diff options
author | Darrell Anderson <humanreadable@yahoo.com> | 2012-08-22 13:05:27 -0500 |
---|---|---|
committer | Darrell Anderson <humanreadable@yahoo.com> | 2012-08-22 13:05:27 -0500 |
commit | 561d1d6802dd50ddc9f441442cc2c351dd2759d6 (patch) | |
tree | 16397d32c394eda320ac37ec273701b2bd323591 /kpdf/xpdf/xpdf | |
parent | debc30baa40bdc687b00414733a50c61f71572de (diff) | |
download | tdegraphics-561d1d6802dd50ddc9f441442cc2c351dd2759d6.tar.gz tdegraphics-561d1d6802dd50ddc9f441442cc2c351dd2759d6.zip |
Fix a potential resize bug and apply xpdf 3.02pl4 and 3.02pl5 security patches.
This partially resolves bug report 1175.
Diffstat (limited to 'kpdf/xpdf/xpdf')
-rw-r--r-- | kpdf/xpdf/xpdf/Gfx.cc | 2 | ||||
-rw-r--r-- | kpdf/xpdf/xpdf/PSOutputDev.cc | 2 | ||||
-rw-r--r-- | kpdf/xpdf/xpdf/Stream.cc | 4 | ||||
-rw-r--r-- | kpdf/xpdf/xpdf/XRef.cc | 18 |
4 files changed, 24 insertions, 2 deletions
diff --git a/kpdf/xpdf/xpdf/Gfx.cc b/kpdf/xpdf/xpdf/Gfx.cc index b37dcb54..e3df8384 100644 --- a/kpdf/xpdf/xpdf/Gfx.cc +++ b/kpdf/xpdf/xpdf/Gfx.cc @@ -461,6 +461,7 @@ Gfx::Gfx(XRef *xrefA, OutputDev *outA, int pageNum, Dict *resDict, baseMatrix[i] = state->getCTM()[i]; } formDepth = 0; + parser = NULL; abortCheckCbk = abortCheckCbkA; abortCheckCbkData = abortCheckCbkDataA; @@ -500,6 +501,7 @@ Gfx::Gfx(XRef *xrefA, OutputDev *outA, Dict *resDict, baseMatrix[i] = state->getCTM()[i]; } formDepth = 0; + parser = NULL; abortCheckCbk = abortCheckCbkA; abortCheckCbkData = abortCheckCbkDataA; diff --git a/kpdf/xpdf/xpdf/PSOutputDev.cc b/kpdf/xpdf/xpdf/PSOutputDev.cc index d35739a5..4fb2cbfd 100644 --- a/kpdf/xpdf/xpdf/PSOutputDev.cc +++ b/kpdf/xpdf/xpdf/PSOutputDev.cc @@ -4386,7 +4386,7 @@ void PSOutputDev::doImageL1Sep(GfxImageColorMap *colorMap, width, -height, height); // allocate a line buffer - lineBuf = (Guchar *)gmalloc(4 * width); + lineBuf = (Guchar *)gmallocn(width, 4); // set up to process the data stream imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(), diff --git a/kpdf/xpdf/xpdf/Stream.cc b/kpdf/xpdf/xpdf/Stream.cc index 20219522..2c1db5b4 100644 --- a/kpdf/xpdf/xpdf/Stream.cc +++ b/kpdf/xpdf/xpdf/Stream.cc @@ -323,6 +323,10 @@ ImageStream::ImageStream(Stream *strA, int widthA, int nCompsA, int nBitsA) { } else { imgLineSize = nVals; } + if (width > INT_MAX / nComps) { + // force a call to gmallocn(-1,...), which will throw an exception + imgLineSize = -1; + } imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar)); imgIdx = nVals; } diff --git a/kpdf/xpdf/xpdf/XRef.cc b/kpdf/xpdf/xpdf/XRef.cc index d12d812f..2e0d1cef 100644 --- a/kpdf/xpdf/xpdf/XRef.cc +++ b/kpdf/xpdf/xpdf/XRef.cc @@ -52,6 +52,8 @@ public: // generation 0. ObjectStream(XRef *xref, int objStrNumA); + GBool isOk() { return ok; } + ~ObjectStream(); // Return the object number of this object stream. @@ -67,6 +69,7 @@ private: int nObjects; // number of objects in the stream Object *objs; // the objects (length = nObjects) int *objNums; // the object numbers (length = nObjects) + GBool ok; }; ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { @@ -80,6 +83,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { nObjects = 0; objs = NULL; objNums = NULL; + ok = gFalse; if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) { goto err1; @@ -105,6 +109,13 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { goto err1; } + // this is an arbitrary limit to avoid integer overflow problems + // in the 'new Object[nObjects]' call (Acrobat apparently limits + // object streams to 100-200 objects) + if (nObjects > 1000000) { + error(-1, "Too many objects in an object stream"); + goto err1; + } objs = new Object[nObjects]; objNums = (int *)gmallocn(nObjects, sizeof(int)); offsets = (int *)gmallocn(nObjects, sizeof(int)); @@ -161,10 +172,10 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { } gfree(offsets); + ok = gTrue; err1: objStr.free(); - return; } ObjectStream::~ObjectStream() { @@ -837,6 +848,11 @@ Object *XRef::fetch(int num, int gen, Object *obj) { delete objStr; } objStr = new ObjectStream(this, e->offset); + if (!objStr->isOk()) { + delete objStr; + objStr = NULL; + goto err; + } } objStr->getObject(e->gen, num, obj); break; |