gnu/packages/patches/mupdf-CVE-2021-3407.patch

   1 This patch came from https://git.ghostscript.com/?p=mupdf.git;a=patch;h=cee7cefc610d42fd383b3c80c12cbc675443176a
   2 and fixes CVE-2021-3407.
   3
   4 From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001
   5 From: Robin Watts <Robin.Watts@artifex.com>
   6 Date: Fri, 22 Jan 2021 17:05:15 +0000
   7 Subject: [PATCH] Bug 703366: Fix double free of object during linearization.
   8
   9 This appears to happen because we parse an illegal object from
  10 a broken file and assign it to object 0, which is defined to
  11 be free.
  12
  13 Here, we fix the parsing code so this can't happen.
  14 ---
  15  source/pdf/pdf-parse.c | 6 ++++++
  16  source/pdf/pdf-xref.c  | 2 ++
  17  2 files changed, 8 insertions(+)
  18
  19 diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
  20 index 7abc8c3d4..5761c3351 100644
  21 --- a/source/pdf/pdf-parse.c
  22 +++ b/source/pdf/pdf-parse.c
  23 @@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
  24                 fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
  25         }
  26         gen = buf->i;
  27 +       if (gen < 0 || gen >= 65536)
  28 +       {
  29 +               if (try_repair)
  30 +                       *try_repair = 1;
  31 +               fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
  32 +       }
  33
  34         tok = pdf_lex(ctx, file, buf);
  35         if (tok != PDF_TOK_OBJ)
  36 diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
  37 index 1b2bdcd59..30197b4b8 100644
  38 --- a/source/pdf/pdf-xref.c
  39 +++ b/source/pdf/pdf-xref.c
  40 @@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
  41         {
  42                 ofs = fz_tell(ctx, doc->file);
  43                 trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
  44 +               if (num == 0)
  45 +                       fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
  46         }
  47         fz_catch(ctx)
  48         {
  49 --
  50 2.17.1
  51