Attachment #178879 for bug #216061

View | Details | Raw Unified | Return to bug 216061
Collapse All | Expand All

Lines 1-8 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/Makefile (-2 / +2 lines)
1	# Created by: Martin Dieringer <martin.dieringer@gmx.de>	1	# Created by: Martin Dieringer <martin.dieringer@gmx.de>
2	# $FreeBSD$	2	# $FreeBSD: head/graphics/mupdf/Makefile 423807 2016-10-12 00:11:07Z feld $
3		3
4	PORTNAME= mupdf	4	PORTNAME= mupdf
5	PORTVERSION= 1.9a	5	PORTVERSION= 1.10a
6	PORTREVISION= 1	6	PORTREVISION= 1
7	DISTVERSIONSUFFIX= -source	7	DISTVERSIONSUFFIX= -source
8	PORTEPOCH= 1	8	PORTEPOCH= 1

Lines 1-3 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/distinfo (-3 / +3 lines)
1	TIMESTAMP = 1466328793	1	TIMESTAMP = 1484331364
2	SHA256 (mupdf-1.9a-source.tar.gz) = 8015c55f4e6dd892d3c50db4f395c1e46660a10b460e2ecd180a497f55bbc4cc	2	SHA256 (mupdf-1.10a-source.tar.gz) = aacc1f36b9180f562022ef1ab3439b009369d944364f3cff8a2a898834e3a836
3	SIZE (mupdf-1.9a-source.tar.gz) = 20493793	3	SIZE (mupdf-1.10a-source.tar.gz) = 42264707

Lines 1-4 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/files/patch-scripts_fontdump.c (-1 / +1 lines)
1	--- scripts/fontdump.c.orig 2016-04-21 11:14:32 UTC	1	--- scripts/fontdump.c.orig 2016-11-28 13:34:04 UTC
2	+++ scripts/fontdump.c	2	+++ scripts/fontdump.c
3	@@ -50,7 +50,6 @@ main(int argc, char **argv)	3	@@ -50,7 +50,6 @@ main(int argc, char **argv)
4	fprintf(fo, "#ifndef __STRICT_ANSI__\n");	4	fprintf(fo, "#ifndef __STRICT_ANSI__\n");




--- source/fitz/load-jpx.c.orig	2016-11-28 13:34:04 UTC
+++ source/fitz/load-jpx.c
@@ -481,15 +481,7 @@ fz_load_jpx_info(fz_context *ctx, unsign
 
 #else /* HAVE_LURATECH */
 
-/* Without the definition of OPJ_STATIC, compilation fails on windows
- * due to the use of __stdcall. We believe it is required on some

-#include <openjpeg.h>
+#include <openjpeg-2.1/openjpeg.h>
 
 /* OpenJPEG does not provide a safe mechanism to intercept
  * allocations. In the latest version all allocations go
@@ -117,7 +109,7 @@ fz_load_jpx(fz_context *ctx, unsigned ch
 	opj_stream_set_read_function(stream, fz_opj_stream_read);
 	opj_stream_set_skip_function(stream, fz_opj_stream_skip);
 	opj_stream_set_seek_function(stream, fz_opj_stream_seek);
-	opj_stream_set_user_data(stream, &sb);
+	opj_stream_set_user_data(stream, &sb,NULL);
 	/* Set the length to avoid an assert */
 	opj_stream_set_user_data_length(stream, size);
 




$OpenBSD: patch-source_pdf_pdf-shade_c,v 1.1 2016/08/27 20:58:48 jca Exp $

  CVE-2016-6525

  http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e;hp=fa1936405b6a84e5c9bb440912c23d532772f958

--- source/pdf/pdf-shade.c.orig	2016-04-21 11:14:32 UTC
+++ source/pdf/pdf-shade.c
@@ -206,7 +206,7 @@ pdf_load_mesh_params(fz_context *ctx, pd
 	obj = pdf_dict_get(ctx, dict, PDF_NAME_Decode);
 	if (pdf_array_len(ctx, obj) >= 6)
 	{
-		n = (pdf_array_len(ctx, obj) - 4) / 2;
+		n = fz_mini(FZ_MAX_COLORS, (pdf_array_len(ctx, obj) - 4) / 2);
 		shade->u.m.x0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 0));
 		shade->u.m.x1 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 1));
 		shade->u.m.y0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 2));




$OpenBSD: patch-source_pdf_pdf-xref_c,v 1.1 2016/08/27 20:58:48 jca Exp $

  CVE-2016-6265

  http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa1936405b6a84e5c9bb440912c23d532772f958

--- source/pdf/pdf-xref.c.orig	2016-04-21 11:14:32 UTC
+++ source/pdf/pdf-xref.c
@@ -1191,8 +1191,14 @@ pdf_load_xref(fz_context *ctx, pdf_docum
 				fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", (int)entry->ofs, i);
 		}
 		if (entry->type == 'o')
-			if (entry->ofs <= 0 || entry->ofs >= xref_len || pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
-				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i);
+		{
+			/* Read this into a local variable here, because pdf_get_xref_entry
+			 * may solidify the xref, hence invalidating "entry", meaning we
+			 * need a stashed value for the throw. */
+			fz_off_t ofs = entry->ofs;
+			if (ofs <= 0 || ofs >= xref_len || pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
+				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
+		}
 	}
 }
 




bin/mupdf
bin/mupdf-gl
bin/mupdf-x11-curl
bin/muraster
bin/mutool
include/mupdf/fitz.h
include/mupdf/fitz/annotation.h
include/mupdf/fitz/archive.h
include/mupdf/fitz/bidi.h
include/mupdf/fitz/bitmap.h
include/mupdf/fitz/buffer.h
include/mupdf/fitz/colorspace.h
include/mupdf/fitz/compressed-buffer.h
include/mupdf/fitz/config.h
include/mupdf/fitz/context.h
include/mupdf/fitz/crypt.h
include/mupdf/fitz/device.h

include/mupdf/fitz/structured-text.h
include/mupdf/fitz/system.h
include/mupdf/fitz/text.h
include/mupdf/fitz/track-usage.h
include/mupdf/fitz/transition.h
include/mupdf/fitz/tree.h
include/mupdf/fitz/ucdn.h
include/mupdf/fitz/unzip.h
include/mupdf/fitz/util.h
include/mupdf/fitz/version.h
include/mupdf/fitz/writer.h
include/mupdf/fitz/xml.h
include/mupdf/html.h
include/mupdf/memento.h

include/mupdf/pdf/event.h
include/mupdf/pdf/field.h
include/mupdf/pdf/font.h
include/mupdf/pdf/graft.h
include/mupdf/pdf/interpret.h
include/mupdf/pdf/javascript.h
include/mupdf/pdf/name-table.h

include/mupdf/pdf/resource.h
include/mupdf/pdf/widget.h
include/mupdf/pdf/xref.h
include/mupdf/svg.h
lib/libmupdf.a
lib/libmupdfthird.a
lib/libmupdfthird_pic.a

%%PORTDOCS%%%%DOCSDIR%%/progressive.txt
%%PORTDOCS%%%%DOCSDIR%%/refcount.txt
%%PORTDOCS%%%%DOCSDIR%%/thirdparty.txt
%%PORTDOCS%%%%DOCSDIR%%/types.txt

Return to bug 216061

Lines 1-7 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/files/patch-source__fitz__load-jpx.c (-14 / +6 lines)
1	--- source/fitz/load-jpx.c.orig 2016-04-21 11:14:32 UTC	1	--- source/fitz/load-jpx.c.orig 2016-11-28 13:34:04 UTC
2	+++ source/fitz/load-jpx.c	2	+++ source/fitz/load-jpx.c
3	@@ -1,14 +1,6 @@	3	@@ -481,15 +481,7 @@ fz_load_jpx_info(fz_context *ctx, unsign
4	#include "mupdf/fitz.h"	4
		5	#else /* HAVE_LURATECH */
5		6
6	-/* Without the definition of OPJ_STATIC, compilation fails on windows	7	-/* Without the definition of OPJ_STATIC, compilation fails on windows
7	- * due to the use of __stdcall. We believe it is required on some	8	- * due to the use of __stdcall. We believe it is required on some
Lines 14-27 Link Here
14	-#include <openjpeg.h>	15	-#include <openjpeg.h>
15	+#include <openjpeg-2.1/openjpeg.h>	16	+#include <openjpeg-2.1/openjpeg.h>
16		17
17	static void fz_opj_error_callback(const char msg, void client_data)	18	/* OpenJPEG does not provide a safe mechanism to intercept
18	{	19	* allocations. In the latest version all allocations go
19	@@ -117,7 +109,7 @@ fz_load_jpx(fz_context *ctx, unsigned ch
20	opj_stream_set_read_function(stream, fz_opj_stream_read);
21	opj_stream_set_skip_function(stream, fz_opj_stream_skip);
22	opj_stream_set_seek_function(stream, fz_opj_stream_seek);
23	- opj_stream_set_user_data(stream, &sb);
24	+ opj_stream_set_user_data(stream, &sb,NULL);
25	/* Set the length to avoid an assert */
26	opj_stream_set_user_data_length(stream, size);
27

Lines 1-17 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/files/patch-source_pdf_pdf-shade.c (-17 lines)
1	$OpenBSD: patch-source_pdf_pdf-shade_c,v 1.1 2016/08/27 20:58:48 jca Exp $
2
3	CVE-2016-6525
4
5	http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e;hp=fa1936405b6a84e5c9bb440912c23d532772f958
6
7	--- source/pdf/pdf-shade.c.orig 2016-04-21 11:14:32 UTC
8	+++ source/pdf/pdf-shade.c
9	@@ -206,7 +206,7 @@ pdf_load_mesh_params(fz_context *ctx, pd
10	obj = pdf_dict_get(ctx, dict, PDF_NAME_Decode);
11	if (pdf_array_len(ctx, obj) >= 6)
12	{
13	- n = (pdf_array_len(ctx, obj) - 4) / 2;
14	+ n = fz_mini(FZ_MAX_COLORS, (pdf_array_len(ctx, obj) - 4) / 2);
15	shade->u.m.x0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 0));
16	shade->u.m.x1 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 1));
17	shade->u.m.y0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 2));

Lines 1-25 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/files/patch-source_pdf_pdf-xref.c (-25 lines)
1	$OpenBSD: patch-source_pdf_pdf-xref_c,v 1.1 2016/08/27 20:58:48 jca Exp $
2
3	CVE-2016-6265
4
5	http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa1936405b6a84e5c9bb440912c23d532772f958
6
7	--- source/pdf/pdf-xref.c.orig 2016-04-21 11:14:32 UTC
8	+++ source/pdf/pdf-xref.c
9	@@ -1191,8 +1191,14 @@ pdf_load_xref(fz_context *ctx, pdf_docum
10	fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", (int)entry->ofs, i);
11	}
12	if (entry->type == 'o')
13	- if (entry->ofs <= 0 \|\| entry->ofs >= xref_len \|\| pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
14	- fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i);
15	+ {
16	+ /* Read this into a local variable here, because pdf_get_xref_entry
17	+ * may solidify the xref, hence invalidating "entry", meaning we
18	+ * need a stashed value for the throw. */
19	+ fz_off_t ofs = entry->ofs;
20	+ if (ofs <= 0 \|\| ofs >= xref_len \|\| pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
21	+ fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
22	+ }
23	}
24	}
25

Lines 2-15 Link Here

(-)/usr/local/poudriere/ports/default/graphics/mupdf/pkg-plist (-3 / +7 lines)
2	bin/mupdf	2	bin/mupdf
3	bin/mupdf-gl	3	bin/mupdf-gl
4	bin/mupdf-x11-curl	4	bin/mupdf-x11-curl
		5	bin/muraster
5	bin/mutool	6	bin/mutool
6	include/mupdf/fitz.h	7	include/mupdf/fitz.h
7	include/mupdf/fitz/annotation.h	8	include/mupdf/fitz/annotation.h
		9	include/mupdf/fitz/archive.h
8	include/mupdf/fitz/bidi.h	10	include/mupdf/fitz/bidi.h
9	include/mupdf/fitz/bitmap.h	11	include/mupdf/fitz/bitmap.h
10	include/mupdf/fitz/buffer.h	12	include/mupdf/fitz/buffer.h
11	include/mupdf/fitz/colorspace.h	13	include/mupdf/fitz/colorspace.h
12	include/mupdf/fitz/compressed-buffer.h	14	include/mupdf/fitz/compressed-buffer.h
		15	include/mupdf/fitz/config.h
13	include/mupdf/fitz/context.h	16	include/mupdf/fitz/context.h
14	include/mupdf/fitz/crypt.h	17	include/mupdf/fitz/crypt.h
15	include/mupdf/fitz/device.h	18	include/mupdf/fitz/device.h
Lines 45-56 Link Here
45	include/mupdf/fitz/structured-text.h	48	include/mupdf/fitz/structured-text.h
46	include/mupdf/fitz/system.h	49	include/mupdf/fitz/system.h
47	include/mupdf/fitz/text.h	50	include/mupdf/fitz/text.h
		51	include/mupdf/fitz/track-usage.h
48	include/mupdf/fitz/transition.h	52	include/mupdf/fitz/transition.h
49	include/mupdf/fitz/tree.h	53	include/mupdf/fitz/tree.h
50	include/mupdf/fitz/ucdn.h	54	include/mupdf/fitz/ucdn.h
51	include/mupdf/fitz/unzip.h
52	include/mupdf/fitz/util.h	55	include/mupdf/fitz/util.h
53	include/mupdf/fitz/version.h	56	include/mupdf/fitz/version.h
		57	include/mupdf/fitz/writer.h
54	include/mupdf/fitz/xml.h	58	include/mupdf/fitz/xml.h
55	include/mupdf/html.h	59	include/mupdf/html.h
56	include/mupdf/memento.h	60	include/mupdf/memento.h
Lines 65-71 Link Here
65	include/mupdf/pdf/event.h	69	include/mupdf/pdf/event.h
66	include/mupdf/pdf/field.h	70	include/mupdf/pdf/field.h
67	include/mupdf/pdf/font.h	71	include/mupdf/pdf/font.h
68	include/mupdf/pdf/graft.h
69	include/mupdf/pdf/interpret.h	72	include/mupdf/pdf/interpret.h
70	include/mupdf/pdf/javascript.h	73	include/mupdf/pdf/javascript.h
71	include/mupdf/pdf/name-table.h	74	include/mupdf/pdf/name-table.h
Lines 76-82 Link Here
76	include/mupdf/pdf/resource.h	79	include/mupdf/pdf/resource.h
77	include/mupdf/pdf/widget.h	80	include/mupdf/pdf/widget.h
78	include/mupdf/pdf/xref.h	81	include/mupdf/pdf/xref.h
79	include/mupdf/xps.h	82	include/mupdf/svg.h
80	lib/libmupdf.a	83	lib/libmupdf.a
81	lib/libmupdfthird.a	84	lib/libmupdfthird.a
82	lib/libmupdfthird_pic.a	85	lib/libmupdfthird_pic.a
Lines 91-93 Link Here
91	%%PORTDOCS%%%%DOCSDIR%%/progressive.txt	94	%%PORTDOCS%%%%DOCSDIR%%/progressive.txt
92	%%PORTDOCS%%%%DOCSDIR%%/refcount.txt	95	%%PORTDOCS%%%%DOCSDIR%%/refcount.txt
93	%%PORTDOCS%%%%DOCSDIR%%/thirdparty.txt	96	%%PORTDOCS%%%%DOCSDIR%%/thirdparty.txt
		97	%%PORTDOCS%%%%DOCSDIR%%/types.txt