -+++ b/platform/x11/x11_main.c -@@ -317,13 +317,38 @@ void winreplacefile(char *source, char *target) - - void wincopyfile(char *source, char *target) - { -- char *buf = malloc(strlen(source)+strlen(target)+5); -- if (buf) -+ FILE *in, *out; -+ char buf[32 << 10]; -+ int n; -+ -+ in = fopen(source, "rb"); -+ if (!in) -+ { -+ winerror(&gapp, "cannot open source file for copying"); -+ return; -+ } -+ out = fopen(target, "wb"); -+ if (!out) -+ { -+ winerror(&gapp, "cannot open target file for copying"); -+ fclose(in); -+ return; -+ } -+ -+ for (;;) - { -- sprintf(buf, "cp %s %s", source, target); -- system(buf); -- free(buf); -+ n = fread(buf, 1, sizeof buf, in); -+ fwrite(buf, 1, n, out); -+ if (n < sizeof buf) -+ { -+ if (ferror(in)) -+ winerror(&gapp, "cannot read data from source file"); -+ break; -+ } - } -+ -+ fclose(out); -+ fclose(in); - } - - void cleanup(pdfapp_t *app) -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 392adf3..4997ebe 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -590,7 +590,7 @@ pdf_load_version(fz_context *ctx, pdf_document *doc) - - fz_seek(ctx, doc->file, 0, SEEK_SET); - fz_read_line(ctx, doc->file, buf, sizeof buf); -- if (memcmp(buf, "%PDF-", 5) != 0) -+ if (strlen(buf) < 5 || memcmp(buf, "%PDF-", 5) != 0) - fz_throw(ctx, FZ_ERROR_GENERIC, "cannot recognize version marker"); - - doc->version = 10 * (fz_atof(buf+5) + 0.05f); --- -2.9.1 diff --git a/office/misc/mupdf/files/mupdf-1.12.0-security_fix-1.patch b/office/misc/mupdf/files/mupdf-1.12.0-security_fix-1.patch deleted file mode 100644 index 0f496edc42..0000000000 --- a/office/misc/mupdf/files/mupdf-1.12.0-security_fix-1.patch +++ /dev/null @@ -1,108 +0,0 @@ -Submitted By: Pierre Labastie -Date: 2018-02-18 -Initial Package Version: 1.12.0 -Upstream Status: Commit 55c3f68d638ac1263a386e0aaa004bb6e8bde731 -Origin: Upstream -Description: Fixes for CVE-2017-17858 - -From 55c3f68d638ac1263a386e0aaa004bb6e8bde731 Mon Sep 17 00:00:00 2001 -From: Sebastian Rasmussen -Date: Mon, 11 Dec 2017 14:09:15 +0100 -Subject: [PATCH] Bugs 698804/698810/698811: Keep PDF object numbers below - limit. - -This ensures that: - * xref tables with objects pointers do not grow out of bounds. - * other readers, e.g. Adobe Acrobat can parse PDFs written by mupdf. ---- - include/mupdf/pdf/object.h | 3 +++ - source/pdf/pdf-repair.c | 5 +---- - source/pdf/pdf-xref.c | 21 ++++++++++++--------- - 3 files changed, 16 insertions(+), 13 deletions(-) - -diff --git a/include/mupdf/pdf/object.h b/include/mupdf/pdf/object.h -index 21ed859..4177112 100644 ---- a/include/mupdf/pdf/object.h -+++ b/include/mupdf/pdf/object.h -@@ -3,6 +3,9 @@ - - typedef struct pdf_document_s pdf_document; - -+/* Defined in PDF 1.7 according to Acrobat limit. */ -+#define PDF_MAX_OBJECT_NUMBER 8388607 -+ - /* - * Dynamic objects. - * The same type of objects as found in PDF and PostScript. -diff --git a/source/pdf/pdf-repair.c b/source/pdf/pdf-repair.c -index ca149bd..0c29758 100644 ---- a/source/pdf/pdf-repair.c -+++ b/source/pdf/pdf-repair.c -@@ -6,9 +6,6 @@ - - /* Scan file for objects and reconstruct xref table */ - --/* Define in PDF 1.7 to be 8388607, but mupdf is more lenient. */ --#define MAX_OBJECT_NUMBER (10 << 20) -- - struct entry - { - int num; -@@ -436,7 +433,7 @@ pdf_repair_xref(fz_context *ctx, pdf_document *doc) - break; - } - -- if (num <= 0 || num > MAX_OBJECT_NUMBER) -+ if (num <= 0 || num > PDF_MAX_OBJECT_NUMBER) - { - fz_warn(ctx, "ignoring object with invalid object number (%d %d R)", num, gen); - goto have_next_token; -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 00586db..6284e70 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -868,11 +868,12 @@ pdf_read_old_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) - fz_seek(ctx, file, -(2 + (int)strlen(s)), SEEK_CUR); - } - -- if (ofs < 0) -- fz_throw(ctx, FZ_ERROR_GENERIC, "out of range object num in xref: %d", (int)ofs); -- if (ofs > INT64_MAX - len) -- fz_throw(ctx, FZ_ERROR_GENERIC, "xref section object numbers too big"); -- -+ if (ofs < 0 || ofs > PDF_MAX_OBJECT_NUMBER -+ || len < 0 || len > PDF_MAX_OBJECT_NUMBER -+ || ofs + len - 1 > PDF_MAX_OBJECT_NUMBER) -+ { -+ fz_throw(ctx, FZ_ERROR_GENERIC, "xref subsection object numbers are out of range"); -+ } - /* broken pdfs where size in trailer undershoots entries in xref sections */ - if (ofs + len > xref_len) - { -@@ -933,10 +934,8 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, in - pdf_xref_entry *table; - int i, n; - -- if (i0 < 0 || i1 < 0 || i0 > INT_MAX - i1) -- fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index"); -- //if (i0 + i1 > pdf_xref_len(ctx, doc)) -- // fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries"); -+ if (i0 < 0 || i0 > PDF_MAX_OBJECT_NUMBER || i1 < 0 || i1 > PDF_MAX_OBJECT_NUMBER || i0 + i1 - 1 > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "xref subsection object numbers are out of range"); - - table = pdf_xref_find_subsection(ctx, doc, i0, i1); - for (i = i0; i < i0 + i1; i++) -@@ -2086,6 +2085,10 @@ pdf_create_object(fz_context *ctx, pdf_document *doc) - /* TODO: reuse free object slots by properly linking free object chains in the ofs field */ - pdf_xref_entry *entry; - int num = pdf_xref_len(ctx, doc); -+ -+ if (num > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "too many objects stored in pdf"); -+ - entry = pdf_get_incremental_xref_entry(ctx, doc, num); - entry->type = 'f'; - entry->ofs = -1; --- -2.9.1 - diff --git a/office/misc/mupdf/files/mupdf-CVE-2017-17858.patch b/office/misc/mupdf/files/mupdf-CVE-2017-17858.patch deleted file mode 100644 index 1e31e81f53..0000000000 --- a/office/misc/mupdf/files/mupdf-CVE-2017-17858.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 55c3f68d638ac1263a386e0aaa004bb6e8bde731 Mon Sep 17 00:00:00 2001 -From: Sebastian Rasmussen -Date: Mon, 11 Dec 2017 14:09:15 +0100 -Subject: [PATCH] Bugs 698804/698810/698811: Keep PDF object numbers below - limit. - -This ensures that: - * xref tables with objects pointers do not grow out of bounds. - * other readers, e.g. Adobe Acrobat can parse PDFs written by mupdf. ---- - include/mupdf/pdf/object.h | 3 +++ - source/pdf/pdf-repair.c | 5 +---- - source/pdf/pdf-xref.c | 21 ++++++++++++--------- - 3 files changed, 16 insertions(+), 13 deletions(-) - -diff --git a/include/mupdf/pdf/object.h b/include/mupdf/pdf/object.h -index 21ed859..4177112 100644 ---- a/include/mupdf/pdf/object.h -+++ b/include/mupdf/pdf/object.h -@@ -3,6 +3,9 @@ - - typedef struct pdf_document_s pdf_document; - -+/* Defined in PDF 1.7 according to Acrobat limit. */ -+#define PDF_MAX_OBJECT_NUMBER 8388607 -+ - /* - * Dynamic objects. - * The same type of objects as found in PDF and PostScript. -diff --git a/source/pdf/pdf-repair.c b/source/pdf/pdf-repair.c -index ca149bd..0c29758 100644 ---- a/source/pdf/pdf-repair.c -+++ b/source/pdf/pdf-repair.c -@@ -6,9 +6,6 @@ - - /* Scan file for objects and reconstruct xref table */ - --/* Define in PDF 1.7 to be 8388607, but mupdf is more lenient. */ --#define MAX_OBJECT_NUMBER (10 << 20) -- - struct entry - { - int num; -@@ -436,7 +433,7 @@ pdf_repair_xref(fz_context *ctx, pdf_document *doc) - break; - } - -- if (num <= 0 || num > MAX_OBJECT_NUMBER) -+ if (num <= 0 || num > PDF_MAX_OBJECT_NUMBER) - { - fz_warn(ctx, "ignoring object with invalid object number (%d %d R)", num, gen); - goto have_next_token; -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 00586db..6284e70 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -868,11 +868,12 @@ pdf_read_old_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) - fz_seek(ctx, file, -(2 + (int)strlen(s)), SEEK_CUR); - } - -- if (ofs < 0) -- fz_throw(ctx, FZ_ERROR_GENERIC, "out of range object num in xref: %d", (int)ofs); -- if (ofs > INT64_MAX - len) -- fz_throw(ctx, FZ_ERROR_GENERIC, "xref section object numbers too big"); -- -+ if (ofs < 0 || ofs > PDF_MAX_OBJECT_NUMBER -+ || len < 0 || len > PDF_MAX_OBJECT_NUMBER -+ || ofs + len - 1 > PDF_MAX_OBJECT_NUMBER) -+ { -+ fz_throw(ctx, FZ_ERROR_GENERIC, "xref subsection object numbers are out of range"); -+ } - /* broken pdfs where size in trailer undershoots entries in xref sections */ - if (ofs + len > xref_len) - { -@@ -933,10 +934,8 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, in - pdf_xref_entry *table; - int i, n; - -- if (i0 < 0 || i1 < 0 || i0 > INT_MAX - i1) -- fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index"); -- //if (i0 + i1 > pdf_xref_len(ctx, doc)) -- // fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries"); -+ if (i0 < 0 || i0 > PDF_MAX_OBJECT_NUMBER || i1 < 0 || i1 > PDF_MAX_OBJECT_NUMBER || i0 + i1 - 1 > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "xref subsection object numbers are out of range"); - - table = pdf_xref_find_subsection(ctx, doc, i0, i1); - for (i = i0; i < i0 + i1; i++) -@@ -2086,6 +2085,10 @@ pdf_create_object(fz_context *ctx, pdf_document *doc) - /* TODO: reuse free object slots by properly linking free object chains in the ofs field */ - pdf_xref_entry *entry; - int num = pdf_xref_len(ctx, doc); -+ -+ if (num > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "too many objects stored in pdf"); -+ - entry = pdf_get_incremental_xref_entry(ctx, doc, num); - entry->type = 'f'; - entry->ofs = -1; --- -2.9.1 - diff --git a/office/misc/mupdf/files/shared-libs.patch b/office/misc/mupdf/files/shared-libs.patch new file mode 100644 index 0000000000..e0ca039e22 --- /dev/null +++ b/office/misc/mupdf/files/shared-libs.patch @@ -0,0 +1,59 @@ +From aaa2d5971fa8419c2a7aec5361d909a45226d20a Mon Sep 17 00:00:00 2001 +From: Fabio Forni +Date: Sun, 6 Dec 2020 13:25:20 +0100 +Subject: [PATCH] Link against shared libs + +--- + Makefile | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/Makefile b/Makefile +index b0fb617..9fe5001 100644 +--- a/Makefile ++++ b/Makefile +@@ -24,7 +24,7 @@ include Makethird + # Do not specify CFLAGS or LIBS on the make invocation line - specify + # XCFLAGS or XLIBS instead. Make ignores any lines in the makefile that + # set a variable that was set on the command line. +-CFLAGS += $(XCFLAGS) -Iinclude ++CFLAGS += $(XCFLAGS) -Iinclude -fPIC + LIBS += $(XLIBS) -lm + + ifneq ($(threading),no) +@@ -214,15 +214,19 @@ MUPDF_LIB = $(OUT)/libmupdf.$(SO) + + $(MUPDF_LIB) : $(MUPDF_OBJ) $(THIRD_OBJ) $(THREAD_OBJ) $(PKCS7_OBJ) + else +-MUPDF_LIB = $(OUT)/libmupdf.a +-THIRD_LIB = $(OUT)/libmupdf-third.a +-THREAD_LIB = $(OUT)/libmupdf-threads.a +-PKCS7_LIB = $(OUT)/libmupdf-pkcs7.a ++MUPDF_LIB = $(OUT)/libmupdf.so ++THIRD_LIB = $(OUT)/libmupdf-third.so ++THREAD_LIB = $(OUT)/libmupdf-threads.so ++PKCS7_LIB = $(OUT)/libmupdf-pkcs7.so + +-$(MUPDF_LIB) : $(MUPDF_OBJ) ++$(MUPDF_LIB) : $(MUPDF_OBJ) $(THIRD_LIB) $(THREAD_LIB) ++ $(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf.so -Wl,--no-undefined $(THIRD_LIBS) + $(THIRD_LIB) : $(THIRD_OBJ) ++ $(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf-third.so -Wl,--no-undefined + $(THREAD_LIB) : $(THREAD_OBJ) ++ $(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf-threads.so -Wl,--no-undefined -lpthread + $(PKCS7_LIB) : $(PKCS7_OBJ) ++ $(LINK_CMD) -shared -Wl,-soname -Wl,libmupdf-pkcs7.so + endif + + $(MUPDF_LIB) : $(MUPDF_OBJ) +@@ -230,7 +234,7 @@ $(THIRD_LIB) : $(THIRD_OBJ) + $(THREAD_LIB) : $(THREAD_OBJ) + $(PKCS7_LIB) : $(PKCS7_OBJ) + +-INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB) ++INSTALL_LIBS := $(MUPDF_LIB) $(THIRD_LIB) $(THREAD_LIB) $(PKCS7_LIB) + + # --- Main tools and viewers --- + +-- +2.29.2 + diff --git a/office/misc/mupdf/pspec.xml b/office/misc/mupdf/pspec.xml index cebfe335e6..1b5416479f 100644 --- a/office/misc/mupdf/pspec.xml +++ b/office/misc/mupdf/pspec.xml @@ -1,5 +1,5 @@ - + mupdf @@ -10,39 +10,36 @@ AGPL3 app:gui - Lightweight PDF and XPS viewer + Lightweight PDF and XPS viewer. MuPDF is a lightweight open source software framework for viewing and converting PDF, XPS, and E-book documents. - - https://mupdf.com/downloads/archive/mupdf-1.16.1-source.tar.gz + + https://mupdf.com/downloads/archive/mupdf-1.18.0-source.tar.xz - curl-devel libXi-devel libX11-devel libXext-devel openssl-devel - mesa-glu-devel + libglvnd-devel + openjpeg2-devel libXrandr-devel + leptonica-devel + tesseract-devel libXcursor-devel libXinerama-devel + libjpeg-turbo-devel - + shared-libs.patch + 32e4e8b4bcbacbf92af7c.patch + b82e9b6d6b46877e5c376.patch + fix-build-on-big-endian.patch @@ -51,19 +48,22 @@ curl mesa + zlib libX11 - libXext openssl + libXext + freetype + harfbuzz + libglvnd libXrandr + openjpeg2 + libjpeg-turbo /usr/bin - + /usr/lib + /usr/share/man /usr/share/doc - /usr/share/man/man1 @@ -81,6 +81,13 @@ + + 2021-01-19 + 1.18.0 + Version bump. + fury + wascheme@tuta.io + 2020-02-22 1.16.1