Re: 2.99.1: new beta / almost release candidate
[email protected] (Frank Küster)
| Newsgroups | gmane.comp.tex.tetex.beta |
|---|---|
| Message-ID | <[email protected]> |
Tobias Burnus <[email protected]> schrieb: > Hello, > > Thomas Esser wrote: > >>Well, shortly after 2.99.0, we now see this 2.99.1 release. [...] >>Changes in the src area: >> > I've a question: PDFTeX uses the XPDF library and there had been > recently security problems detected (CAN-2004-0888, CAN-2004-0889). By the way, here is a patch for teTeX-2.0.2 containing xpdf 2.01. I guess the Debian security team will also forward it to other distributors once it has reviewed it; I wouldn't trust it too much. The reason is that it was *me* who prepared it, by adapting the patch for xpdf 2.02 which I got from the Debian Security team. My knowledge of C is *very* small. Regards, Frank -- Frank Küster Inst. f. Biochemie der Univ. Zürich Debian Developer
tetex-bin_2.0.2-22-security.patch
(text/x-patch, 3.1 KB)
RCS file: /cvs/tetex/tetex-bin/debian/patches/patch-src,v
retrieving revision 1.5
diff -u -r1.5 patch-src
--- patches/patch-src 3 Mar 2004 13:49:31 -0000 1.5
+++ patches/patch-src 26 Oct 2004 18:41:22 -0000
@@ -142,3 +142,79 @@
do_args (argc, argv);
+--- tetex-bin-2.0.2-CVS/libs/xpdf/xpdf/Catalog.cc.orig Tue Oct 26 17:37:40 2004
++++ tetex-bin-2.0.2-CVS/libs/xpdf/xpdf/Catalog.cc Tue Oct 26 20:27:50 2004
+@@ -63,6 +63,12 @@
+ }
+ pagesSize = numPages0 = obj.getInt();
+ obj.free();
++ if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++ pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++ error(-1, "Invalid 'pagesSize'");
++ ok = gFalse;
++ return;
++ }
+ pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
+ pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+ for (i = 0; i < pagesSize; ++i) {
+@@ -190,6 +196,11 @@
+ }
+ if (start >= pagesSize) {
+ pagesSize += 32;
++ if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++ pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++ error(-1, "Invalid 'pagesSize' parameter.");
++ goto err3;
++ }
+ pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
+ pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
+ for (j = pagesSize - 32; j < pagesSize; ++j) {
+--- tetex-bin-2.0.2-CVS/libs/xpdf/xpdf/XRef.cc.orig Tue Oct 26 20:30:11 2004
++++ tetex-bin-2.0.2-CVS/libs/xpdf/xpdf/XRef.cc Tue Oct 26 20:29:35 2004
+@@ -76,6 +76,12 @@
+
+ // trailer is ok - read the xref table
+ } else {
++ if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
++ error(-1, "Invalid 'size' inside xref table.");
++ ok = gFalse;
++ errCode = errDamaged;
++ return;
++ }
+ entries = (XRefEntry *)gmalloc(size * sizeof(XRefEntry));
+ for (i = 0; i < size; ++i) {
+ entries[i].offset = 0xffffffff;
+@@ -267,6 +273,10 @@
+ // table size
+ if (first + n > size) {
+ newSize = size + 256;
++ if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++ error(-1, "Invalid 'newSize'");
++ goto err2;
++ }
+ entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
+ for (i = size; i < newSize; ++i) {
+ entries[i].offset = 0xffffffff;
+@@ -410,6 +420,10 @@
+ if (!strncmp(p, "obj", 3)) {
+ if (num >= size) {
+ newSize = (num + 1 + 255) & ~255;
++ if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++ error(-1, "Invalid 'obj' parameters.");
++ return gFalse;
++ }
+ entries = (XRefEntry *)
+ grealloc(entries, newSize * sizeof(XRefEntry));
+ for (i = size; i < newSize; ++i) {
+@@ -431,6 +445,11 @@
+ } else if (!strncmp(p, "endstream", 9)) {
+ if (streamEndsLen == streamEndsSize) {
+ streamEndsSize += 64;
++ if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
++ error(-1, "Invalid 'endstream' parameter.");
++ return gFalse;
++ }
++
+ streamEnds = (Guint *)grealloc(streamEnds,
+ streamEndsSize * sizeof(int));
+ }