[pkg-kde-commits] rev 2633 - in trunk/packages/koffice/debian: . patches

[Isaac Clerencia]

Author: isaac
Date: 2005-12-14 09:03:54 +0000 (Wed, 14 Dec 2005)
New Revision: 2633

Added:
   trunk/packages/koffice/debian/patches/01_koffice_branch_r488386.diff
Modified:
   trunk/packages/koffice/debian/changelog
Log:
Let's see if this really fixes the damn security bug


Modified: trunk/packages/koffice/debian/changelog
===================================================================
--- trunk/packages/koffice/debian/changelog	2005-12-14 08:54:44 UTC (rev 2632)
+++ trunk/packages/koffice/debian/changelog	2005-12-14 09:03:54 UTC (rev 2633)
@@ -1,3 +1,9 @@
+koffice (1:1.4.2-5) unstable; urgency=low
+
+  * koffice branch pull, adding missing bit to completely fix #342294.
+
+ -- Isaac Clerencia <isaac at debian.org>  Wed, 14 Dec 2005 09:59:38 +0100
+
 koffice (1:1.4.2-4) unstable; urgency=low
 
   * koffice branch pull, fixes security bug in included xpdf code,

Added: trunk/packages/koffice/debian/patches/01_koffice_branch_r488386.diff
===================================================================
--- trunk/packages/koffice/debian/patches/01_koffice_branch_r488386.diff	2005-12-14 08:54:44 UTC (rev 2632)
+++ trunk/packages/koffice/debian/patches/01_koffice_branch_r488386.diff	2005-12-14 09:03:54 UTC (rev 2633)
@@ -0,0 +1,144 @@
+#DPATCHLEVEL=0
+--- filters/kword/pdf/xpdf/xpdf/JBIG2Stream.cc	(revision 487865)
++++ filters/kword/pdf/xpdf/xpdf/JBIG2Stream.cc	(revision 488386)
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -977,6 +978,13 @@
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+ }
+ 
+@@ -986,6 +994,13 @@
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
++
++  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
+   data = (Guchar *)gmalloc(h * line);
+   memcpy(data, bitmap->data, h * line);
+ }
+@@ -1012,7 +1027,10 @@
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++  if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
++    error(-1, "invalid width/height");
++    gfree(data);
++    data = NULL;
+     return;
+   }
+   data = (Guchar *)grealloc(data, newH * line);
+@@ -2505,6 +2523,15 @@
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -3078,6 +3105,11 @@
+   Guint ltpCX, cx, cx0, cx2, cx3, cx4, tpgrCX0, tpgrCX1, tpgrCX2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
++    error(-1, "invalid width/height");
++    return NULL;
++  }
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
+--- filters/kword/pdf/xpdf/xpdf/Stream.cc	(revision 487865)
++++ filters/kword/pdf/xpdf/xpdf/Stream.cc	(revision 488386)
+@@ -1247,6 +1247,11 @@
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns < 1 || columns + 2 < 0 || columns + 3 < 0 ||
++	  (columns + 2) >= INT_MAX / sizeof(short) || (columns + 3) >= INT_MAX / sizeof(short)) {
++    error(-1, "invalid number of columns");
++    exit(1);
++  }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+@@ -2882,6 +2887,7 @@
+   width = read16();
+   numComps = str->getChar();
+   if (numComps <= 0 || numComps > 4) {
++     numComps = 0;
+      error(getPos(), "Bad number of components in DCT stream");
+      return gFalse;
+   }
+@@ -2912,6 +2918,7 @@
+   width = read16();
+   numComps = str->getChar();
+   if (numComps <= 0 || numComps > 4) {
++     numComps = 0;
+      error(getPos(), "Bad number of components in DCT stream");
+      return gFalse;
+   }
+@@ -2938,6 +2945,7 @@
+   length = read16() - 2;
+   scanInfo.numComps = str->getChar();
+   if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++     scanInfo.numComps = 0;
+      error(getPos(), "Bad number of components in DCT stream");
+      return gFalse;
+   }
+@@ -3008,12 +3016,12 @@
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3101,9 +3109,11 @@
+   do {
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c != 0xff);
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c == 0xff);
+   } while (c == 0x00);
+   return c;