Mailinglist Archive: opensuse-commit (857 mails)

[root@xxxxxxxxxxxxxxx (h_root)]

Hello community,

here is the log from the commit of package xpdf
checked in at Tue Nov 13 21:37:37 CET 2007.

--------
--- xpdf/xpdf.changes   2007-08-07 11:18:26.000000000 +0200
+++ /mounts/work_src_done/STABLE/xpdf/xpdf.changes      2007-11-06 
21:38:23.000000000 +0100
@@ -1,0 +2,6 @@
+Tue Nov  6 21:33:25 CET 2007 - pcerny@xxxxxxx
+
+- fix for CVE-2007-4352,5392,5393 [#335637] 
+- correct fix for CVE-2007-3387 [#291690]
+
+-------------------------------------------------------------------

New:
----
  xpdf-3.02pl1-CVE-2007-3387.patch
  xpdf-3.02pl2-CVE-2007-4352,5392,5393.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ xpdf.spec ++++++
--- /var/tmp/diff_new_pack.O12230/_old  2007-11-13 21:37:11.000000000 +0100
+++ /var/tmp/diff_new_pack.O12230/_new  2007-11-13 21:37:11.000000000 +0100
@@ -12,11 +12,11 @@
 
 Name:           xpdf
 BuildRequires:  freetype2-devel gcc-c++ ghostscript-fonts-std openmotif-devel 
update-desktop-files xorg-x11
-License:        GPL v2 or later
+License:        GPL v2 only
 Group:          Productivity/Publishing/PDF
 Version:        3.02
-Release:        1
-Autoreqprov:    on
+Release:        34
+AutoReqProv:    on
 Requires:       ghostscript-fonts-std, xpdf-tools = %{version}
 Summary:        A PDF File Viewer for the X Window System
 Source:         xpdf-%{version}.tar.bz2
@@ -44,7 +44,6 @@
 Patch9:         xpdf-i18n.patch
 Patch10:        xpdf-settitle.patch
 Patch11:        xpdf-search-non-ascii.patch
-#Patch13:        xpdf-font-optimize.dif
 Patch14:        xpdf-fix-cut-and-paste-and-default-output-encoding.patch
 Patch15:        xpdf-fix-crash-in-japanese-locale.patch
 Patch17:        xpdf-postscript-lc-numeric.patch
@@ -53,7 +52,9 @@
 Patch24:        xpdf-disable-byte-code-interpreter.patch
 Patch25:        xpdf-cid-ttf-unicode-fix2.diff
 Patch26:        xpdf-gcc41.patch
-URL:            http://www.foolabs.com/xpdf/
+Patch27:        xpdf-3.02pl1-CVE-2007-3387.patch
+Patch28:        xpdf-3.02pl2-CVE-2007-4352,5392,5393.patch
+Url:            http://www.foolabs.com/xpdf/
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 %description
@@ -91,7 +92,6 @@
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
-#%patch13 -p1
 %patch14 -p1
 %patch15 -p1
 %patch17 -p1
@@ -100,13 +100,16 @@
 %patch24 -p1
 %patch25
 %patch26
+%patch27 -p1
+%patch28 -p1
 
 %build
 %{?suse_update_config:%{suse_update_config -f }}
 #autoreconf -f -i
-export CFLAGS="$RPM_OPT_FLAGS -fstack-protector -fno-strict-aliasing"
-export CXXFLAGS="$RPM_OPT_FLAGS -fstack-protector -fno-strict-aliasing"
-  ./configure --prefix=/usr \
+export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing"
+export CXXFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing"
+./configure \
+    --prefix=/usr \
             --sysconfdir=/etc \
             --mandir=%{_mandir} \
             --enable-a4 \
@@ -116,37 +119,37 @@
 make
 
 %install
-rm -rf $RPM_BUILD_ROOT
-make install DESTDIR=$RPM_BUILD_ROOT
-mkdir -p $RPM_BUILD_ROOT/usr/share/xpdf
+rm -rf %{buildroot}
+make install DESTDIR=%{buildroot}
+mkdir -p %{buildroot}/usr/share/xpdf
 for file in xpdf-*/add-to-xpdfrc ; do
   sed -e "s|/usr/local/share/xpdf|/usr/share/xpdf|" -e 
"s|^displayCIDFontX|#displayCIDFontX|" $file >$file.new
   mv -f $file.new $file
   dir=`dirname $file`
   lang=`echo $dir|sed -e "s|xpdf-||"`
-  cp -r $dir $RPM_BUILD_ROOT/usr/share/xpdf/$lang
-  echo >>$RPM_BUILD_ROOT/etc/xpdfrc
-  cat $file >>$RPM_BUILD_ROOT/etc/xpdfrc
+  cp -r $dir %{buildroot}/usr/share/xpdf/$lang
+  echo >>%{buildroot}/etc/xpdfrc
+  cat $file >>%{buildroot}/etc/xpdfrc
 done
-echo "# include font setup for CJK languages" >> $RPM_BUILD_ROOT/etc/xpdfrc
-echo "include /etc/xpdfrc-cjk-auto" >> $RPM_BUILD_ROOT/etc/xpdfrc
-echo "include /etc/xpdfrc-cjk" >> $RPM_BUILD_ROOT/etc/xpdfrc
-echo "include /etc/xpdfrc-cjk.sjis" >> $RPM_BUILD_ROOT/etc/xpdfrc
-touch $RPM_BUILD_ROOT/etc/xpdfrc-cjk-auto
-install -m 644 $RPM_SOURCE_DIR/xpdfrc-cjk $RPM_BUILD_ROOT/etc/xpdfrc-cjk
-install -m 644 $RPM_SOURCE_DIR/xpdfrc-cjk.sjis 
$RPM_BUILD_ROOT/etc/xpdfrc-cjk.sjis
-mkdir -p $RPM_BUILD_ROOT/usr/lib/fonts-config/conf.d/
-install -m 755 $RPM_SOURCE_DIR/50-xpdf 
$RPM_BUILD_ROOT/usr/lib/fonts-config/conf.d/
-mkdir -p $RPM_BUILD_ROOT/usr/sbin/
-install -m 755 $RPM_SOURCE_DIR/xpdf-cjk-config $RPM_BUILD_ROOT/usr/sbin/
-mkdir -p $RPM_BUILD_ROOT/usr/share/applications/
-install -m 644 %{S:24} $RPM_BUILD_ROOT/usr/share/applications/
-mkdir -p $RPM_BUILD_ROOT/usr/share/pixmaps/
-install -m 644 %{S:25} $RPM_BUILD_ROOT/usr/share/pixmaps/
+echo "# include font setup for CJK languages" >> %{buildroot}/etc/xpdfrc
+echo "include /etc/xpdfrc-cjk-auto" >> %{buildroot}/etc/xpdfrc
+echo "include /etc/xpdfrc-cjk" >> %{buildroot}/etc/xpdfrc
+echo "include /etc/xpdfrc-cjk.sjis" >> %{buildroot}/etc/xpdfrc
+touch %{buildroot}/etc/xpdfrc-cjk-auto
+install -m 644 $RPM_SOURCE_DIR/xpdfrc-cjk %{buildroot}/etc/xpdfrc-cjk
+install -m 644 $RPM_SOURCE_DIR/xpdfrc-cjk.sjis %{buildroot}/etc/xpdfrc-cjk.sjis
+mkdir -p %{buildroot}/usr/lib/fonts-config/conf.d/
+install -m 755 $RPM_SOURCE_DIR/50-xpdf 
%{buildroot}/usr/lib/fonts-config/conf.d/
+mkdir -p %{buildroot}/usr/sbin/
+install -m 755 $RPM_SOURCE_DIR/xpdf-cjk-config %{buildroot}/usr/sbin/
+mkdir -p %{buildroot}/usr/share/applications/
+install -m 644 %{S:24} %{buildroot}/usr/share/applications/
+mkdir -p %{buildroot}/usr/share/pixmaps/
+install -m 644 %{S:25} %{buildroot}/usr/share/pixmaps/
 %suse_update_desktop_file -i %name Office Viewer
 
 %clean
-rm -rf $RPM_BUILD_ROOT
+rm -rf %{buildroot}
 
 %files
 %defattr(-,root,root)
@@ -175,8 +178,10 @@
 %doc %{_mandir}/man5/*
 %doc %{_mandir}/man1/pdf*.1*
 /usr/share/xpdf
-
 %changelog
+* Tue Nov 06 2007 - pcerny@xxxxxxx
+- fix for CVE-2007-4352,5392,5393 [#335637]
+- correct fix for CVE-2007-3387 [#291690]
 * Mon Aug 06 2007 - ltinkl@xxxxxxx
 - update to 3.0.2
   * Added anti-aliasing for vector graphics; added the vectorAntialias


++++++ xpdf-3.02pl1-CVE-2007-3387.patch ++++++
# upstream patch for CVE-2007-3387
--- xpdf-3.02.orig/xpdf/Stream.cc       2007-02-27 23:05:52.000000000 +0100
+++ xpdf-3.02/xpdf/Stream.cc    2007-11-02 19:02:47.974397067 +0100
@@ -410,15 +410,13 @@
   ok = gFalse;
 
   nVals = width * nComps;
-  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
-      nComps >= INT_MAX / nBits ||
-      width >= INT_MAX / nComps / nBits ||
-      nVals * nBits + 7 < 0) {
-    return;
-  }
   pixBytes = (nComps * nBits + 7) >> 3;
   rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
-  if (rowBytes <= 0) {
+  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+      nComps > gfxColorMaxComps ||
+      nBits > 16 ||
+      width >= INT_MAX / nComps ||      // check for overflow in nVals 
+      nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
     return;
   }
   predLine = (Guchar *)gmalloc(rowBytes);
++++++ xpdf-3.02pl2-CVE-2007-4352,5392,5393.patch ++++++
++++ 652 lines (skipped)







++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Remember to have fun...

---------------------------------------------------------------------
To unsubscribe, e-mail: opensuse-commit+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-commit+help@xxxxxxxxxxxx