summaryrefslogtreecommitdiff
path: root/user/evince/CVE-2019-11459.patch
diff options
context:
space:
mode:
authorA. Wilcox <awilcox@wilcox-tech.com>2019-09-28 16:42:22 +0000
committerA. Wilcox <awilcox@wilcox-tech.com>2019-09-28 16:42:22 +0000
commit78267424e8c6115d0bf4ab46356f0474608f4ef4 (patch)
tree9e48f02c5d1050d29a05b4301dc55ce3965eef14 /user/evince/CVE-2019-11459.patch
parentb6f94882152d13b024f7b547a766d825e2a4589a (diff)
parent915860fbb6b95634ce381443aa9d15d88d0819e3 (diff)
downloadpackages-78267424e8c6115d0bf4ab46356f0474608f4ef4.tar.gz
packages-78267424e8c6115d0bf4ab46356f0474608f4ef4.tar.bz2
packages-78267424e8c6115d0bf4ab46356f0474608f4ef4.tar.xz
packages-78267424e8c6115d0bf4ab46356f0474608f4ef4.zip
Merge branch 'poopler' into 'master'
Bump poppler* and rebuild some of its dependencies See merge request adelie/packages!333
Diffstat (limited to 'user/evince/CVE-2019-11459.patch')
-rw-r--r--user/evince/CVE-2019-11459.patch72
1 files changed, 72 insertions, 0 deletions
diff --git a/user/evince/CVE-2019-11459.patch b/user/evince/CVE-2019-11459.patch
new file mode 100644
index 000000000..b331a0c30
--- /dev/null
+++ b/user/evince/CVE-2019-11459.patch
@@ -0,0 +1,72 @@
+From 234f034a4d15cd46dd556f4945f99fbd57ef5f15 Mon Sep 17 00:00:00 2001
+From: Jason Crain <jcrain@src.gnome.org>
+Date: Mon, 15 Apr 2019 23:06:36 -0600
+Subject: [PATCH] tiff: Handle failure from TIFFReadRGBAImageOriented
+
+The TIFFReadRGBAImageOriented function returns zero if it was unable to
+read the image. Return NULL in this case instead of displaying
+uninitialized memory.
+
+Fixes #1129
+---
+ backend/tiff/tiff-document.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/backend/tiff/tiff-document.c b/backend/tiff/tiff-document.c
+index 7715031b..38bb3bd8 100644
+--- a/backend/tiff/tiff-document.c
++++ b/backend/tiff/tiff-document.c
+@@ -292,18 +292,22 @@ tiff_document_render (EvDocument *document,
+ g_warning("Failed to allocate memory for rendering.");
+ return NULL;
+ }
+-
++
++ if (!TIFFReadRGBAImageOriented (tiff_document->tiff,
++ width, height,
++ (uint32 *)pixels,
++ orientation, 0)) {
++ g_warning ("Failed to read TIFF image.");
++ g_free (pixels);
++ return NULL;
++ }
++
+ surface = cairo_image_surface_create_for_data (pixels,
+ CAIRO_FORMAT_RGB24,
+ width, height,
+ rowstride);
+ cairo_surface_set_user_data (surface, &key,
+ pixels, (cairo_destroy_func_t)g_free);
+-
+- TIFFReadRGBAImageOriented (tiff_document->tiff,
+- width, height,
+- (uint32 *)pixels,
+- orientation, 0);
+ pop_handlers ();
+
+ /* Convert the format returned by libtiff to
+@@ -384,13 +388,17 @@ tiff_document_get_thumbnail (EvDocument *document,
+ if (!pixels)
+ return NULL;
+
++ if (!TIFFReadRGBAImageOriented (tiff_document->tiff,
++ width, height,
++ (uint32 *)pixels,
++ ORIENTATION_TOPLEFT, 0)) {
++ g_free (pixels);
++ return NULL;
++ }
++
+ pixbuf = gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, TRUE, 8,
+ width, height, rowstride,
+ (GdkPixbufDestroyNotify) g_free, NULL);
+- TIFFReadRGBAImageOriented (tiff_document->tiff,
+- width, height,
+- (uint32 *)pixels,
+- ORIENTATION_TOPLEFT, 0);
+ pop_handlers ();
+
+ ev_render_context_compute_scaled_size (rc, width, height * (x_res / y_res),
+--
+2.21.0
+