gnu/packages/patches/mupdf-CVE-2017-14687.patch

   1 Fix CVE-2017-14687:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14687
   4
   5 Patch copied from upstream source repository:
   6
   7 https://git.ghostscript.com/?p=mupdf.git;h=2b16dbd8f73269cb15ca61ece75cf8d2d196ed28
   8
   9 From 2b16dbd8f73269cb15ca61ece75cf8d2d196ed28 Mon Sep 17 00:00:00 2001
  10 From: Tor Andersson <tor.andersson@artifex.com>
  11 Date: Tue, 19 Sep 2017 17:17:12 +0200
  12 Subject: [PATCH] Fix 698558: Handle non-tags in tag name comparisons.
  13
  14 Use fz_xml_is_tag instead of fz_xml_tag && !strcmp idiom.
  15 ---
  16  source/html/css-apply.c   | 2 +-
  17  source/svg/svg-run.c      | 2 +-
  18  source/xps/xps-common.c   | 6 +++---
  19  source/xps/xps-glyphs.c   | 2 +-
  20  source/xps/xps-path.c     | 4 ++--
  21  source/xps/xps-resource.c | 2 +-
  22  6 files changed, 9 insertions(+), 9 deletions(-)
  23
  24 diff --git a/source/html/css-apply.c b/source/html/css-apply.c
  25 index de55490..6a91df0 100644
  26 --- a/source/html/css-apply.c
  27 +++ b/source/html/css-apply.c
  28 @@ -328,7 +328,7 @@ match_selector(fz_css_selector *sel, fz_xml *node)
  29
  30         if (sel->name)
  31         {
  32 -               if (strcmp(sel->name, fz_xml_tag(node)))
  33 +               if (!fz_xml_is_tag(node, sel->name))
  34                         return 0;
  35         }
  36
  37 diff --git a/source/svg/svg-run.c b/source/svg/svg-run.c
  38 index f974c67..5302c64 100644
  39 --- a/source/svg/svg-run.c
  40 +++ b/source/svg/svg-run.c
  41 @@ -1044,7 +1044,7 @@ svg_run_use(fz_context *ctx, fz_device *dev, svg_document *doc, fz_xml *root, co
  42                 fz_xml *linked = fz_tree_lookup(ctx, doc->idmap, xlink_href_att + 1);
  43                 if (linked)
  44                 {
  45 -                       if (!strcmp(fz_xml_tag(linked), "symbol"))
  46 +                       if (fz_xml_is_tag(linked, "symbol"))
  47                                 svg_run_use_symbol(ctx, dev, doc, root, linked, &local_state);
  48                         else
  49                                 svg_run_element(ctx, dev, doc, linked, &local_state);
  50 diff --git a/source/xps/xps-common.c b/source/xps/xps-common.c
  51 index cc7fed9..f2f9b93 100644
  52 --- a/source/xps/xps-common.c
  53 +++ b/source/xps/xps-common.c
  54 @@ -47,7 +47,7 @@ xps_parse_brush(fz_context *ctx, xps_document *doc, const fz_matrix *ctm, const
  55         else if (fz_xml_is_tag(node, "RadialGradientBrush"))
  56                 xps_parse_radial_gradient_brush(ctx, doc, ctm, area, base_uri, dict, node);
  57         else
  58 -               fz_warn(ctx, "unknown brush tag: %s", fz_xml_tag(node));
  59 +               fz_warn(ctx, "unknown brush tag");
  60  }
  61
  62  void
  63 @@ -85,7 +85,7 @@ xps_begin_opacity(fz_context *ctx, xps_document *doc, const fz_matrix *ctm, cons
  64         if (opacity_att)
  65                 opacity = fz_atof(opacity_att);
  66
  67 -       if (opacity_mask_tag && !strcmp(fz_xml_tag(opacity_mask_tag), "SolidColorBrush"))
  68 +       if (fz_xml_is_tag(opacity_mask_tag, "SolidColorBrush"))
  69         {
  70                 char *scb_opacity_att = fz_xml_att(opacity_mask_tag, "Opacity");
  71                 char *scb_color_att = fz_xml_att(opacity_mask_tag, "Color");
  72 @@ -129,7 +129,7 @@ xps_end_opacity(fz_context *ctx, xps_document *doc, char *base_uri, xps_resource
  73
  74         if (opacity_mask_tag)
  75         {
  76 -               if (strcmp(fz_xml_tag(opacity_mask_tag), "SolidColorBrush"))
  77 +               if (!fz_xml_is_tag(opacity_mask_tag, "SolidColorBrush"))
  78                         fz_pop_clip(ctx, dev);
  79         }
  80  }
  81 diff --git a/source/xps/xps-glyphs.c b/source/xps/xps-glyphs.c
  82 index 29dc5b3..5b26d78 100644
  83 --- a/source/xps/xps-glyphs.c
  84 +++ b/source/xps/xps-glyphs.c
  85 @@ -592,7 +592,7 @@ xps_parse_glyphs(fz_context *ctx, xps_document *doc, const fz_matrix *ctm,
  86
  87         /* If it's a solid color brush fill/stroke do a simple fill */
  88
  89 -       if (fill_tag && !strcmp(fz_xml_tag(fill_tag), "SolidColorBrush"))
  90 +       if (fz_xml_is_tag(fill_tag, "SolidColorBrush"))
  91         {
  92                 fill_opacity_att = fz_xml_att(fill_tag, "Opacity");
  93                 fill_att = fz_xml_att(fill_tag, "Color");
  94 diff --git a/source/xps/xps-path.c b/source/xps/xps-path.c
  95 index 6faeb0c..021d202 100644
  96 --- a/source/xps/xps-path.c
  97 +++ b/source/xps/xps-path.c
  98 @@ -879,14 +879,14 @@ xps_parse_path(fz_context *ctx, xps_document *doc, const fz_matrix *ctm, char *b
  99         if (!data_att && !data_tag)
 100                 return;
 101
 102 -       if (fill_tag && !strcmp(fz_xml_tag(fill_tag), "SolidColorBrush"))
 103 +       if (fz_xml_is_tag(fill_tag, "SolidColorBrush"))
 104         {
 105                 fill_opacity_att = fz_xml_att(fill_tag, "Opacity");
 106                 fill_att = fz_xml_att(fill_tag, "Color");
 107                 fill_tag = NULL;
 108         }
 109
 110 -       if (stroke_tag && !strcmp(fz_xml_tag(stroke_tag), "SolidColorBrush"))
 111 +       if (fz_xml_is_tag(stroke_tag, "SolidColorBrush"))
 112         {
 113                 stroke_opacity_att = fz_xml_att(stroke_tag, "Opacity");
 114                 stroke_att = fz_xml_att(stroke_tag, "Color");
 115 diff --git a/source/xps/xps-resource.c b/source/xps/xps-resource.c
 116 index c2292e6..8e81ab8 100644
 117 --- a/source/xps/xps-resource.c
 118 +++ b/source/xps/xps-resource.c
 119 @@ -84,7 +84,7 @@ xps_parse_remote_resource_dictionary(fz_context *ctx, xps_document *doc, char *b
 120         if (!xml)
 121                 return NULL;
 122
 123 -       if (strcmp(fz_xml_tag(xml), "ResourceDictionary"))
 124 +       if (!fz_xml_is_tag(xml, "ResourceDictionary"))
 125         {
 126                 fz_drop_xml(ctx, xml);
 127                 fz_throw(ctx, FZ_ERROR_GENERIC, "expected ResourceDictionary element");
 128 --
 129 2.9.1
 130