[lfs-patches] r3438 - trunk/mupdf

ken at higgs.linuxfromscratch.org ken at higgs.linuxfromscratch.org
Tue Aug 30 12:36:41 PDT 2016


Author: ken
Date: Tue Aug 30 12:36:41 2016
New Revision: 3438

Log:
Patch mupdf for use after free.

Added:
   trunk/mupdf/mupdf-1.9-upstream_fix-1.patch

Added: trunk/mupdf/mupdf-1.9-upstream_fix-1.patch
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ trunk/mupdf/mupdf-1.9-upstream_fix-1.patch	Tue Aug 30 12:36:41 2016	(r3438)
@@ -0,0 +1,28 @@
+Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
+Date: 2016-08-30
+Initial Package Version: 1.9 (possibly applies to 1.5 and 1.7 versions)
+Upstream Status: Applied
+Origin: Upstream
+Description: Fixes use after free, upstream bug 696941, CVE-2016-6265.
+
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 576c315..3222599 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1184,8 +1184,14 @@ pdf_load_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
+ 				fz_throw(ctx, FZ_ERROR_GENERIC, "object offset out of range: %d (%d 0 R)", (int)entry->ofs, i);
+ 		}
+ 		if (entry->type == 'o')
+-			if (entry->ofs <= 0 || entry->ofs >= xref_len || pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
+-				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i);
++		{
++			/* Read this into a local variable here, because pdf_get_xref_entry
++			 * may solidify the xref, hence invalidating "entry", meaning we
++			 * need a stashed value for the throw. */
++			fz_off_t ofs = entry->ofs;
++			if (ofs <= 0 || ofs >= xref_len || pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
++				fz_throw(ctx, FZ_ERROR_GENERIC, "invalid reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
++		}
+ 	}
+ }
+ 


More information about the patches mailing list