diff options
author | Arkadiusz Miśkiewicz | 2017-01-24 07:10:04 (GMT) |
---|---|---|
committer | Arkadiusz Miśkiewicz | 2017-01-24 07:10:04 (GMT) |
commit | 9a546392dc64c6ba944654367b515ede27abf26c (patch) | |
tree | a66b476369492386c17d5aebebcc972618c1954e | |
parent | 8e5936b51679dbfd811cf3cad7209ec630b350bd (diff) | |
download | t1lib-9a546392dc64c6ba944654367b515ede27abf26c.zip t1lib-9a546392dc64c6ba944654367b515ede27abf26c.tar.gz |
- rel 10; bunch of CVE fixes from gentooauto/th/t1lib-5.1.2-10
-rw-r--r-- | t1lib-5.1.2-CVE-2010-2642.patch | 13 | ||||
-rw-r--r-- | t1lib-5.1.2-CVE-2010-2642_2011-0433_2011-5244.patch | 46 | ||||
-rw-r--r-- | t1lib-5.1.2-CVE-2011-0764.patch | 31 | ||||
-rw-r--r-- | t1lib-5.1.2-CVE-2011-1552_1553_1554.patch | 133 | ||||
-rw-r--r-- | t1lib.spec | 10 |
5 files changed, 217 insertions, 16 deletions
diff --git a/t1lib-5.1.2-CVE-2010-2642.patch b/t1lib-5.1.2-CVE-2010-2642.patch deleted file mode 100644 index 933666c..0000000 --- a/t1lib-5.1.2-CVE-2010-2642.patch +++ /dev/null @@ -1,13 +0,0 @@ -Index: t1lib-5.1.2/lib/t1lib/parseAFM.c -=================================================================== ---- t1lib-5.1.2.orig/lib/t1lib/parseAFM.c 2007-12-23 16:49:42.000000000 +0100 -+++ t1lib-5.1.2/lib/t1lib/parseAFM.c 2011-01-07 10:52:38.953106681 +0100 -@@ -199,7 +199,7 @@ - idx = 0; - - while (ch != EOF && ch != ' ' && ch != CR && ch != LF && -- ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){ -+ ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';' && idx < MAX_NAME){ - ident[idx++] = ch; - ch = fgetc(stream); - } /* while */ diff --git a/t1lib-5.1.2-CVE-2010-2642_2011-0433_2011-5244.patch b/t1lib-5.1.2-CVE-2010-2642_2011-0433_2011-5244.patch new file mode 100644 index 0000000..9d3168c --- /dev/null +++ b/t1lib-5.1.2-CVE-2010-2642_2011-0433_2011-5244.patch @@ -0,0 +1,46 @@ +CVE-2010-2642, CVE-2011-0433 and CVE-2011-5244 + +CVE-2010-2642: +============== +Upstream-Bug: https://bugzilla.gnome.org/show_bug.cgi?id=643882 +Upstream-Fix: https://git.gnome.org/browse/evince/commit/?id=efadec4ffcdde3373f6f4ca0eaac98dc963c4fd5 + + +CVE-2011-0433: +============== +Upstream-Bug: https://bugzilla.gnome.org/show_bug.cgi?id=640923 +Upstream-Fix: https://git.gnome.org/browse/evince/commit/?id=439c5070022eab6cef7266aab47f978058012c72 + + +CVE-2011-5244: +============== +Upstream-Bug: https://bugzilla.gnome.org/show_bug.cgi?id=643882 +Upstream-Fix: https://git.gnome.org/browse/evince/commit/?id=efadec4ffcdde3373f6f4ca0eaac98dc963c4fd5 + + +Origin: https://bugs.debian.org/652996 + +diff --git a/lib/t1lib/parseAFM.c b/lib/t1lib/parseAFM.c +index 6a31d7f..ba64541 100644 +--- a/lib/t1lib/parseAFM.c ++++ b/lib/t1lib/parseAFM.c +@@ -199,7 +199,9 @@ static char *token(stream) + idx = 0; + + while (ch != EOF && ch != ' ' && ch != CR && ch != LF && +- ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';'){ ++ ch != CTRL_Z && ch != '\t' && ch != ':' && ch != ';' ++ && idx < (MAX_NAME -1)) ++ { + ident[idx++] = ch; + ch = fgetc(stream); + } /* while */ +@@ -235,7 +237,7 @@ static char *linetoken(stream) + while ((ch = fgetc(stream)) == ' ' || ch == '\t' ); + + idx = 0; +- while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z) ++ while (ch != EOF && ch != CR && ch != LF && ch != CTRL_Z && idx < (MAX_NAME - 1)) + { + ident[idx++] = ch; + ch = fgetc(stream); diff --git a/t1lib-5.1.2-CVE-2011-0764.patch b/t1lib-5.1.2-CVE-2011-0764.patch new file mode 100644 index 0000000..73f94ce --- /dev/null +++ b/t1lib-5.1.2-CVE-2011-0764.patch @@ -0,0 +1,31 @@ +CVE-2011-0764 + +Author: Marc Deslauriers <marc.deslauriers@canonical.com> +Origin: https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/wily/t1lib/wily/view/head:/debian/patches/CVE-2011-0764.diff + +--- t1lib-5.1.2.orig/lib/type1/type1.c 2011-12-13 14:24:14.280965637 -0600 ++++ t1lib-5.1.2/lib/type1/type1.c 2011-12-13 14:25:25.893320747 -0600 +@@ -1700,6 +1700,7 @@ + long pindex = 0; + + /* compute hinting for previous segment! */ ++ if (ppoints == NULL) Error0i("RLineTo: No previous point!\n"); + FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx, dy); + + /* Allocate a new path point and pre-setup data */ +@@ -1728,6 +1729,7 @@ + long pindex = 0; + + /* compute hinting for previous point! */ ++ if (ppoints == NULL) Error0i("RRCurveTo: No previous point!\n"); + FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx1, dy1); + + /* Allocate three new path points and pre-setup data */ +@@ -1903,6 +1905,7 @@ + FindStems( currx, curry, 0, 0, dx, dy); + } + else { ++ if (ppoints == NULL) Error0i("RMoveTo: No previous point!\n"); + FindStems( currx, curry, ppoints[numppoints-2].x, ppoints[numppoints-2].y, dx, dy); + } + diff --git a/t1lib-5.1.2-CVE-2011-1552_1553_1554.patch b/t1lib-5.1.2-CVE-2011-1552_1553_1554.patch new file mode 100644 index 0000000..192c91f --- /dev/null +++ b/t1lib-5.1.2-CVE-2011-1552_1553_1554.patch @@ -0,0 +1,133 @@ +CVE-2011-1552, CVE-2011-1553 and CVE-2011-1554 + +Author: Jaroslav Škarvada <jskarvad@redhat.com> +Origin: http://bugzilla.redhat.com/show_bug.cgi?id=692909 + +--- t1lib-5.1.2.orig/lib/type1/lines.c 2007-12-23 09:49:42.000000000 -0600 ++++ t1lib-5.1.2/lib/type1/lines.c 2012-01-17 14:15:08.000000000 -0600 +@@ -67,6 +67,10 @@ + None. + */ + ++#define BITS (sizeof(LONG)*8) ++#define HIGHTEST(p) (((p)>>(BITS-2)) != 0) /* includes sign bit */ ++#define TOOBIG(xy) ((xy < 0) ? HIGHTEST(-xy) : HIGHTEST(xy)) ++ + /* + :h2.StepLine() - Produces Run Ends for a Line After Checks + +@@ -84,6 +88,9 @@ + IfTrace4((LineDebug > 0), ".....StepLine: (%d,%d) to (%d,%d)\n", + x1, y1, x2, y2); + ++ if ( TOOBIG(x1) || TOOBIG(x2) || TOOBIG(y1) || TOOBIG(y2)) ++ abort("Lines this big not supported", 49); ++ + dy = y2 - y1; + + /* +Index: t1lib-5.1.2/lib/type1/objects.c +=================================================================== +--- t1lib-5.1.2.orig/lib/type1/objects.c 2007-12-23 09:49:42.000000000 -0600 ++++ t1lib-5.1.2/lib/type1/objects.c 2012-01-17 14:15:08.000000000 -0600 +@@ -1137,12 +1137,13 @@ + "Context: out of them", /* 46 */ + "MatrixInvert: can't", /* 47 */ + "xiStub called", /* 48 */ +- "Illegal access type1 abort() message" /* 49 */ ++ "Lines this big not supported", /* 49 */ ++ "Illegal access type1 abort() message" /* 50 */ + }; + +- /* no is valid from 1 to 48 */ +- if ( (number<1)||(number>48)) +- number=49; ++ /* no is valid from 1 to 49 */ ++ if ( (number<1)||(number>49)) ++ number=50; + return( err_msgs[number-1]); + + } +Index: t1lib-5.1.2/lib/type1/type1.c +=================================================================== +--- t1lib-5.1.2.orig/lib/type1/type1.c 2012-01-17 14:13:28.000000000 -0600 ++++ t1lib-5.1.2/lib/type1/type1.c 2012-01-17 14:19:54.000000000 -0600 +@@ -1012,6 +1012,7 @@ + double nextdtana = 0.0; /* tangent of post-delta against horizontal line */ + double nextdtanb = 0.0; /* tangent of post-delta against vertical line */ + ++ if (ppoints == NULL || numppoints < 1) Error0v("FindStems: No previous point!\n"); + + /* setup default hinted position */ + ppoints[numppoints-1].ax = ppoints[numppoints-1].x; +@@ -1289,7 +1290,7 @@ + static int DoRead(CodeP) + int *CodeP; + { +- if (strindex >= CharStringP->len) return(FALSE); /* end of string */ ++ if (!CharStringP || strindex >= CharStringP->len) return(FALSE); /* end of string */ + /* We handle the non-documented Adobe convention to use lenIV=-1 to + suppress charstring encryption. */ + if (blues->lenIV==-1) { +@@ -1700,7 +1701,7 @@ + long pindex = 0; + + /* compute hinting for previous segment! */ +- if (ppoints == NULL) Error0i("RLineTo: No previous point!\n"); ++ if (ppoints == NULL || numppoints < 2) Error0i("RLineTo: No previous point!\n"); + FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx, dy); + + /* Allocate a new path point and pre-setup data */ +@@ -1729,7 +1730,7 @@ + long pindex = 0; + + /* compute hinting for previous point! */ +- if (ppoints == NULL) Error0i("RRCurveTo: No previous point!\n"); ++ if (ppoints == NULL || numppoints < 2) Error0i("RRCurveTo: No previous point!\n"); + FindStems( currx, curry, currx-ppoints[numppoints-2].x, curry-ppoints[numppoints-2].y, dx1, dy1); + + /* Allocate three new path points and pre-setup data */ +@@ -1788,7 +1789,9 @@ + long tmpind; + double deltax = 0.0; + double deltay = 0.0; +- ++ ++ if (ppoints == NULL || numppoints < 1) Error0i("DoClosePath: No previous point!"); ++ + /* If this ClosePath command together with the starting point of this + path completes to a segment aligned to a stem, we would miss + hinting for this point. --> Check and explicitly care for this! */ +@@ -1803,6 +1806,7 @@ + deltax = ppoints[i].x - ppoints[numppoints-1].x; + deltay = ppoints[i].y - ppoints[numppoints-1].y; + ++ if (ppoints == NULL || numppoints <= i + 1) Error0i("DoClosePath: No previous point!"); + /* save nummppoints and reset to move point */ + tmpind = numppoints; + numppoints = i + 1; +@@ -1905,7 +1909,7 @@ + FindStems( currx, curry, 0, 0, dx, dy); + } + else { +- if (ppoints == NULL) Error0i("RMoveTo: No previous point!\n"); ++ if (ppoints == NULL || numppoints < 2) Error0i("RMoveTo: No previous point!\n"); + FindStems( currx, curry, ppoints[numppoints-2].x, ppoints[numppoints-2].y, dx, dy); + } + +@@ -2155,6 +2159,7 @@ + DOUBLE cx, cy; + DOUBLE ex, ey; + ++ if (ppoints == NULL || numppoints < 8) Error0v("FlxProc: No previous point!"); + + /* Our PPOINT list now contains 7 moveto commands which + are about to be consumed by the Flex mechanism. --> Remove these +@@ -2324,6 +2329,7 @@ + /* Returns currentpoint on stack */ + static void FlxProc2() + { ++ if (ppoints == NULL || numppoints < 1) Error0v("FlxProc2: No previous point!"); + /* Push CurrentPoint on fake PostScript stack */ + PSFakePush( ppoints[numppoints-1].x); + PSFakePush( ppoints[numppoints-1].y); @@ -9,7 +9,7 @@ Summary(ru.UTF-8): Растеризатор шрифтов Type 1 Summary(uk.UTF-8): Растеризатор шрифтів Type 1 Name: t1lib Version: 5.1.2 -Release: 9 +Release: 10 License: GPL v2 Group: Libraries Source0: ftp://sunsite.unc.edu/pub/Linux/libs/graphics/%{name}-%{version}.tar.gz @@ -25,8 +25,10 @@ Patch3: %{name}-man.patch Patch4: %{name}-xglyph.patch Patch5: %{name}-aclocal.patch Patch6: %{name}-link.patch -Patch7: %{name}-5.1.2-CVE-2010-2642.patch -Patch8: format-security.patch +Patch7: format-security.patch +Patch8: t1lib-5.1.2-CVE-2010-2642_2011-0433_2011-5244.patch +Patch9: t1lib-5.1.2-CVE-2011-0764.patch +Patch10: t1lib-5.1.2-CVE-2011-1552_1553_1554.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool @@ -271,6 +273,8 @@ Program testowy dla t1lib z interfejsem X11. %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p1 +%patch10 -p1 rm -f ac-tools/aclocal.m4 |