texlive[48060] Build/source/libs: poppler 0.66.0
commits+kakuto at tug.org
commits+kakuto at tug.org
Wed Jun 20 07:54:15 CEST 2018
Revision: 48060
http://tug.org/svn/texlive?view=revision&revision=48060
Author: kakuto
Date: 2018-06-20 07:54:15 +0200 (Wed, 20 Jun 2018)
Log Message:
-----------
poppler 0.66.0
Modified Paths:
--------------
trunk/Build/source/libs/README
trunk/Build/source/libs/poppler/ChangeLog
trunk/Build/source/libs/poppler/TLpatches/ChangeLog
trunk/Build/source/libs/poppler/TLpatches/TL-Changes
trunk/Build/source/libs/poppler/TLpatches/patch-03-time
trunk/Build/source/libs/poppler/configure
trunk/Build/source/libs/poppler/poppler-src/CMakeLists.txt
trunk/Build/source/libs/poppler/poppler-src/ChangeLog
trunk/Build/source/libs/poppler/poppler-src/NEWS
trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc
trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc
trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc
trunk/Build/source/libs/poppler/poppler-src/goo/gmem.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/CMap.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Function.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.h
trunk/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Hints.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Parser.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.cc
trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.h
trunk/Build/source/libs/poppler/poppler-src/poppler/XRef.cc
trunk/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h
trunk/Build/source/libs/poppler/version.ac
Modified: trunk/Build/source/libs/README
===================================================================
--- trunk/Build/source/libs/README 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/README 2018-06-20 05:54:15 UTC (rev 48060)
@@ -49,7 +49,7 @@
pixman 0.34.0 - checked 04feb16
http://cairographics.org/releases/
-poppler 0.65.0 - checked 21may18
+poppler 0.66.0 - checked 20jun18
http://poppler.freedesktop.org/ - used by luatex and xetex
(requires C++11)
Modified: trunk/Build/source/libs/poppler/ChangeLog
===================================================================
--- trunk/Build/source/libs/poppler/ChangeLog 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/ChangeLog 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,3 +1,8 @@
+2018-06-20 Akira Kakuto <kakuto at fuk.kindai.ac.jp>
+
+ Import poppler-0.66.0.
+ * version.ac: Adjust.
+
2018-05-21 Akira Kakuto <kakuto at fuk.kindai.ac.jp>
Import poppler-0.65.0.
Modified: trunk/Build/source/libs/poppler/TLpatches/ChangeLog
===================================================================
--- trunk/Build/source/libs/poppler/TLpatches/ChangeLog 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/TLpatches/ChangeLog 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,3 +1,7 @@
+2018-06-20 Akira Kakuto <kakuto at fuk.kindai.ac.jp>
+
+ * patch-03-time: Adapted.
+
2018-05-21 Akira Kakuto <kakuto at fuk.kindai.ac.jp>
* patch-03-time: Adapted.
Modified: trunk/Build/source/libs/poppler/TLpatches/TL-Changes
===================================================================
--- trunk/Build/source/libs/poppler/TLpatches/TL-Changes 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/TLpatches/TL-Changes 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,4 +1,4 @@
-Changes applied to the poppler-0.65.0 tree as obtained from:
+Changes applied to the poppler-0.66.0 tree as obtained from:
http://poppler.freedesktop.org/
Removed unused dirs:
@@ -11,7 +11,7 @@
update version.ac
mv poppler-src poppler-prev
tar xf poppler-*.tar.gz
-mv poppler-0.65.0 poppler-src
+mv poppler-0.66.0 poppler-src
cd poppler-src
svn status >/tmp/s
svn add # the ? lines
Modified: trunk/Build/source/libs/poppler/TLpatches/patch-03-time
===================================================================
--- trunk/Build/source/libs/poppler/TLpatches/patch-03-time 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/TLpatches/patch-03-time 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,6 +1,6 @@
-diff -ur poppler-0.65.0/goo/gfile.h poppler-src/goo/gfile.h
---- poppler-0.65.0/goo/gfile.h Sun May 20 00:05:25 2018
-+++ poppler-src/goo/gfile.h Mon May 21 13:30:39 2018
+diff -ur poppler-0.66.0/goo/gfile.h poppler-src/goo/gfile.h
+--- poppler-0.66.0/goo/gfile.h Wed Jun 20 06:16:47 2018
++++ poppler-src/goo/gfile.h Wed Jun 20 14:32:44 2018
@@ -51,8 +51,6 @@
# include <windows.h>
# endif
@@ -10,9 +10,9 @@
#else
# include <unistd.h>
# include <sys/types.h>
-diff -ur poppler-0.65.0/poppler/Form.h poppler-src/poppler/Form.h
---- poppler-0.65.0/poppler/Form.h Sun May 20 00:05:25 2018
-+++ poppler-src/poppler/Form.h Mon May 21 13:31:30 2018
+diff -ur poppler-0.66.0/poppler/Form.h poppler-src/poppler/Form.h
+--- poppler-0.66.0/poppler/Form.h Wed Jun 20 06:16:47 2018
++++ poppler-src/poppler/Form.h Wed Jun 20 14:31:47 2018
@@ -36,6 +36,7 @@
#include <set>
Modified: trunk/Build/source/libs/poppler/configure
===================================================================
--- trunk/Build/source/libs/poppler/configure 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/configure 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for poppler (TeX Live) 0.65.0.
+# Generated by GNU Autoconf 2.69 for poppler (TeX Live) 0.66.0.
#
# Report bugs to <tex-k at tug.org>.
#
@@ -580,8 +580,8 @@
# Identity of this package.
PACKAGE_NAME='poppler (TeX Live)'
PACKAGE_TARNAME='poppler--tex-live-'
-PACKAGE_VERSION='0.65.0'
-PACKAGE_STRING='poppler (TeX Live) 0.65.0'
+PACKAGE_VERSION='0.66.0'
+PACKAGE_STRING='poppler (TeX Live) 0.66.0'
PACKAGE_BUGREPORT='tex-k at tug.org'
PACKAGE_URL=''
@@ -1307,7 +1307,7 @@
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-\`configure' configures poppler (TeX Live) 0.65.0 to adapt to many kinds of systems.
+\`configure' configures poppler (TeX Live) 0.66.0 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -1374,7 +1374,7 @@
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of poppler (TeX Live) 0.65.0:";;
+ short | recursive ) echo "Configuration of poppler (TeX Live) 0.66.0:";;
esac
cat <<\_ACEOF
@@ -1487,7 +1487,7 @@
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
-poppler (TeX Live) configure 0.65.0
+poppler (TeX Live) configure 0.66.0
generated by GNU Autoconf 2.69
Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2134,7 +2134,7 @@
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by poppler (TeX Live) $as_me 0.65.0, which was
+It was created by poppler (TeX Live) $as_me 0.66.0, which was
generated by GNU Autoconf 2.69. Invocation command line was
$ $0 $@
@@ -4057,7 +4057,7 @@
# Define the identity of the package.
PACKAGE='poppler--tex-live-'
- VERSION='0.65.0'
+ VERSION='0.66.0'
# Some tools Automake needs.
@@ -7647,7 +7647,7 @@
cat >>confdefs.h <<_ACEOF
-#define POPPLER_VERSION "0.65.0"
+#define POPPLER_VERSION "0.66.0"
_ACEOF
@@ -8341,7 +8341,7 @@
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
-This file was extended by poppler (TeX Live) $as_me 0.65.0, which was
+This file was extended by poppler (TeX Live) $as_me 0.66.0, which was
generated by GNU Autoconf 2.69. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -8407,7 +8407,7 @@
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
ac_cs_version="\\
-poppler (TeX Live) config.status 0.65.0
+poppler (TeX Live) config.status 0.66.0
configured by $0, generated by GNU Autoconf 2.69,
with options \\"\$ac_cs_config\\"
Modified: trunk/Build/source/libs/poppler/poppler-src/CMakeLists.txt
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/CMakeLists.txt 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/CMakeLists.txt 2018-06-20 05:54:15 UTC (rev 48060)
@@ -30,7 +30,7 @@
endif()
set(POPPLER_MAJOR_VERSION "0")
-set(POPPLER_MINOR_VERSION "65")
+set(POPPLER_MINOR_VERSION "66")
set(POPPLER_MICRO_VERSION "0")
set(POPPLER_VERSION "${POPPLER_MAJOR_VERSION}.${POPPLER_MINOR_VERSION}.${POPPLER_MICRO_VERSION}")
@@ -490,7 +490,7 @@
else()
add_library(poppler ${poppler_SRCS})
endif()
-set_target_properties(poppler PROPERTIES VERSION 76.0.0 SOVERSION 76)
+set_target_properties(poppler PROPERTIES VERSION 77.0.0 SOVERSION 77)
if(MINGW)
get_target_property(POPPLER_SOVERSION poppler SOVERSION)
set_target_properties(poppler PROPERTIES SUFFIX "-${POPPLER_SOVERSION}${CMAKE_SHARED_LIBRARY_SUFFIX}")
Modified: trunk/Build/source/libs/poppler/poppler-src/ChangeLog
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/ChangeLog 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/ChangeLog 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,3 +1,990 @@
+commit 877dcec7e2357991d79508a2aefc39d1510bf235
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 19 23:16:47 2018 +0200
+
+ Poppler 0.66
+
+ CMakeLists.txt | 4 ++--
+ NEWS | 7 +++++++
+ cpp/Doxyfile | 2 +-
+ qt5/src/Doxyfile | 2 +-
+ 4 files changed, 11 insertions(+), 4 deletions(-)
+
+commit 37d2aa88409429397a6c8801b34213f6eded8e1e
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 19 17:42:16 2018 +0200
+
+ PostScriptFunction::parseCode: Fix memory leak on malformed files
+
+ Fixes oss-fuzz/8859
+
+ poppler/Function.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit e4f4cbddd11ae6386985879187007fa5add43624
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 12 09:32:57 2018 +0200
+
+ StreamPredictor: Move pixBytes calculation after checks
+
+ fixes oss-fuzz/8835
+
+ poppler/Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit adb7cac1b787b35c4f5d25e0441e459ab92d0469
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 12 09:00:33 2018 +0200
+
+ GfxImageColorMap: Initialize y to prevent uninit mem use
+
+ Fixes oss-fuzz/8839
+
+ poppler/GfxState.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 6b37df791731e40837fa1eba86ae740650431438
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed Jun 6 17:56:27 2018 +0200
+
+ SampledFunction: Fix divide by zero
+
+ Actual valid values are 1, 2, 4, 8, 12, 16, 24, and 32 but this
+ check is easier
+
+ fixes oss-fuzz/8713
+
+ poppler/Function.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit d6a3dc3ebbc97fcdd3c45028b5741f4b99fc0279
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed Jun 6 17:46:17 2018 +0200
+
+ GfxAxialShading::parse: Fix memory leak on broken files
+
+ fixes oss-fuzz/8742
+
+ poppler/GfxState.cc | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+commit 599e28433268ceaa933cf2a2492c81da4418e207
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 5 20:11:19 2018 +0200
+
+ JBIG2Stream::readSymbolDictSeg: Fix potential uninitialized memory
+ read
+
+ fixes oss-fuzz/8748
+
+ poppler/JBIG2Stream.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit a231de883b438af1807726fab4265ecf4689cf50
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 5 20:00:03 2018 +0200
+
+ CMap::parse2: Initialize end
+
+ fixes oss-fuzz/8747
+
+ poppler/CMap.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 2c629fefe2b2b1e2663521beeac432c808afe7c7
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue Jun 5 19:56:53 2018 +0200
+
+ JBIG2Stream::readSymbolDictSeg: Initialize dh
+
+ fixes oss-fuzz/8751
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 0053966d3ec5b5c4eb6480417b2c8a8ccd910964
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Mon Jun 4 20:38:41 2018 +0200
+
+ JBIG2Stream::readSymbolDictSeg: Initialize refDX
+
+ fixes oss-fuzz/8696
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 8dfe3fb37ec01e35eb22a0932fe708bc9b78cb4f
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 30 17:09:16 2018 +0200
+
+ LONG_LONG_MAX -> LLONG_MAX
+
+ that's the name the standard uses
+
+ poppler/Parser.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit b4f0e2b27a0880801c7af0c82fe17894797511b2
+Author: Stefan Brüns <stefan.bruens at rwth-aachen.de>
+Date: Sat May 26 19:51:20 2018 +0200
+
+ Splash: Reserve space for path segments upfront
+
+ Instead of iteratively growing the array reserve sufficient space
+ prior to populating the array.
+
+ poppler/SplashOutputDev.cc | 2 ++
+ splash/SplashPath.cc | 18 ++++++++++++++++++
+ splash/SplashPath.h | 4 ++++
+ 3 files changed, 24 insertions(+)
+
+commit 450a8a54e080b5bb80533b1777b3b670bea1f27a
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 30 09:09:12 2018 +0200
+
+ JBIG2Stream::readSymbolDictSeg: Initialize refDY
+
+ fixes oss-fuzz/8621
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 1750c0155762e75d0a80ab55b50d1bfd172c2430
+Author: Stefan Brüns <stefan.bruens at rwth-aachen.de>
+Date: Tue May 29 23:49:05 2018 +0200
+
+ splash: Correctly manipulate spot colors if SPOT_NCOMPS != 4
+
+ The default number of spot colors is 4, in this case the change is
+ without effect, otherwise only the last 4 colors where handled.
+
+ splash/SplashTypes.h | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+commit fb4629eb4b1787332b88b330da16353e5ade7b4d
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 29 20:32:23 2018 +0200
+
+ SplashFTFont: Early return if face->units_per_EM is 0
+
+ fixes oss-fuzz/8617
+
+ splash/SplashFTFont.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 943a465d7b76b26de83d2038226c72bcf619c29f
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 29 20:23:51 2018 +0200
+
+ SplashFTFont: Initialize textScale
+
+ fixes oss-fuzz/8616
+
+ splash/SplashFTFont.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit f821faa1795c1b25104d84e9f5a7e8ad218baa61
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 29 20:18:26 2018 +0200
+
+ CMap::parse2: Initialize start
+
+ fixes oss-fuzz/8611
+
+ poppler/CMap.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit a76c8fbd50a3a5cbe0487158e9d2b325e596d2c6
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 29 01:01:26 2018 +0200
+
+ GfxSeparationColorSpace::getRGB: ensure color2 doesn't have uninit
+ values
+
+ if alt->getNComps() is bigger than func->getOutputSize() (which
+ is most
+ likely a faulty file) we init those indexes of color2 with 0
+
+ fixes oss-fuzz/8586
+
+ poppler/GfxState.cc | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit e35fdb1448b7860d697b9c2ec8bda49c7a8a3ae5
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 29 00:59:22 2018 +0200
+
+ JBIG2Stream::readTextRegion: Initialize ds
+
+ fixes oss-fuzz/8594
+
+ poppler/JBIG2Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit bb25c0d46f1f0e037805f0c6dde07f3ea9c9320c
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 29 00:55:28 2018 +0200
+
+ Gfx::doRadialShFill: Initialize colorA, colorB and colorC
+
+ fixes oss-fuzz/8587
+
+ poppler/Gfx.cc | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+commit b8cf8b04cbd1c0c5643cc77ed7b0b60525ecf080
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Mon May 28 23:51:32 2018 +0200
+
+ FoFiType1::parse: Don't copy to buf more than the available file
+
+ fixes oss-fuzz/8576
+
+ fofi/FoFiType1.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit 10a3dc2a9c92349e498ea36bb342b821dcfc9d76
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Mon May 28 17:44:34 2018 +0200
+
+ GfxState.cc: Fix undefined behaviour when compBits is 31
+
+ it's a technical issue since according to spec biggest
+ valid value for compBits is 16, but this is simpler imho
+
+ fixes oss-fuzz/8582
+
+ poppler/GfxState.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 96e7bc19ffcaf46d4cb69660ed040c09d46815d6
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Sun May 27 09:42:24 2018 +0200
+
+ JBIG2Stream::readTextRegion: Initialize a few variables
+
+ So if the stream is broken we don't use uninitialized variables
+
+ fixes oss-fuzz/8547
+
+ poppler/JBIG2Stream.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 9c0c538e8d1aa39cd136cfb8fe0fbfe1def5174d
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Sun May 27 09:34:16 2018 +0200
+
+ Gfx::doAxialShFill: initialize color1
+
+ fixes oss-fuzz/8546
+
+ poppler/Gfx.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 18f376c0dff184851b3ee4c05c40b4ee2c21da8c
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Sun May 27 09:29:49 2018 +0200
+
+ FoFiType1::parse: Fix reading past font length
+
+ fixes oss-fuzz/8545
+
+ fofi/FoFiType1.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit 19d3993f3f40b5113141d5a55acea307c174f1d3
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Sun May 27 09:10:05 2018 +0200
+
+ XRef::fetch: Don't try to fetch objects with negative offset
+
+ fixes oss-fuzz/8433
+
+ poppler/XRef.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 9a8d33246601dbd2bea98bb3404596848f71162a
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Sun May 27 08:47:19 2018 +0200
+
+ Splash::fillGlyph2: fix buffer overflow
+
+ Make sure xx / 8 + 1 is not out of bounds
+
+ fixes oss-fuzz/8422
+
+ splash/Splash.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 1bc71245fa88dc23dc355f926f50f04896739fff
+Author: Adam Reichold <adam.reichold at t-online.de>
+Date: Sat May 26 11:54:41 2018 +0200
+
+ LZWStream: make inputBuf unsigned
+
+ since shifting negative numbers is undefined according to spec
+
+ poppler/Stream.cc | 6 +++---
+ poppler/Stream.h | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+commit 68c5977980a60b2fbac0a5938e697cf09f37b0a2
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 23:06:53 2018 +0200
+
+ BaseCryptStream: Initialize all of objKey
+
+ fixes oss-fuzz/8493
+
+ poppler/Decrypt.cc | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+commit 14adecb9693345b7e3baa6dee05f5c88dde7952c
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 22:57:29 2018 +0200
+
+ Decrypt::md5: initialize x
+
+ When msgLen is small enough x would had initialized values for some
+ parts of the md5 calculation
+
+ fixes oss-fuzz/8492
+
+ poppler/Decrypt.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 71bb82bdecccc235e15255635cab2c31cce58e0e
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 22:52:31 2018 +0200
+
+ Gfx::doAxialShFill: initialize color0
+
+ fixes oss-fuzz/8470
+
+ poppler/Gfx.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit b245154fdebc9a78db163bc95959c6c8f5b4126f
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 22:46:22 2018 +0200
+
+ Parser::makeStream: Don't overflow length
+
+ fixes oss-fuzz/8499
+
+ poppler/Parser.cc | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+commit 86777478387577aee8242eb2f11932041e87eff5
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 19:44:50 2018 +0200
+
+ Splash::fillWithPattern: initialize pipe
+
+ Makes sure if things fail we're not painting with uninitialized memory
+
+ fixes oss-fuzz/8538
+
+ splash/Splash.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 97caec070090d112d4fb5b63dc433a34e214c7e5
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 19:38:19 2018 +0200
+
+ FoFiType1C::readTopDict: Return early if parsing fails
+
+ fixes oss-fuzz/8456
+
+ fofi/FoFiType1C.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 7e2189377bfaa0594e25eaba26aca47bea59f315
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 17:47:07 2018 +0200
+
+ GfxGouraudTriangleShading::parse: Add bounds check for compBits
+
+ The spec is much more strict on what is valid, but i'm only doing
+ a check so that the code doesn't break
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit fef32ba463a225618a967c541d939fd69e02f2dd
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 17:42:22 2018 +0200
+
+ GfxPatchMeshShading::parse: Add bounds check for compBits
+
+ The spec is much more strict on what is valid, but i'm only doing
+ a check so that the code doesn't break
+
+ fixes oss-fuzz/8445
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit 3b9d8025dbdfcfac94ede20b05d86d177393cde7
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 17:26:37 2018 +0200
+
+ Splash: Fix another potential uninitialized memory use
+
+ fixes oss-fuzz/8466
+
+ splash/Splash.cc | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit 0e3b18a48c3907a49c51a0ceded6078a2fd790eb
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 17:06:13 2018 +0200
+
+ SplashUnivariatePattern::getColor: Fix potential uninitialized
+ memory read
+
+ If the GfxUnivariateShading doesn't provide enough bits of color
+ fill them with 0 as to not have random memory read
+
+ fixes oss-fuzz/8470
+
+ poppler/GfxState.cc | 5 +++--
+ poppler/GfxState.h | 4 +++-
+ poppler/SplashOutputDev.cc | 6 +++++-
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+commit c75500bf6b2af4b9a26467ce55d1f2879e916b79
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 16:41:36 2018 +0200
+
+ T3FontCache: change the order in which the overflow checks are done
+
+ fixes oss-fuzz/8479
+
+ poppler/SplashOutputDev.cc | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+commit 4ea7ac960d9ecb6a407d0e660312f5701d3dcd49
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 16:35:49 2018 +0200
+
+ SplashFTFont::getGlyphPath: early return if textScale == 0
+
+ fixes oss-fuzz/8529
+
+ splash/SplashFTFont.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit c1164653bd8d6bcb7da1d959634f63592a393235
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 16:26:44 2018 +0200
+
+ GfxGouraudTriangleShading::parse: Protect against coordBits <= 0
+
+ fixes oss-fuzz/8524
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit a7154bcc6aba5429dc6cc024bd90dae2f1d2d0c1
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Fri May 25 16:21:45 2018 +0200
+
+ XRef::readXRefTable: Rewrite overflow check
+
+ In a way that it doesn't depend on undefined behaviour
+
+ fixes oss-fuzz/8528
+
+ poppler/XRef.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit f966b9096d046aaee4891de11f74207218cc929b
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 23:58:41 2018 +0200
+
+ SplashOutputDev::drawSoftMaskedImage: Fix uninitialized memory read
+
+ It can happen that maskStr->doGetChars doesn't give us the number
+ of chars we wanted, if that happens just set the remainder to zero
+
+ poppler/SplashOutputDev.cc | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+commit b228892adb01f978d5e6045e1e61741bca1950d2
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 23:49:12 2018 +0200
+
+ Splash::blitImageClipped: initialize pixel
+
+ At least this way if the getPixels call we're not drawing random
+ memory
+ and thus we get a stable render which helps with regtests
+
+ splash/Splash.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 67be3708cc4dea9e03f5d0ce5b0214fff35748f2
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 23:29:55 2018 +0200
+
+ SplashFTFont::makeGlyph: Fix use of uninitialized data
+
+ caused by the bugfix to not divide by zero
+
+ splash/SplashFTFont.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit c758fc980834882528eeae82568494e46d189cc5
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 23:19:16 2018 +0200
+
+ FoFiType1::parse: Fix invalid memory access
+
+ Make sure there's enough line left before calling strncmp
+
+ fixes oss-fuzz/8425
+
+ fofi/FoFiType1.cc | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+commit 07318f3899248f67a58148b29a9555ff47a1b083
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 20:15:42 2018 +0200
+
+ StreamReader::cmp: Fix potential undefined behaviour
+
+ going outside an array range is technically undefined behaviour,
+ even if then after you go back in range with the next operation, so
+ we first calculate the diff and then add it to the array
+
+ fofi/FoFiIdentifier.cc | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+commit 6b91d37a704fb2b6fa9529d859c366c331327ab9
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 18:22:00 2018 +0200
+
+ SplashOutputDev: Fix memory leak on malformed files
+
+ i.e. SplashOutputDev::endTextObject is not called after
+ SplashOutputDev::drawChar
+
+ fixes oss-fuzz/8508
+
+ poppler/SplashOutputDev.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit c9650369c5dd74812db515d986ded898b9002ae4
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 18:20:12 2018 +0200
+
+ Splash::scaleMaskYuXu: Free internal bitmap data on error
+
+ this way we don't try to use it later, which will be an uninitialized
+ memory read
+
+ fixes oss-fuzz/8511
+
+ splash/Splash.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit f279778fe0aca610cdecb70d0a714bbaa08b0d22
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 13:06:00 2018 +0200
+
+ JBIG2Stream::readSymbolDictSeg: Fix potential uninitialized memory use
+
+ fixes oss-fuzz/8468
+
+ poppler/JBIG2Stream.cc | 2 ++
+ 1 file changed, 2 insertions(+)
+
+commit ea72a3f3dc1619482ab2502dc50fe628600f38b5
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 12:42:54 2018 +0200
+
+ gmallocn: move the operation after the checks
+
+ fixes oss-fuzz/8423
+
+ goo/gmem.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit aa39d079dc3b68b0a3512408706d053d664d557d
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 12:40:38 2018 +0200
+
+ XRef::readXRefStreamSection: Add integer overflow check
+
+ fixes oss-fuzz/8444
+
+ poppler/XRef.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit db73587c566f8e50f03b24628e8948a558ee7039
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 11:56:39 2018 +0200
+
+ StreamPredictor: move rowBytes calculation after overflow check
+
+ fixes oss-fuzz/8498
+
+ poppler/Stream.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 76820f5ab932a9ed18913bc7d1a452ddf060c133
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Thu May 24 01:12:07 2018 +0200
+
+ JBIG2Stream::readPageInfoSeg: Fix memory leak on malformed documents
+
+ fixes oss-fuzz/8463
+
+ poppler/JBIG2Stream.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit ffb0daefda688564c1456f4b8b3f5a715d228cdc
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 19:06:51 2018 +0200
+
+ Apply previous optimization also to Splash::pipeRunAARGB8
+
+ splash/Splash.cc | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+commit f47936af75088c55a19fe6b1a67128fcc3f57b08
+Author: Stefan Brüns <stefan.bruens at rwth-aachen.de>
+Date: Wed May 23 19:05:50 2018 +0200
+
+ Small optimization for AAXRGB8 pipes
+
+ Skip some computations if both src and dest alpha are zero, or if
+ src is fully opaque. For common cases (majority of pixels fully
+ opaque) like in fdo#81211, this reduces execution time of
+ pipeRunAAXBGR8 by 50% (-20% total execution time).
+
+ splash/Splash.cc | 29 ++++++++++++++++++++---------
+ 1 file changed, 20 insertions(+), 9 deletions(-)
+
+commit 60ec88b3ca5f109b3532dbf2f36df66aed2d7bbf
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 19:49:29 2018 +0200
+
+ greallocn: move the operation to after the checks
+
+ fixes oss-fuzz/8484
+
+ goo/gmem.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit e0fb18040378659c98fedb4bdaff6a903ddd095b
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 19:40:50 2018 +0200
+
+ Gfx::opSetExtGState: Fix memory leak on broken files
+
+ doSoftMask was called just once, from opSetExtGState, but was
+ given the duty to delete blendingColorSpace that given doSoftMask
+ has various early returns is hard to do right, so i've moved
+ the deletion to opSetExtGState itself
+
+ fixes oss-fuzz/8431
+
+ poppler/Gfx.cc | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+commit 86991adb172fd55decdc72ec6fc34d41b19beafa
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 19:35:27 2018 +0200
+
+ Gfx::doRadialShFill: Fix potential divide by zero
+
+ fixes oss-fuzz/8476
+
+ poppler/Gfx.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 62c7a6a135aa8c70f638bac9b41a11c4e69c8452
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 19:29:39 2018 +0200
+
+ GfxImageColorMap::GfxImageColorMap: Bail out early if bits <= 0
+
+ fixes oss-fuzz/8478
+
+ poppler/GfxState.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 6e2de368f620d2e459a4cfe6533a8c29fae6d8c9
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 19:21:30 2018 +0200
+
+ SplashFTFont::SplashFTFont: Early return if textScale is 0
+
+ fixes oss-fuzz/8482
+
+ splash/SplashFTFont.cc | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit 8d715bfc7c3610b823721dc26368728795baa2fe
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 15:44:05 2018 +0200
+
+ GfxPatchMeshShading::parse: Error out if BitsPerCoordinate <= 0
+
+ poppler/GfxState.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+commit f5fb32bd4b64040dc0f9b9e1555dabce804ba566
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 15:38:26 2018 +0200
+
+ Splash::scaleMaskYuXu: Also check for srcHeight <= 0
+
+ splash/Splash.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 0318e1667c7b137493f22be61b835eb914f68fa9
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 15:34:32 2018 +0200
+
+ GfxPatchMeshShading::parse: Fix memory leak on malformed documents
+
+ fixes oss-fuzz/8487
+
+ poppler/GfxState.cc | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+commit 3ca2d43b7ddcca08bc026c6564f89ffbe0dde506
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 00:27:08 2018 +0200
+
+ warning--
+
+ poppler/Decrypt.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 58e056c4b15f262b7715f8061d6885eb80044d0d
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Wed May 23 00:23:19 2018 +0200
+
+ Revert 31c3832b996acbf04ea833e304d7d21ac4533a57
+
+ So shifting left negative values is undefined behaviour according
+ to the
+ spec but if we don't do it we break, so we seem to be depending
+ on this
+ undefined behaviour, will try to figure out a better fix
+
+ poppler/Stream.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit a6c2eb671f08beb682e086d5f6791fdb78906a7c
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 22:12:03 2018 +0200
+
+ Make sure dash[i] is intialized
+
+ even if obj is not a number
+
+ fixes oss-fuzz/8462
+
+ poppler/Gfx.cc | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+commit 083bfa59378be1c008cb6543f7e9bebde29a4079
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 22:01:35 2018 +0200
+
+ nBitsDiffObjects can only be 32 as per spec
+
+ fixes oss-fuzz/8464
+
+ poppler/Hints.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 942a426f2844b66758b6b443234c3686d61420cc
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 21:41:51 2018 +0200
+
+ Parser::makeStream: Make sure length is not negative
+
+ fixes oss-fuzz/8469
+
+ poppler/Parser.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit bf03344ad26b1227b5052420feabe062441c02ed
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 20:36:05 2018 +0200
+
+ StandardSecurityHandler::isUnencrypted: Fix uninitialized memory use
+
+ fixes oss-fuzz/8426
+
+ poppler/SecurityHandler.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 31c3832b996acbf04ea833e304d7d21ac4533a57
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 20:25:18 2018 +0200
+
+ LZWStream::getCode: Don't left shift negative values
+
+ it's undefined behaviour
+
+ poppler/Stream.cc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+commit 2c0a0b07fdb2c76487ca4af7b2f50da9904c6c23
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 20:15:39 2018 +0200
+
+ Gfx::doImage: Fix memory leak on malformed documents
+
+ fixes oss-fuzz/8452
+
+ poppler/Gfx.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit ace7ca3e0dd1570ef6804c0f054742b2996b9b9f
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 20:10:01 2018 +0200
+
+ SplashAxialPattern: fix potential divide by zero
+
+ poppler/SplashOutputDev.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 3b8634e744aa5ba3b317fd3378ba07a438826827
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 20:07:50 2018 +0200
+
+ GfxAxialShading::getParameterRange: Fix potential divide by zero
+
+ fixes oss-fuzz/8436
+
+ poppler/GfxState.cc | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit 91079d4f482b35f190a4f2bbd9f4fb6a8ad7c2a2
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 20:01:56 2018 +0200
+
+ SampledFunction: Fix potential divide by zero
+
+ fixes oss-fuzz/8455
+
+ poppler/Function.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+commit 6169bfb1ecd289a8235be0b8884a550f5d1ad926
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 19:56:34 2018 +0200
+
+ GfxState.cc: Fix potential division by zero
+
+ fixes oss-fuzz/8465
+
+ poppler/GfxState.cc | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+commit 0868c499a9f5f37f8df5c9fef03c37496b40fc8a
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 19:42:38 2018 +0200
+
+ Parser::makeStream: Fix potential integer overflow
+
+ poppler/Parser.cc | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+commit dbe330678766d1260d7f595d238e90aeae1194d6
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 19:31:34 2018 +0200
+
+ XRef::constructXRef: Prevent overflow when calculating newSize
+
+ fixes oss-fuzz/8421
+
+ poppler/XRef.cc | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+commit 224dda4d292a097866f109a9d2cec4b3ba78eb97
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 19:17:20 2018 +0200
+
+ Fix out of bounds write in BaseCryptStream
+
+ fixes oss-fuzz/8420
+
+ poppler/Decrypt.cc | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+commit 0c0c368fed70c1db64ce04b135fd5b060a1f0653
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 18:26:29 2018 +0200
+
+ LZWStream::clearTable: init newChar to 0
+
+ it should not be needed because on well formed streams it will be
+ properly initialized in processNextCode but
+ this solves an uninitialized memory use on malformed documents
+
+ fixes oss-fuzz/8457
+
+ poppler/Stream.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+commit e7f59e39a0aca2a8a363fc0edcf25fb5aaada7a5
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 18:22:29 2018 +0200
+
+ Splash::scaleMaskYuXu: Fix crash on malformed files
+
+ fixes oss-fuzz/8435
+ fixes oss-fuzz/8441
+
+ splash/Splash.cc | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+commit 547f19cd420f2d579d921620545e6496adb6a9fb
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 18:17:58 2018 +0200
+
+ Fix crash in "generic" GlobalParams::findSystemFontFile
+
+ Not very important since we usually either use the fontconfig or
+ the windows one
+
+ fixes oss-fuzz/8427
+
+ poppler/GlobalParams.cc | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+commit d1d8dea64db53fb151fede27efd5fd3308820a51
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 18:13:19 2018 +0200
+
+ Fix memory leak on malformed files
+
+ fixes oss-fuzz/8430
+
+ poppler/Gfx.cc | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+commit 127d0fe3a209b04fc9efb086d423bca4ba359dca
+Author: Albert Astals Cid <aacid at kde.org>
+Date: Tue May 22 01:08:12 2018 +0200
+
+ Fix overflownLongLong check
+
+ We actually want integer math here since doubles lose the precision we
+ want at that high long long values
+
+ poppler/Lexer.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
commit c9e2dc7ea7e098875e6b93566bdb1d14451c3673
Author: Albert Astals Cid <aacid at kde.org>
Date: Sat May 19 17:05:25 2018 +0200
Modified: trunk/Build/source/libs/poppler/poppler-src/NEWS
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/NEWS 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/NEWS 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1,3 +1,10 @@
+Release 0.66.0
+ core:
+ * Fix lots of security/leak issues found by oss-fuzz
+ * Splash: Optimize some files, making them 20% faster
+ * Splash: Correctly manipulate spot colors if SPOT_NCOMPS != 4
+ * Fix compilation with some strict compilers
+
Release 0.65.0
core:
* SplashOutputDev: Add the invisible character check beginType3Char. Bug #106244
Modified: trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -378,13 +378,12 @@
}
GBool StreamReader::cmp(int pos, const char *s) {
- int n;
-
- n = (int)strlen(s);
+ const int n = (int)strlen(s);
if (!fillBuf(pos, n)) {
return gFalse;
}
- return !memcmp(buf - bufPos + pos, s, n);
+ const int posDiff = pos - bufPos;
+ return !memcmp(buf + posDiff, s, n);
}
GBool StreamReader::fillBuf(int pos, int len) {
Modified: trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -226,9 +226,13 @@
++i) {
// get font name
- if (!name && !strncmp(line, "/FontName", 9)) {
- strncpy(buf, line, 255);
- buf[255] = '\0';
+ if (!name &&
+ (line + 9 <= (char*)file + len) &&
+ !strncmp(line, "/FontName", 9)) {
+ const auto availableFile = (char*)file + len - line;
+ const int lineLen = availableFile < 255 ? availableFile : 255;
+ strncpy(buf, line, lineLen);
+ buf[lineLen] = '\0';
if ((p = strchr(buf+9, '/')) &&
(p = strtok_r(p+1, " \t\n\r", &tokptr))) {
name = copyString(p);
@@ -237,9 +241,11 @@
// get encoding
} else if (!encoding &&
+ (line + 30 <= (char*)file + len) &&
!strncmp(line, "/Encoding StandardEncoding def", 30)) {
encoding = (char **)fofiType1StandardEncoding;
} else if (!encoding &&
+ (line + 19 <= (char*)file + len) &&
!strncmp(line, "/Encoding 256 array", 19)) {
encoding = (char **)gmallocn(256, sizeof(char *));
for (j = 0; j < 256; ++j) {
@@ -331,9 +337,13 @@
}
//~ check for getinterval/putinterval junk
- } else if (!gotMatrix && !strncmp(line, "/FontMatrix", 11)) {
- strncpy(buf, line + 11, 255);
- buf[255] = '\0';
+ } else if (!gotMatrix &&
+ (line + 11 <= (char*)file + len) &&
+ !strncmp(line, "/FontMatrix", 11)) {
+ const auto availableFile = (char*)file + len - (line + 11);
+ const int bufLen = availableFile < 255 ? availableFile : 255;
+ strncpy(buf, line + 11, bufLen);
+ buf[bufLen] = '\0';
if ((p = strchr(buf, '['))) {
++p;
if ((p2 = strchr(p, ']'))) {
Modified: trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -2126,6 +2126,9 @@
topDict.fdSelectOffset = 0;
getIndexVal(&topDictIdx, 0, &topDictPtr, &parsedOk);
+ if (!parsedOk) {
+ return;
+ }
pos = topDictPtr.pos;
nOps = 0;
while (pos < topDictPtr.pos + topDictPtr.len) {
Modified: trunk/Build/source/libs/poppler/poppler-src/goo/gmem.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/goo/gmem.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/goo/gmem.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -178,17 +178,15 @@
}
inline static void *gmallocn(int nObjs, int objSize, bool checkoverflow) {
- int n;
-
if (nObjs == 0) {
return nullptr;
}
- n = nObjs * objSize;
if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
fprintf(stderr, "Bogus memory allocation size\n");
if (checkoverflow) return nullptr;
else exit(1);
}
+ const int n = nObjs * objSize;
return gmalloc(n, checkoverflow);
}
@@ -219,8 +217,6 @@
}
inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflow) {
- int n;
-
if (nObjs == 0) {
if (p) {
gfree(p);
@@ -227,7 +223,6 @@
}
return nullptr;
}
- n = nObjs * objSize;
if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
fprintf(stderr, "Bogus memory allocation size\n");
if (checkoverflow) {
@@ -237,6 +232,7 @@
exit(1);
}
}
+ const int n = nObjs * objSize;
return grealloc(p, n, checkoverflow);
}
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/CMap.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/CMap.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/CMap.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -234,7 +234,7 @@
PSTokenizer *pst;
char tok1[256], tok2[256], tok3[256];
int n1, n2, n3;
- Guint start, end, code;
+ Guint start = 0, end = 0, code;
pst = new PSTokenizer(getCharFunc, data);
pst->getToken(tok1, sizeof(tok1), &n1);
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -311,22 +311,26 @@
int keyLength, int objNum, int objGen):
FilterStream(strA)
{
- int i;
-
algo = algoA;
// construct object key
- for (i = 0; i < keyLength; ++i) {
+ for (int i = 0; i < keyLength; ++i) {
objKey[i] = fileKey[i];
}
+ for (std::size_t i = keyLength; i < sizeof(objKey); ++i) {
+ objKey[i] = 0;
+ }
+
switch (algo) {
case cryptRC4:
- objKey[keyLength] = objNum & 0xff;
- objKey[keyLength + 1] = (objNum >> 8) & 0xff;
- objKey[keyLength + 2] = (objNum >> 16) & 0xff;
- objKey[keyLength + 3] = objGen & 0xff;
- objKey[keyLength + 4] = (objGen >> 8) & 0xff;
- md5(objKey, keyLength + 5, objKey);
+ if (likely(keyLength < static_cast<int>(sizeof(objKey) - 4))) {
+ objKey[keyLength] = objNum & 0xff;
+ objKey[keyLength + 1] = (objNum >> 8) & 0xff;
+ objKey[keyLength + 2] = (objNum >> 16) & 0xff;
+ objKey[keyLength + 3] = objGen & 0xff;
+ objKey[keyLength + 4] = (objGen >> 8) & 0xff;
+ md5(objKey, keyLength + 5, objKey);
+ }
if ((objKeyLength = keyLength + 5) > 16) {
objKeyLength = 16;
}
@@ -1148,7 +1152,7 @@
}
void md5(Guchar *msg, int msgLen, Guchar *digest) {
- Gulong x[16];
+ Gulong x[16] = {};
Gulong a, b, c, d, aa, bb, cc, dd;
int n64;
int i, j, k;
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Function.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Function.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Function.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -13,7 +13,7 @@
// All changes made under the Poppler project to this file are licensed
// under GPL version 2 or later
//
-// Copyright (C) 2006, 2008-2010, 2013-2015, 2017 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2006, 2008-2010, 2013-2015, 2017, 2018 Albert Astals Cid <aacid at kde.org>
// Copyright (C) 2006 Jeff Muizelaar <jeff at infidigm.net>
// Copyright (C) 2010 Christian Feuers\xE4nger <cfeuersaenger at googlemail.com>
// Copyright (C) 2011 Andrea Canciani <ranma42 at gmail.com>
@@ -295,6 +295,10 @@
return;
}
sampleBits = obj1.getInt();
+ if (unlikely(sampleBits < 1 || sampleBits > 32)) {
+ error(errSyntaxError, -1, "Function invalid BitsPerSample");
+ return;
+ }
sampleMul = 1.0 / (pow(2.0, (double)sampleBits) - 1);
//----- Encode
@@ -321,6 +325,10 @@
}
}
for (i = 0; i < m; ++i) {
+ if (unlikely((domain[i][1] - domain[i][0]) == 0)) {
+ error(errSyntaxError, -1, "Illegal value in function domain array");
+ return;
+ }
inputMul[i] = (encode[i][1] - encode[i][0]) /
(domain[i][1] - domain[i][0]);
}
@@ -1295,6 +1303,7 @@
if (!tok->cmp("{")) {
elsePtr = *codePtr;
if (!parseCode(str, codePtr)) {
+ delete tok;
return gFalse;
}
delete tok;
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -947,11 +947,10 @@
dash = nullptr;
} else {
dash = (double *)gmallocn(length, sizeof(double));
+ bool dummyOk;
for (i = 0; i < length; ++i) {
- Object obj = a->get(i);
- if (obj.isNum()) {
- dash[i] = obj.getNum();
- }
+ const Object obj = a->get(i);
+ dash[i] = obj.getNum(&dummyOk);
}
}
state->setLineDash(dash, length, args[1].getNum());
@@ -990,7 +989,6 @@
Function *funcs[4];
GfxColor backdropColor;
GBool haveBackdropColor;
- GfxColorSpace *blendingColorSpace;
GBool alpha, isolated, knockout;
double opac;
int i;
@@ -1197,7 +1195,7 @@
if (obj3.isStream()) {
Object obj4 = obj3.streamGetDict()->lookup("Group");
if (obj4.isDict()) {
- blendingColorSpace = nullptr;
+ GfxColorSpace *blendingColorSpace = nullptr;
isolated = knockout = gFalse;
Object obj5 = obj4.dictLookup("CS");
if (!obj5.isNull()) {
@@ -1223,9 +1221,7 @@
}
doSoftMask(&obj3, alpha, blendingColorSpace,
isolated, knockout, funcs[0], &backdropColor);
- if (funcs[0]) {
- delete funcs[0];
- }
+ delete blendingColorSpace;
} else {
error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group");
}
@@ -1232,6 +1228,7 @@
} else {
error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group");
}
+ delete funcs[0];
} else if (!obj2.isNull()) {
error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState");
}
@@ -1357,10 +1354,6 @@
blendingColorSpace, isolated, knockout,
alpha, transferFunc, backdropColor);
--formDepth;
-
- if (blendingColorSpace) {
- delete blendingColorSpace;
- }
}
void Gfx::opSetRenderingIntent(Object args[], int numArgs) {
@@ -2610,7 +2603,7 @@
double t0, t1, tt;
double ta[axialMaxSplits + 1];
int next[axialMaxSplits + 1];
- GfxColor color0, color1;
+ GfxColor color0 = {}, color1 = {};
int nComps;
int i, j, k;
GBool needExtend = gTrue;
@@ -2910,7 +2903,7 @@
double xMin, yMin, xMax, yMax;
double x0, y0, r0, x1, y1, r1, t0, t1;
int nComps;
- GfxColor colorA, colorB;
+ GfxColor colorA = {}, colorB = {}, colorC = {};
double xa, ya, xb, yb, ra, rb;
double ta, tb, sa, sb;
double sz, xz, yz, sMin, sMax;
@@ -2941,7 +2934,12 @@
xz = x0 + sz * (x1 - x0);
yz = y0 + sz * (y1 - y0);
enclosed = (xz - x0) * (xz - x0) + (yz - y0) * (yz - y0) <= r0 * r0;
- theta = asin(r0 / sqrt((x0 - xz) * (x0 - xz) + (y0 - yz) * (y0 - yz)));
+ const double theta_aux = sqrt((x0 - xz) * (x0 - xz) + (y0 - yz) * (y0 - yz));
+ if (likely(theta_aux != 0)) {
+ theta = asin(r0 / theta_aux);
+ } else {
+ theta = 0;
+ }
if (r0 > r1) {
theta = -theta;
}
@@ -3081,7 +3079,6 @@
// same color does not mean all the areas in between have the same color too
int ic = ia + 1;
for (; ic <= ib; ic++) {
- GfxColor colorC;
const double sc = sMin + ((double)ic / (double)radialMaxSplits) * (sMax - sMin);
const double tc = t0 + sc * (t1 - t0);
getShadingColorRadialHelper(t0, t1, tc, shading, &colorC);
@@ -4457,6 +4454,7 @@
}
maskColorSpace = GfxColorSpace::parse(nullptr, &obj1, out, state);
if (!maskColorSpace || maskColorSpace->getMode() != csDeviceGray) {
+ delete maskColorSpace;
goto err1;
}
obj1 = maskDict->lookup("Decode");
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -72,9 +72,13 @@
GBool Matrix::invertTo(Matrix *other) const
{
- double det;
+ const double det_denominator = determinant();
+ if (unlikely(det_denominator == 0)) {
+ *other = {1, 0, 0, 1, 0, 0};
+ return gFalse;
+ }
- det = 1 / determinant();
+ const double det = 1 / det_denominator;
other->m[0] = m[3] * det;
other->m[1] = -m[1] * det;
other->m[2] = -m[2] * det;
@@ -2812,9 +2816,15 @@
} else {
x = colToDbl(color->c[0]);
func->transform(&x, c);
- for (i = 0; i < alt->getNComps(); ++i) {
+ const int altNComps = alt->getNComps();
+ for (i = 0; i < altNComps; ++i) {
color2.c[i] = dblToCol(c[i]);
}
+ if (unlikely(altNComps > func->getOutputSize())) {
+ for (i = func->getOutputSize(); i < altNComps; ++i) {
+ color2.c[i] = 0;
+ }
+ }
alt->getRGB(&color2, rgb);
}
}
@@ -3887,7 +3897,7 @@
gfree (cacheBounds);
}
-void GfxUnivariateShading::getColor(double t, GfxColor *color) {
+int GfxUnivariateShading::getColor(double t, GfxColor *color) {
double out[gfxColorMaxComps];
// NB: there can be one function with n outputs or n functions with
@@ -3897,7 +3907,7 @@
if (unlikely(nFuncs < 1 || nComps > gfxColorMaxComps)) {
for (int i = 0; i < gfxColorMaxComps; i++)
color->c[i] = 0;
- return;
+ return gfxColorMaxComps;
}
if (cacheSize > 0) {
@@ -3937,6 +3947,7 @@
for (int i = 0; i < nComps; ++i) {
color->c[i] = dblToCol(out[i]);
}
+ return nComps;
}
void GfxUnivariateShading::setupCache(const Matrix *ctm,
@@ -4059,7 +4070,6 @@
int nFuncsA;
GBool extend0A, extend1A;
Object obj1;
- int i;
x0A = y0A = x1A = y1A = 0;
obj1 = dict->lookup("Coords");
@@ -4098,9 +4108,11 @@
error(errSyntaxWarning, -1, "Invalid Function array in shading dictionary");
return nullptr;
}
- for (i = 0; i < nFuncsA; ++i) {
+ for (int i = 0; i < nFuncsA; ++i) {
Object obj2 = obj1.arrayGet(i);
if (!(funcsA[i] = Function::parse(&obj2))) {
+ for (int j = 0; j < i; ++j)
+ delete funcsA[j];
return nullptr;
}
}
@@ -4172,7 +4184,13 @@
pdx = x1 - x0;
pdy = y1 - y0;
- invsqnorm = 1.0 / (pdx * pdx + pdy * pdy);
+ const double invsqnorm_denominator = (pdx * pdx + pdy * pdy);
+ if (unlikely(invsqnorm_denominator == 0)) {
+ *lower = 0;
+ *upper = 0;
+ return;
+ }
+ invsqnorm = 1.0 / invsqnorm_denominator;
pdx *= invsqnorm;
pdy *= invsqnorm;
@@ -4771,6 +4789,10 @@
error(errSyntaxWarning, -1, "Missing or invalid BitsPerCoordinate in shading dictionary");
return nullptr;
}
+ if (unlikely(coordBits <= 0)) {
+ error(errSyntaxWarning, -1, "Invalid BitsPerCoordinate in shading dictionary");
+ return nullptr;
+ }
obj1 = dict->lookup("BitsPerComponent");
if (obj1.isInt()) {
compBits = obj1.getInt();
@@ -4778,6 +4800,10 @@
error(errSyntaxWarning, -1, "Missing or invalid BitsPerComponent in shading dictionary");
return nullptr;
}
+ if (unlikely(compBits <= 0 || compBits > 31)) {
+ error(errSyntaxWarning, -1, "Invalid BitsPerComponent in shading dictionary");
+ return nullptr;
+ }
flagBits = vertsPerRow = 0; // make gcc happy
if (typeA == 4) {
obj1 = dict->lookup("BitsPerFlag");
@@ -4809,7 +4835,7 @@
for (i = 0; 5 + 2*i < obj1.arrayGetLength() && i < gfxColorMaxComps; ++i) {
cMin[i] = (obj2 = obj1.arrayGet(4 + 2*i), obj2.getNum(&decodeOk));
cMax[i] = (obj2 = obj1.arrayGet(5 + 2*i), obj2.getNum(&decodeOk));
- cMul[i] = (cMax[i] - cMin[i]) / (double)((1 << compBits) - 1);
+ cMul[i] = (cMax[i] - cMin[i]) / (double)((1u << compBits) - 1);
}
nComps = i;
@@ -5119,6 +5145,10 @@
error(errSyntaxWarning, -1, "Missing or invalid BitsPerCoordinate in shading dictionary");
return nullptr;
}
+ if (unlikely(coordBits <= 0)) {
+ error(errSyntaxWarning, -1, "Invalid BitsPerCoordinate in shading dictionary");
+ return nullptr;
+ }
obj1 = dict->lookup("BitsPerComponent");
if (obj1.isInt()) {
compBits = obj1.getInt();
@@ -5126,6 +5156,10 @@
error(errSyntaxWarning, -1, "Missing or invalid BitsPerComponent in shading dictionary");
return nullptr;
}
+ if (unlikely(compBits <= 0 || compBits > 31)) {
+ error(errSyntaxWarning, -1, "Invalid BitsPerComponent in shading dictionary");
+ return nullptr;
+ }
obj1 = dict->lookup("BitsPerFlag");
if (obj1.isInt()) {
flagBits = obj1.getInt();
@@ -5146,7 +5180,7 @@
for (i = 0; 5 + 2*i < obj1.arrayGetLength() && i < gfxColorMaxComps; ++i) {
cMin[i] = (obj2 = obj1.arrayGet(4 + 2*i), obj2.getNum(&decodeOk));
cMax[i] = (obj2 = obj1.arrayGet(5 + 2*i), obj2.getNum(&decodeOk));
- cMul[i] = (cMax[i] - cMin[i]) / (double)((1 << compBits) - 1);
+ cMul[i] = (cMax[i] - cMin[i]) / (double)((1u << compBits) - 1);
}
nComps = i;
@@ -5283,6 +5317,7 @@
case 1:
if (nPatchesA == 0) {
gfree(patchesA);
+ for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
return nullptr;
}
p->x[0][0] = patchesA[nPatchesA-1].x[0][3];
@@ -5319,6 +5354,7 @@
case 2:
if (nPatchesA == 0) {
gfree(patchesA);
+ for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
return nullptr;
}
p->x[0][0] = patchesA[nPatchesA-1].x[3][3];
@@ -5355,6 +5391,7 @@
case 3:
if (nPatchesA == 0) {
gfree(patchesA);
+ for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
return nullptr;
}
p->x[0][0] = patchesA[nPatchesA-1].x[3][0];
@@ -5434,6 +5471,7 @@
case 1:
if (nPatchesA == 0) {
gfree(patchesA);
+ for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
return nullptr;
}
p->x[0][0] = patchesA[nPatchesA-1].x[0][3];
@@ -5478,6 +5516,7 @@
case 2:
if (nPatchesA == 0) {
gfree(patchesA);
+ for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
return nullptr;
}
p->x[0][0] = patchesA[nPatchesA-1].x[3][3];
@@ -5522,6 +5561,7 @@
case 3:
if (nPatchesA == 0) {
gfree(patchesA);
+ for (int k = 0; k < nFuncsA; ++k) delete funcsA[k];
return nullptr;
}
p->x[0][0] = patchesA[nPatchesA-1].x[3][0];
@@ -5651,7 +5691,7 @@
Guchar *indexedLookup;
Function *sepFunc;
double x[gfxColorMaxComps];
- double y[gfxColorMaxComps];
+ double y[gfxColorMaxComps] = {};
int i, j, k;
double mapped;
GBool useByteLookup;
@@ -5677,6 +5717,9 @@
}
byte_lookup = nullptr;
+ if (unlikely(bits <= 0))
+ goto err1;
+
// get decode map
if (decode->isNull()) {
nComps = colorSpace->getNComps();
@@ -6745,10 +6788,18 @@
void GfxState::getUserClipBBox(double *xMin, double *yMin,
double *xMax, double *yMax) {
double ictm[6];
- double xMin1, yMin1, xMax1, yMax1, det, tx, ty;
+ double xMin1, yMin1, xMax1, yMax1, tx, ty;
// invert the CTM
- det = 1 / (ctm[0] * ctm[3] - ctm[1] * ctm[2]);
+ const double det_denominator = (ctm[0] * ctm[3] - ctm[1] * ctm[2]);
+ if (unlikely(det_denominator == 0)) {
+ *xMin = 0;
+ *yMin = 0;
+ *xMax = 0;
+ *yMax = 0;
+ return;
+ }
+ const double det = 1 / det_denominator;
ictm[0] = ctm[3] * det;
ictm[1] = -ctm[1] * det;
ictm[2] = -ctm[2] * det;
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.h
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.h 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/GfxState.h 2018-06-20 05:54:15 UTC (rev 48060)
@@ -915,7 +915,9 @@
GBool getExtend1() { return extend1; }
int getNFuncs() { return nFuncs; }
Function *getFunc(int i) { return funcs[i]; }
- void getColor(double t, GfxColor *color);
+ // returns the nComps of the shading
+ // i.e. how many positions of color have been set
+ int getColor(double t, GfxColor *color);
void setupCache(const Matrix *ctm,
double xMin, double yMin,
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1296,9 +1296,12 @@
SysFontInfo *fi;
GooString *path;
+ const GooString *fontName = font->getName();
+ if (!fontName) return nullptr;
+
path = NULL;
lockGlobalParams;
- if ((fi = sysFonts->find(font->getName(), font->isFixedWidth(), gFalse))) {
+ if ((fi = sysFonts->find(fontName, font->isFixedWidth(), gFalse))) {
path = fi->path->copy();
*type = fi->type;
*fontNum = fi->fontNum;
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Hints.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Hints.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Hints.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -5,7 +5,7 @@
// This file is licensed under the GPLv2 or later
//
// Copyright 2010, 2012 Hib Eris <hib at hiberis.nl>
-// Copyright 2010, 2011, 2013, 2014, 2016, 2017 Albert Astals Cid <aacid at kde.org>
+// Copyright 2010, 2011, 2013, 2014, 2016-2018 Albert Astals Cid <aacid at kde.org>
// Copyright 2010, 2013 Pino Toscano <pino at kde.org>
// Copyright 2013 Adrian Johnson <ajohnson at redneon.com>
// Copyright 2014 Fabio D'Urso <fabiodurso at hotmail.it>
@@ -258,6 +258,11 @@
if (objectOffsetFirst >= hintsOffset) objectOffsetFirst += hintsLength;
nBitsDiffObjects = sbr.readBits(16);
+ if (nBitsDiffObjects > 32) {
+ error(errSyntaxWarning, -1, "Invalid number of bits needed to represent the difference between the greatest and least number of objects in a page");
+ nPages = 0;
+ return gFalse;
+ }
pageLengthLeast = sbr.readBits(32);
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -1562,7 +1562,7 @@
JBIG2Bitmap *collBitmap, *refBitmap;
Guint *symWidths;
Guint symHeight, symWidth, totalWidth, x, symID;
- int dh, dw, refAggNum, refDX, refDY, bmSize;
+ int dh = 0, dw, refAggNum, refDX = 0, refDY = 0, bmSize;
GBool ex;
int run, cnt, c;
Guint i, j, k;
@@ -1896,6 +1896,7 @@
}
for (k = 0; k < (Guint)bmSize; ++k) {
if ((c = curStr->getChar()) == EOF) {
+ memset(p, 0, bmSize - k);
break;
}
*p++ = (Guchar)c;
@@ -1930,6 +1931,8 @@
// exported symbol list
i = j = 0;
ex = gFalse;
+ run = 0; // initialize it once in case the first decodeInt fails
+ // we do not want to use uninitialized memory
while (i < numInputSyms + numNewSyms) {
if (huff) {
huffDecoder->decodeInt(&run, huffTableA);
@@ -2335,8 +2338,8 @@
JBIG2Bitmap *bitmap;
JBIG2Bitmap *symbolBitmap;
Guint strips;
- int t, dt, tt, s, ds, sFirst, j;
- int rdw, rdh, rdx, rdy, ri, refDX, refDY, bmSize;
+ int t = 0, dt = 0, tt, s, ds = 0, sFirst, j;
+ int rdw, rdh, rdx, rdy, ri = 0, refDX, refDY, bmSize;
Guint symID, inst, bw, bh;
strips = 1 << logStrips;
@@ -4023,6 +4026,7 @@
} else {
curPageH = pageH;
}
+ delete pageBitmap;
pageBitmap = new JBIG2Bitmap(0, pageW, curPageH);
if (!pageBitmap->isOk()) {
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -206,7 +206,7 @@
xf = xf * 10.0 + (c - '0');
} else if (unlikely (overflownInteger)) {
if (unlikely(xll > LongLongSafeLimit) &&
- (xll > (LLONG_MAX - (c - '0')) / 10.0)) {
+ (xll > (LLONG_MAX - (c - '0')) / 10)) {
overflownLongLong = gTrue;
xf = xll * 10.0 + (c - '0');
} else {
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Parser.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Parser.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Parser.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -13,7 +13,7 @@
// All changes made under the Poppler project to this file are licensed
// under GPL version 2 or later
//
-// Copyright (C) 2006, 2009, 201, 2010, 2013, 2014, 2017 Albert Astals Cid <aacid at kde.org>
+// Copyright (C) 2006, 2009, 201, 2010, 2013, 2014, 2017, 2018 Albert Astals Cid <aacid at kde.org>
// Copyright (C) 2006 Krzysztof Kowalczyk <kkowalczyk at gmail.com>
// Copyright (C) 2009 Ilya Gorenbein <igorenbein at finjan.com>
// Copyright (C) 2012 Hib Eris <hib at hiberis.nl>
@@ -235,6 +235,12 @@
pos = pos - 1;
lexer->lookCharLastValueCached = Lexer::LOOK_VALUE_NOT_CACHED;
}
+ if (unlikely(length < 0)) {
+ return nullptr;
+ }
+ if (unlikely(pos > LLONG_MAX - length)) {
+ return nullptr;
+ }
lexer->setPos(pos + length);
// refill token buffers and check for 'endstream'
@@ -255,7 +261,8 @@
// When building the xref we can't use it so use this
// kludge for broken PDF files: just add 5k to the length, and
// hope its enough
- length += 5000;
+ if (length < LLONG_MAX - 5000)
+ length += 5000;
}
}
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -315,6 +315,9 @@
}
GBool StandardSecurityHandler::isUnencrypted() {
+ if (!ok) {
+ return gTrue;
+ }
return encVersion == -1 && encRevision == -1;
}
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -39,6 +39,7 @@
// Copyright (C) 2016 Takahiro Hashimoto <kenya888.en at gmail.com>
// Copyright (C) 2017 Even Rouault <even.rouault at spatialys.com>
// Copyright (C) 2018 Klarälvdalens Datakonsult AB, a KDAB Group company, <info at kdab.com>. Work sponsored by the LiMux project of the city of Munich
+// Copyright (C) 2018 Stefan Brüns <stefan.bruens at rwth-aachen.de>
//
// To see a description of the changes please see the Changelog file that
// came with your tarball or type make ChangeLog if you are building from git
@@ -315,7 +316,11 @@
if (! getParameter (xc, yc, &t))
return gFalse;
- shading->getColor(t, &gfxColor);
+ const int filled = shading->getColor(t, &gfxColor);
+ if (unlikely(filled < shading->getColorSpace()->getNComps())) {
+ for (int i = filled; i < shading->getColorSpace()->getNComps(); ++i)
+ gfxColor.c[i] = 0;
+ }
convertGfxColor(c, colorMode, shading->getColorSpace(), &gfxColor);
return gTrue;
}
@@ -453,7 +458,12 @@
shadingA->getCoords(&x0, &y0, &x1, &y1);
dx = x1 - x0;
dy = y1 - y0;
- mul = 1 / (dx * dx + dy * dy);
+ const double mul_denominator = (dx * dx + dy * dy);
+ if (unlikely(mul_denominator == 0)) {
+ mul = 0;
+ } else {
+ mul = 1 / mul_denominator;
+ }
shadingA->getColorSpace()->getDefaultColor(&srcColor);
convertGfxColor(defaultColor, colorModeA, shadingA->getColorSpace(), &srcColor);
}
@@ -1251,7 +1261,6 @@
double m21A, double m22A,
int glyphXA, int glyphYA, int glyphWA, int glyphHA,
GBool validBBoxA, GBool aa) {
- int i;
fontID = *fontIDA;
m11 = m11A;
@@ -1265,8 +1274,7 @@
validBBox = validBBoxA;
// sanity check for excessively large glyphs (which most likely
// indicate an incorrect BBox)
- i = glyphW * glyphH;
- if (i > 100000 || glyphW > INT_MAX / glyphH || glyphW <= 0 || glyphH <= 0) {
+ if (glyphW > INT_MAX / glyphH || glyphW <= 0 || glyphH <= 0 || glyphW * glyphH > 100000) {
glyphW = glyphH = 100;
validBBox = gFalse;
}
@@ -1293,7 +1301,7 @@
{
cacheTags = (T3FontCacheTag *)gmallocn(cacheSets * cacheAssoc,
sizeof(T3FontCacheTag));
- for (i = 0; i < cacheSets * cacheAssoc; ++i) {
+ for (int i = 0; i < cacheSets * cacheAssoc; ++i) {
cacheTags[i].mru = i & (cacheAssoc - 1);
}
}
@@ -1445,6 +1453,7 @@
if (bitmap) {
delete bitmap;
}
+ delete textClipPath;
}
void SplashOutputDev::startDoc(PDFDoc *docA) {
@@ -2360,6 +2369,7 @@
for (i = 0; i < path->getNumSubpaths(); ++i) {
subpath = path->getSubpath(i);
if (subpath->getNumPoints() > n) {
+ sPath->reserve(subpath->getNumPoints() + 1);
sPath->moveTo((SplashCoord)subpath->getX(0),
(SplashCoord)subpath->getY(0));
j = 1;
@@ -3982,11 +3992,15 @@
//----- set up the soft mask
if (maskColorMap->getMatteColor() != nullptr) {
- Guchar *data = (Guchar *) gmalloc(maskWidth * maskHeight);
+ const int maskChars = maskWidth * maskHeight;
+ Guchar *data = (Guchar *) gmalloc(maskChars);
maskStr->reset();
- maskStr->doGetChars(maskWidth * maskHeight, data);
+ const int readChars = maskStr->doGetChars(maskChars, data);
+ if (unlikely(readChars < maskChars)) {
+ memset(&data[readChars], 0, maskChars - readChars);
+ }
maskStr->close();
- maskStr = new AutoFreeMemStream((char *)data, 0, maskWidth * maskHeight, maskStr->getDictObject()->copy());
+ maskStr = new AutoFreeMemStream((char *)data, 0, maskChars, maskStr->getDictObject()->copy());
}
imgMaskData.imgStr = new ImageStream(maskStr, maskWidth,
maskColorMap->getNumPixelComps(),
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -28,7 +28,7 @@
// Copyright (C) 2012 Fabio D'Urso <fabiodurso at hotmail.it>
// Copyright (C) 2012 Even Rouault <even.rouault at mines-paris.org>
// Copyright (C) 2013, 2017, 2018 Adrian Johnson <ajohnson at redneon.com>
-// Copyright (C) 2013 Adam Reichold <adamreichold at myopera.com>
+// Copyright (C) 2013, 2018 Adam Reichold <adamreichold at myopera.com>
// Copyright (C) 2013 Pino Toscano <pino at kde.org>
// Copyright (C) 2015 Suzuki Toshiya <mpsuzuki at hiroshima-u.ac.jp>
// Copyright (C) 2015 Jason Crain <jason at aquaticape.us>
@@ -572,8 +572,6 @@
ok = gFalse;
nVals = width * nComps;
- pixBytes = (nComps * nBits + 7) >> 3;
- rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
if (width <= 0 || nComps <= 0 || nBits <= 0 ||
nComps > gfxColorMaxComps ||
nBits > 16 ||
@@ -581,6 +579,8 @@
nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
return;
}
+ pixBytes = (nComps * nBits + 7) >> 3;
+ rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
predLine = (Guchar *)gmalloc(rowBytes);
memset(predLine, 0, rowBytes);
predIdx = rowBytes;
@@ -1435,6 +1435,7 @@
nextBits = 9;
seqIndex = seqLength = 0;
first = gTrue;
+ newChar = 0;
}
int LZWStream::getCode() {
@@ -1444,10 +1445,10 @@
while (inputBits < nextBits) {
if ((c = str->getChar()) == EOF)
return EOF;
- inputBuf = (inputBuf << 8) | (c & 0xff);
+ inputBuf = (inputBuf << 8) | static_cast<unsigned>(c & 0xff);
inputBits += 8;
}
- code = (inputBuf >> (inputBits - nextBits)) & ((1 << nextBits) - 1);
+ code = static_cast<signed>((inputBuf >> (inputBits - nextBits)) & ((1 << nextBits) - 1));
inputBits -= nextBits;
return code;
}
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.h
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.h 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/Stream.h 2018-06-20 05:54:15 UTC (rev 48060)
@@ -24,7 +24,7 @@
// Copyright (C) 2012, 2013 Fabio D'Urso <fabiodurso at hotmail.it>
// Copyright (C) 2013, 2017 Adrian Johnson <ajohnson at redneon.com>
// Copyright (C) 2013 Peter Breitenlohner <peb at mppmu.mpg.de>
-// Copyright (C) 2013 Adam Reichold <adamreichold at myopera.com>
+// Copyright (C) 2013, 2018 Adam Reichold <adamreichold at myopera.com>
// Copyright (C) 2013 Pino Toscano <pino at kde.org>
//
// To see a description of the changes please see the Changelog file that
@@ -823,7 +823,7 @@
StreamPredictor *pred; // predictor
int early; // early parameter
GBool eof; // true if at eof
- int inputBuf; // input buffer
+ unsigned int inputBuf; // input buffer
int inputBits; // number of bits in input buffer
struct { // decoding table
int length;
Modified: trunk/Build/source/libs/poppler/poppler-src/poppler/XRef.cc
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/poppler/XRef.cc 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/poppler/XRef.cc 2018-06-20 05:54:15 UTC (rev 48060)
@@ -574,7 +574,7 @@
goto err0;
}
n = obj.getInt();
- if (first < 0 || n < 0 || first + n < 0) {
+ if (first < 0 || n < 0 || first > INT_MAX - n) {
goto err0;
}
if (first + n > size) {
@@ -789,6 +789,9 @@
unsigned long long offset, gen;
int type, c, i, j;
+ if (first > INT_MAX - n) {
+ return gFalse;
+ }
if (first + n < 0) {
return gFalse;
}
@@ -866,7 +869,6 @@
char buf[256];
Goffset pos;
int num, gen;
- int newSize;
int streamEndsSize;
char *p;
GBool gotRoot;
@@ -961,7 +963,11 @@
while (*p && isspace(*p & 0xff)) ++p;
if (!strncmp(p, "obj", 3)) {
if (num >= size) {
- newSize = (num + 1 + 255) & ~255;
+ if (unlikely(num >= INT_MAX - 1 - 255)) {
+ error(errSyntaxError, -1, "Bad object number");
+ return gFalse;
+ }
+ const int newSize = (num + 1 + 255) & ~255;
if (newSize < 0) {
error(errSyntaxError, -1, "Bad object number");
return gFalse;
@@ -1135,7 +1141,7 @@
case xrefEntryUncompressed:
{
- if (e->gen != gen) {
+ if (e->gen != gen || e->offset < 0) {
goto err;
}
parser = new Parser(this,
Modified: trunk/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h
===================================================================
--- trunk/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h 2018-06-20 05:54:15 UTC (rev 48060)
@@ -17,6 +17,7 @@
// Copyright (C) 2009 Stefan Thomas <thomas at eload24.com>
// Copyright (C) 2010 William Bader <williambader at hotmail.com>
// Copyright (C) 2017 Adrian Johnson <ajohnson at redneon.com>
+// Copyright (C) 2018 Stefan Brüns <stefan.bruens at rwth-aachen.de>
//
// To see a description of the changes please see the Changelog file that
// came with your tarball or type make ChangeLog if you are building from git
@@ -126,7 +127,7 @@
dest[2] = 0;
#ifdef SPLASH_CMYK
dest[3] = 0;
- for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++)
+ for (int i = 4; i < SPOT_NCOMPS + 4; i++)
dest[i] = 0;
#endif
}
@@ -137,7 +138,7 @@
dest[2] = src[2];
#ifdef SPLASH_CMYK
dest[3] = src[3];
- for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++)
+ for (int i = 4; i < SPOT_NCOMPS + 4; i++)
dest[i] = src[i];
#endif
}
@@ -148,7 +149,7 @@
dest[2] ^= src[2];
#ifdef SPLASH_CMYK
dest[3] ^= src[3];
- for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++)
+ for (int i = 4; i < SPOT_NCOMPS + 4; i++)
dest[i] ^= src[i];
#endif
}
Modified: trunk/Build/source/libs/poppler/version.ac
===================================================================
--- trunk/Build/source/libs/poppler/version.ac 2018-06-20 03:55:23 UTC (rev 48059)
+++ trunk/Build/source/libs/poppler/version.ac 2018-06-20 05:54:15 UTC (rev 48060)
@@ -9,4 +9,4 @@
dnl --------------------------------------------------------
dnl
dnl m4-include this file to define the current poppler version
-m4_define([poppler_version], [0.65.0])
+m4_define([poppler_version], [0.66.0])
More information about the tex-live-commits
mailing list