djvulibre.
This commit is contained in:
@@ -1,12 +0,0 @@
|
||||
diff -up djvulibre-3.5.22/libdjvu/GSmartPointer.h.cdefs djvulibre-3.5.22/libdjvu/GSmartPointer.h
|
||||
--- djvulibre-3.5.22/libdjvu/GSmartPointer.h.cdefs 2008-03-05 01:44:20.000000000 +0000
|
||||
+++ djvulibre-3.5.22/libdjvu/GSmartPointer.h 2011-01-31 13:43:37.595917364 +0000
|
||||
@@ -65,6 +65,8 @@
|
||||
# pragma interface
|
||||
#endif
|
||||
|
||||
+#include <cstddef>
|
||||
+
|
||||
/** @name GSmartPointer.h
|
||||
|
||||
Files #"GSmartPointer.h"# and #"GSmartPointer.cpp"# define a smart-pointer
|
||||
@@ -0,0 +1,16 @@
|
||||
diff --git a/libdjvu/IW44Image.cpp b/libdjvu/IW44Image.cpp
|
||||
index e8d4b44..aa3d554 100644
|
||||
--- a/libdjvu/IW44Image.cpp
|
||||
+++ b/libdjvu/IW44Image.cpp
|
||||
@@ -678,7 +678,11 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast)
|
||||
size_t sz = bw * bh;
|
||||
if (sz / (size_t)bw != (size_t)bh) // multiplication overflow
|
||||
G_THROW("IW44Image: image size exceeds maximum (corrupted file?)");
|
||||
+ if (sz == 0)
|
||||
+ G_THROW("IW44Image: zero size image (corrupted file?)");
|
||||
GPBuffer<short> gdata16(data16,sz);
|
||||
+ if (data16 == NULL)
|
||||
+ G_THROW("IW44Image: unable to allocate image data");
|
||||
// Copy coefficients
|
||||
int i;
|
||||
short *p = data16;
|
||||
@@ -0,0 +1,13 @@
|
||||
diff --git a/libdjvu/DataPool.cpp b/libdjvu/DataPool.cpp
|
||||
index 5fcbedf..4c2eaf0 100644
|
||||
--- a/libdjvu/DataPool.cpp
|
||||
+++ b/libdjvu/DataPool.cpp
|
||||
@@ -791,6 +791,8 @@ DataPool::create(const GP<DataPool> & pool, int start, int length)
|
||||
DEBUG_MSG("DataPool::DataPool: pool=" << (void *)((DataPool *)pool) << " start=" << start << " length= " << length << "\n");
|
||||
DEBUG_MAKE_INDENT(3);
|
||||
|
||||
+ if (!pool) G_THROW( ERR_MSG("DataPool.zero_DataPool") );
|
||||
+
|
||||
DataPool *xpool=new DataPool();
|
||||
GP<DataPool> retval=xpool;
|
||||
xpool->init();
|
||||
@@ -0,0 +1,36 @@
|
||||
diff --git a/libdjvu/DjVuPort.cpp b/libdjvu/DjVuPort.cpp
|
||||
index 2b3e0d2..ede7f6b 100644
|
||||
--- a/libdjvu/DjVuPort.cpp
|
||||
+++ b/libdjvu/DjVuPort.cpp
|
||||
@@ -507,10 +507,19 @@ GP<DjVuFile>
|
||||
DjVuPortcaster::id_to_file(const DjVuPort * source, const GUTF8String &id)
|
||||
{
|
||||
GPList<DjVuPort> list;
|
||||
+
|
||||
+ if (!!opening_id && opening_id == id)
|
||||
+ G_THROW("DjVuPortcaster: recursive opening of the same file (corrupted file?)");
|
||||
+ else
|
||||
+ opening_id = id;
|
||||
+
|
||||
compute_closure(source, list, true);
|
||||
GP<DjVuFile> file;
|
||||
for(GPosition pos=list;pos;++pos)
|
||||
if ((file=list[pos]->id_to_file(source, id))) break;
|
||||
+
|
||||
+ opening_id = GUTF8String();
|
||||
+
|
||||
return file;
|
||||
}
|
||||
|
||||
diff --git a/libdjvu/DjVuPort.h b/libdjvu/DjVuPort.h
|
||||
index e2b3125..313dc2b 100644
|
||||
--- a/libdjvu/DjVuPort.h
|
||||
+++ b/libdjvu/DjVuPort.h
|
||||
@@ -484,6 +484,7 @@ private:
|
||||
const DjVuPort *dst, int distance);
|
||||
void compute_closure(const DjVuPort *src, GPList<DjVuPort> &list,
|
||||
bool sorted=false);
|
||||
+ GUTF8String opening_id;
|
||||
};
|
||||
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp
|
||||
index 7109952..b41f7d2 100644
|
||||
--- a/tools/ddjvu.cpp
|
||||
+++ b/tools/ddjvu.cpp
|
||||
@@ -70,6 +70,7 @@
|
||||
#include <locale.h>
|
||||
#include <fcntl.h>
|
||||
#include <errno.h>
|
||||
+#include <stdint.h>
|
||||
|
||||
#ifdef UNIX
|
||||
# include <sys/time.h>
|
||||
@@ -394,7 +395,9 @@ render(ddjvu_page_t *page, int pageno)
|
||||
rowsize = rrect.w;
|
||||
else
|
||||
rowsize = rrect.w * 3;
|
||||
- if (! (image = (char*)malloc(rowsize * rrect.h)))
|
||||
+ if ((size_t)rowsize > SIZE_MAX / rrect.h)
|
||||
+ die(i18n("Integer overflow when allocating image buffer for page %d"), pageno);
|
||||
+ if (! (image = (char*)malloc((size_t)rowsize * rrect.h)))
|
||||
die(i18n("Cannot allocate image buffer for page %d"), pageno);
|
||||
|
||||
/* Render */
|
||||
@@ -0,0 +1,21 @@
|
||||
diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp
|
||||
index c2fdbe4..e271a1d 100644
|
||||
--- a/libdjvu/GBitmap.cpp
|
||||
+++ b/libdjvu/GBitmap.cpp
|
||||
@@ -69,6 +69,7 @@
|
||||
#include <stddef.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
+#include <limits.h>
|
||||
|
||||
// - Author: Leon Bottou, 05/1997
|
||||
|
||||
@@ -1284,6 +1285,8 @@ GBitmap::decode(unsigned char *runs)
|
||||
// initialize pixel array
|
||||
if (nrows==0 || ncolumns==0)
|
||||
G_THROW( ERR_MSG("GBitmap.not_init") );
|
||||
+ if (ncolumns > USHRT_MAX - border)
|
||||
+ G_THROW("GBitmap: row size exceeds maximum (corrupted file?)");
|
||||
bytes_per_row = ncolumns + border;
|
||||
if (runs==0)
|
||||
G_THROW( ERR_MSG("GBitmap.null_arg") );
|
||||
@@ -1,7 +1,5 @@
|
||||
Index: djvulibre-3.5.22/config/acinclude.m4
|
||||
===================================================================
|
||||
--- djvulibre-3.5.22.orig/config/acinclude.m4
|
||||
+++ djvulibre-3.5.22/config/acinclude.m4
|
||||
--- a/config/acinclude.m4
|
||||
+++ b/config/acinclude.m4
|
||||
@@ -408,7 +408,7 @@ case "${host_os}-${GCC}" in
|
||||
# On Linux/GCC, libtool uses -nostdlib for linking, which cancel part
|
||||
# of the -pthread flag effect (libpthread is not automatically linked).
|
||||
@@ -0,0 +1,14 @@
|
||||
--- a/libdjvu/DjVuText.cpp
|
||||
+++ b/libdjvu/DjVuText.cpp
|
||||
@@ -345,9 +345,9 @@
|
||||
int textsize = bs.read24();
|
||||
char *buffer = textUTF8.getbuf(textsize);
|
||||
int readsize = bs.read(buffer,textsize);
|
||||
+ if (readsize < textsize || textsize <= 0)
|
||||
+ G_THROW( ERR_MSG("DjVuText.corrupt_chunk") );
|
||||
buffer[readsize] = 0;
|
||||
- if (readsize < textsize)
|
||||
- G_THROW( ERR_MSG("DjVuText.corrupt_chunk") );
|
||||
// Try reading zones
|
||||
unsigned char version;
|
||||
if ( bs.read( (void*) &version, 1 ) == 1)
|
||||
Reference in New Issue
Block a user