[arch-commits] Commit in mupdf/trunk (0001-bug-703366-fix-double-free.patch PKGBUILD)

[Christian Hesse]

    Date: Thursday, March 18, 2021 @ 12:15:15
  Author: eworm
Revision: 894394

upgpkg: mupdf 1.18.0-2: fix arbitrary code execution (CVE-2021-3407)

Added:
  mupdf/trunk/0001-bug-703366-fix-double-free.patch
Modified:
  mupdf/trunk/PKGBUILD

---------------------------------------+
 0001-bug-703366-fix-double-free.patch |   44 ++++++++++++++++++++++++++++++++
 PKGBUILD                              |    7 ++++-
 2 files changed, 50 insertions(+), 1 deletion(-)

Added: 0001-bug-703366-fix-double-free.patch
===================================================================
--- 0001-bug-703366-fix-double-free.patch	                        (rev 0)
+++ 0001-bug-703366-fix-double-free.patch	2021-03-18 12:15:15 UTC (rev 894394)
@@ -0,0 +1,44 @@
+From: Robin Watts <Robin.Watts at artifex.com>
+Date: Fri, 22 Jan 2021 17:05:15 +0000 (+0000)
+Subject: Bug 703366: Fix double free of object during linearization.
+X-Git-Url: https://git.ghostscript.com/?p=mupdf.git;a=commitdiff_plain;h=cee7cefc610d42fd383b3c80c12cbc675443176a
+
+Bug 703366: Fix double free of object during linearization.
+
+This appears to happen because we parse an illegal object from
+a broken file and assign it to object 0, which is defined to
+be free.
+
+Here, we fix the parsing code so this can't happen.
+---
+
+diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
+index 7abc8c3d4..5761c3351 100644
+--- a/source/pdf/pdf-parse.c
++++ b/source/pdf/pdf-parse.c
+@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
+ 		fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d ? obj)", num);
+ 	}
+ 	gen = buf->i;
++	if (gen < 0 || gen >= 65536)
++	{
++		if (try_repair)
++			*try_repair = 1;
++		fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number (%d)", gen);
++	}
+ 
+ 	tok = pdf_lex(ctx, file, buf);
+ 	if (tok != PDF_TOK_OBJ)
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 1b2bdcd59..30197b4b8 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf)
+ 	{
+ 		ofs = fz_tell(ctx, doc->file);
+ 		trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, &gen, &stm_ofs, NULL);
++		if (num == 0)
++			fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number cannot be 0\n");
+ 	}
+ 	fz_catch(ctx)
+ 	{

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2021-03-18 12:07:41 UTC (rev 894393)
+++ PKGBUILD	2021-03-18 12:15:15 UTC (rev 894394)
@@ -8,7 +8,7 @@
 pkgbase=mupdf
 pkgname=(libmupdf mupdf mupdf-gl mupdf-tools)
 pkgver=1.18.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Lightweight PDF and XPS viewer'
 arch=('x86_64')
 url='https://mupdf.com/'
@@ -19,9 +19,11 @@
 # we need static libs for zathura-pdf-mupdf
 options=('staticlibs')
 source=("https://mupdf.com/downloads/archive/mupdf-${pkgver/_/}-source.tar.xz"
+        '0001-bug-703366-fix-double-free.patch'
         'mupdf.desktop'
         'mupdf.xpm')
 sha256sums=('592d4f6c0fba41bb954eb1a41616661b62b134d5b383e33bd45a081af5d4a59a'
+            '16d9af14436cc864646a3b384fa3adfaa6b3eea0b73959a693095ddee4845ce1'
             'ccff66979249bd4ab4ba8918660f194eb90eb0ae231b16e36a6cecdcf471883f'
             'a435f44425f5432c074dee745d8fbaeb879038ec1f1ec64f037c74662f09aca8')
 
@@ -30,6 +32,9 @@
 
   # remove bundled packages, we want our system libraries
   rm -rf thirdparty/{freeglut,freetype,harfbuzz,jbig2dec,libjpeg,openjpeg,zlib}
+
+  # Bug 703366: Fix double free of object during linearization.
+  patch -Np1 < ../0001-bug-703366-fix-double-free.patch
 }
 
 build() {