Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=5dc6aac40ed346943b11ef16ad6167e2ca19a955
commit 5dc6aac40ed346943b11ef16ad6167e2ca19a955 Author: kikadf <[email protected]> Date: Thu Mar 13 09:45:00 2014 +0100 cups-filters-1.0.38-2-x86_64 * Fix CVE-2013-6474, CVE-2013-6475, CVE-2013-6476 diff --git a/source/xapps/cups-filters/CVE-2013-647x-current.patch b/source/xapps/cups-filters/CVE-2013-647x-current.patch new file mode 100644 index 0000000..dca5241 --- /dev/null +++ b/source/xapps/cups-filters/CVE-2013-647x-current.patch @@ -0,0 +1,253 @@ +Description: fix multiple code execution issues +Origin: backported from 1.0.47 release + +diff -Naurp cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPSplash.cxx cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPSplash.cxx +--- cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPSplash.cxx 2013-12-10 16:20:15.000000000 -0500 ++++ cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPSplash.cxx 2014-03-10 07:19:19.000000000 -0400 +@@ -1094,7 +1094,7 @@ void OPVPSplash::fillGlyph(SplashCoord x + + opvpbytes = (m+3)/4; + opvpbytes *= 4; +- bp = (Guchar *)gmalloc(opvpbytes*glyph->h); ++ bp = (Guchar *)gmallocn(glyph->h,opvpbytes); + for (i = 0;i < glyph->h;i++) { + memcpy(bp+i*opvpbytes,glyph->data+i*m,m); + } +@@ -1238,8 +1238,8 @@ SplashError OPVPSplash::fillImageMaskFas + /* align 4 */ + opvpbytes = (opvpbytes+3)/4; + opvpbytes *= 4; +- buf = (Guchar *)gmalloc(opvpbytes*h); +- lineBuf = (SplashColorPtr)gmalloc(opvpbytes*8); ++ buf = (Guchar *)gmallocn(h,opvpbytes); ++ lineBuf = (SplashColorPtr)gmallocn(8,opvpbytes); + + for (i = 0;i < h;i++) { + int k; +@@ -1417,7 +1417,7 @@ SplashError OPVPSplash::fillImageMask(Sp + imat[3] = mat[0]/det; + + /* read source image */ +- pixBuf = (SplashColorPtr)gmalloc(h * w); ++ pixBuf = (SplashColorPtr)gmallocn(h , w); + + p = pixBuf; + for (i = 0; i < h; ++i) { +@@ -1571,8 +1571,8 @@ SplashError OPVPSplash::drawImageNotShea + hs = h-1; + he = -1; + } +- buf = (Guchar *)gmalloc(opvpbytes*h); +- lineBuf = (SplashColorPtr)gmalloc(lineBufSize); ++ buf = (Guchar *)gmallocn(h,opvpbytes); ++ lineBuf = (SplashColorPtr)gmallocn(lineBufSize,1); + switch (colorMode) { + case splashModeMono1: + case splashModeMono8: +@@ -1734,7 +1734,7 @@ SplashError OPVPSplash::drawImageFastWit + return splashErrOPVP; + break; + } +- buf = (Guchar *)gmalloc(opvpbytes*h); ++ buf = (Guchar *)gmallocn(h,opvpbytes); + + switch (colorMode) { + case splashModeMono1: +@@ -1960,7 +1960,7 @@ SplashError OPVPSplash::drawImage(Splash + } + + /* read source image */ +- pixBuf = (SplashColorPtr)gmalloc(h * linesize); ++ pixBuf = (SplashColorPtr)gmallocn(h , linesize); + + p = pixBuf; + for (i = 0; i < h; ++i) { +@@ -1968,8 +1968,8 @@ SplashError OPVPSplash::drawImage(Splash + p += linesize; + } + /* allocate line buffer */ +- Guchar *lineBuf = (Guchar *)gmalloc(opvpbytes); +- Guchar *onBuf = (Guchar *)gmalloc(width); ++ Guchar *lineBuf = (Guchar *)gmallocn(opvpbytes,1); ++ Guchar *onBuf = (Guchar *)gmallocn(width,1); + OPVPSplashClip *clip; + opvpctm.a = 1.0; + opvpctm.b = 0.0; +diff -Naurp cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPWrapper.cxx cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPWrapper.cxx +--- cups-filters-1.0.46/filter/pdftoopvp/oprs/OPVPWrapper.cxx 2013-12-10 16:20:15.000000000 -0500 ++++ cups-filters-1.0.47/filter/pdftoopvp/oprs/OPVPWrapper.cxx 2014-03-10 07:19:19.000000000 -0400 +@@ -822,6 +822,12 @@ OPVPWrapper *OPVPWrapper::loadDriver(con + void *handle = 0; + OPVPWrapper *opvp = 0; + ++ // remove directory part ++ const char *s = strrchr(driverName,'/'); ++ if (s != NULL) { ++ driverName = s+1; ++ } ++ + list = genDynamicLibName(driverName); + + if (list) { +diff -Naurp cups-filters-1.0.46/filter/pdftoopvp/OPVPOutputDev.cxx cups-filters-1.0.47/filter/pdftoopvp/OPVPOutputDev.cxx +--- cups-filters-1.0.46/filter/pdftoopvp/OPVPOutputDev.cxx 2013-12-10 16:20:15.000000000 -0500 ++++ cups-filters-1.0.47/filter/pdftoopvp/OPVPOutputDev.cxx 2014-03-10 07:19:19.000000000 -0400 +@@ -147,8 +147,8 @@ T3FontCache::T3FontCache(Ref *fontIDA, d + } else { + cacheSets = 1; + } +- cacheData = (Guchar *)gmalloc(cacheSets * cacheAssoc * glyphSize); +- cacheTags = (T3FontCacheTag *)gmalloc(cacheSets * cacheAssoc * ++ cacheData = (Guchar *)gmallocn3(cacheSets , cacheAssoc , glyphSize); ++ cacheTags = (T3FontCacheTag *)gmallocn3(cacheSets , cacheAssoc , + sizeof(T3FontCacheTag)); + for (i = 0; i < cacheSets * cacheAssoc; ++i) { + cacheTags[i].mru = i & (cacheAssoc - 1); +@@ -1416,7 +1416,7 @@ void OPVPOutputDev::drawImage(GfxState * + switch (colorMode) { + case splashModeMono1: + case splashModeMono8: +- imgData.lookup = (SplashColorPtr)gmalloc(n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,1); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getGray(&pix, &gray); +@@ -1424,7 +1424,7 @@ void OPVPOutputDev::drawImage(GfxState * + } + break; + case splashModeRGB8: +- imgData.lookup = (SplashColorPtr)gmalloc(3 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,3); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); +@@ -1434,7 +1434,7 @@ void OPVPOutputDev::drawImage(GfxState * + } + break; + case splashModeBGR8: +- imgData.lookup = (SplashColorPtr)gmalloc(3 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,3); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); +@@ -1445,7 +1445,7 @@ void OPVPOutputDev::drawImage(GfxState * + break; + #if SPLASH_CMYK + case splashModeCMYK8: +- imgData.lookup = (SplashColorPtr)gmalloc(4 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,4); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getCMYK(&pix, &cmyk); +@@ -1672,7 +1672,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS + switch (colorMode) { + case splashModeMono1: + case splashModeMono8: +- imgData.lookup = (SplashColorPtr)gmalloc(n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,1); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getGray(&pix, &gray); +@@ -1680,7 +1680,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS + } + break; + case splashModeRGB8: +- imgData.lookup = (SplashColorPtr)gmalloc(3 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,3); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); +@@ -1690,7 +1690,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS + } + break; + case splashModeBGR8: +- imgData.lookup = (SplashColorPtr)gmalloc(3 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,3); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); +@@ -1701,7 +1701,7 @@ void OPVPOutputDev::drawMaskedImage(GfxS + break; + #if SPLASH_CMYK + case splashModeCMYK8: +- imgData.lookup = (SplashColorPtr)gmalloc(4 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,4); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getCMYK(&pix, &cmyk); +@@ -1793,7 +1793,7 @@ void OPVPOutputDev::drawSoftMaskedImage( + imgMaskData.height = maskHeight; + imgMaskData.y = 0; + n = 1 << maskColorMap->getBits(); +- imgMaskData.lookup = (SplashColorPtr)gmalloc(n); ++ imgMaskData.lookup = (SplashColorPtr)gmallocn(n,1); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + maskColorMap->getGray(&pix, &gray); +@@ -1839,7 +1839,7 @@ void OPVPOutputDev::drawSoftMaskedImage( + switch (colorMode) { + case splashModeMono1: + case splashModeMono8: +- imgData.lookup = (SplashColorPtr)gmalloc(n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,1); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getGray(&pix, &gray); +@@ -1847,7 +1847,7 @@ void OPVPOutputDev::drawSoftMaskedImage( + } + break; + case splashModeRGB8: +- imgData.lookup = (SplashColorPtr)gmalloc(3 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,3); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); +@@ -1857,7 +1857,7 @@ void OPVPOutputDev::drawSoftMaskedImage( + } + break; + case splashModeBGR8: +- imgData.lookup = (SplashColorPtr)gmalloc(3 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,3); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); +@@ -1868,7 +1868,7 @@ void OPVPOutputDev::drawSoftMaskedImage( + break; + #if SPLASH_CMYK + case splashModeCMYK8: +- imgData.lookup = (SplashColorPtr)gmalloc(4 * n); ++ imgData.lookup = (SplashColorPtr)gmallocn(n,4); + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getCMYK(&pix, &cmyk); +diff -Naurp cups-filters-1.0.46/filter/urftopdf.cpp cups-filters-1.0.47/filter/urftopdf.cpp +--- cups-filters-1.0.46/filter/urftopdf.cpp 2013-12-10 16:20:15.000000000 -0500 ++++ cups-filters-1.0.47/filter/urftopdf.cpp 2014-03-10 07:15:01.000000000 -0400 +@@ -26,6 +26,7 @@ + #include <unistd.h> + #include <stdlib.h> + #include <string.h> ++#include <limits> + + #include <arpa/inet.h> // ntohl + +@@ -194,6 +195,9 @@ int add_pdf_page(struct pdf_info * info, + info->line_bytes = (width*info->pixel_bytes); + info->bpp = bpp; + ++ if (info->height > (std::numeric_limits<unsigned>::max() / info->line_bytes)) { ++ die("Page too big"); ++ } + info->page_data = PointerHolder<Buffer>(new Buffer(info->line_bytes*info->height)); + + QPDFObjectHandle page = QPDFObjectHandle::parse( +@@ -283,6 +287,9 @@ int decode_raster(int fd, unsigned width + std::vector<uint8_t> pixel_container; + std::vector<uint8_t> line_container; + ++ if (width > (std::numeric_limits<unsigned>::max() / pixel_size)) { ++ die("Line too big"); ++ } + try { + pixel_container.resize(pixel_size); + line_container.resize(pixel_size*width); diff --git a/source/xapps/cups-filters/FrugalBuild b/source/xapps/cups-filters/FrugalBuild index 06b28a6..e7d8993 100644 --- a/source/xapps/cups-filters/FrugalBuild +++ b/source/xapps/cups-filters/FrugalBuild @@ -1,9 +1,11 @@ # Compiling time: 0.01 SBU # Maintainer: bouleetbil <[email protected]> +options+=('asneeded') + pkgname=cups-filters pkgver=1.0.38 -pkgrel=1 +pkgrel=2 pkgdesc="Backends, filters and other software from CUPS distribution." url="http://www.linuxfoundation.org/collaborate/workgroups/openprinting/group"; depends=('cups' 'ijs' 'qpdf' 'lcms2') @@ -17,5 +19,11 @@ sha1sums=('421704eb851c9fb0d7bd5ba6c0390af92a67ff6c') Fconfopts+=" --with-gs-path=/usr/bin/gs \ --with-pdftops-path=/usr/bin/gs" +# FSA fix *** +source=(${source[@]} CVE-2013-647x-current.patch) +sha1sums=(${sha1sums[@]} '303ed232056f20acd197932426a4d1b9163b90ef') +# *********** + + # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
