From 72bd55f3b3dac4ee6b26f0fccb82471465eca21d Mon Sep 17 00:00:00 2001 From: Akira Kakuto Date: Wed, 20 Jun 2018 05:54:15 +0000 Subject: poppler 0.66.0 git-svn-id: svn://tug.org/texlive/trunk@48060 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/libs/README | 2 +- Build/source/libs/poppler/ChangeLog | 5 + Build/source/libs/poppler/TLpatches/ChangeLog | 4 + Build/source/libs/poppler/TLpatches/TL-Changes | 4 +- Build/source/libs/poppler/TLpatches/patch-03-time | 12 +- Build/source/libs/poppler/configure | 22 +- .../source/libs/poppler/poppler-src/CMakeLists.txt | 4 +- Build/source/libs/poppler/poppler-src/ChangeLog | 987 +++++++++++++++++++++ Build/source/libs/poppler/poppler-src/NEWS | 7 + .../poppler/poppler-src/fofi/FoFiIdentifier.cc | 7 +- .../libs/poppler/poppler-src/fofi/FoFiType1.cc | 22 +- .../libs/poppler/poppler-src/fofi/FoFiType1C.cc | 3 + Build/source/libs/poppler/poppler-src/goo/gmem.cc | 8 +- .../libs/poppler/poppler-src/poppler/CMap.cc | 2 +- .../libs/poppler/poppler-src/poppler/Decrypt.cc | 24 +- .../libs/poppler/poppler-src/poppler/Function.cc | 11 +- .../source/libs/poppler/poppler-src/poppler/Gfx.cc | 32 +- .../libs/poppler/poppler-src/poppler/GfxState.cc | 77 +- .../libs/poppler/poppler-src/poppler/GfxState.h | 4 +- .../poppler/poppler-src/poppler/GlobalParams.cc | 5 +- .../libs/poppler/poppler-src/poppler/Hints.cc | 7 +- .../poppler/poppler-src/poppler/JBIG2Stream.cc | 10 +- .../libs/poppler/poppler-src/poppler/Lexer.cc | 2 +- .../libs/poppler/poppler-src/poppler/Parser.cc | 11 +- .../poppler/poppler-src/poppler/SecurityHandler.cc | 3 + .../poppler/poppler-src/poppler/SplashOutputDev.cc | 32 +- .../libs/poppler/poppler-src/poppler/Stream.cc | 11 +- .../libs/poppler/poppler-src/poppler/Stream.h | 4 +- .../libs/poppler/poppler-src/poppler/XRef.cc | 14 +- .../libs/poppler/poppler-src/splash/SplashTypes.h | 7 +- Build/source/libs/poppler/version.ac | 2 +- 31 files changed, 1232 insertions(+), 113 deletions(-) diff --git a/Build/source/libs/README b/Build/source/libs/README index 7f4cffc658c..1d55f12d00b 100644 --- a/Build/source/libs/README +++ b/Build/source/libs/README @@ -49,7 +49,7 @@ mpfr 4.0.1 - checked 10feb18 pixman 0.34.0 - checked 04feb16 http://cairographics.org/releases/ -poppler 0.65.0 - checked 21may18 +poppler 0.66.0 - checked 20jun18 http://poppler.freedesktop.org/ - used by luatex and xetex (requires C++11) diff --git a/Build/source/libs/poppler/ChangeLog b/Build/source/libs/poppler/ChangeLog index 561ba1d21cd..43faadaf6b8 100644 --- a/Build/source/libs/poppler/ChangeLog +++ b/Build/source/libs/poppler/ChangeLog @@ -1,3 +1,8 @@ +2018-06-20 Akira Kakuto + + Import poppler-0.66.0. + * version.ac: Adjust. + 2018-05-21 Akira Kakuto Import poppler-0.65.0. diff --git a/Build/source/libs/poppler/TLpatches/ChangeLog b/Build/source/libs/poppler/TLpatches/ChangeLog index 88096140b2d..95d2ceb3092 100644 --- a/Build/source/libs/poppler/TLpatches/ChangeLog +++ b/Build/source/libs/poppler/TLpatches/ChangeLog @@ -1,3 +1,7 @@ +2018-06-20 Akira Kakuto + + * patch-03-time: Adapted. + 2018-05-21 Akira Kakuto * patch-03-time: Adapted. diff --git a/Build/source/libs/poppler/TLpatches/TL-Changes b/Build/source/libs/poppler/TLpatches/TL-Changes index 7b206957677..492028e489e 100644 --- a/Build/source/libs/poppler/TLpatches/TL-Changes +++ b/Build/source/libs/poppler/TLpatches/TL-Changes @@ -1,4 +1,4 @@ -Changes applied to the poppler-0.65.0 tree as obtained from: +Changes applied to the poppler-0.66.0 tree as obtained from: http://poppler.freedesktop.org/ Removed unused dirs: @@ -11,7 +11,7 @@ General idea: update version.ac mv poppler-src poppler-prev tar xf poppler-*.tar.gz -mv poppler-0.65.0 poppler-src +mv poppler-0.66.0 poppler-src cd poppler-src svn status >/tmp/s svn add # the ? lines diff --git a/Build/source/libs/poppler/TLpatches/patch-03-time b/Build/source/libs/poppler/TLpatches/patch-03-time index aa37759f0f6..ff510f42f21 100644 --- a/Build/source/libs/poppler/TLpatches/patch-03-time +++ b/Build/source/libs/poppler/TLpatches/patch-03-time @@ -1,6 +1,6 @@ -diff -ur poppler-0.65.0/goo/gfile.h poppler-src/goo/gfile.h ---- poppler-0.65.0/goo/gfile.h Sun May 20 00:05:25 2018 -+++ poppler-src/goo/gfile.h Mon May 21 13:30:39 2018 +diff -ur poppler-0.66.0/goo/gfile.h poppler-src/goo/gfile.h +--- poppler-0.66.0/goo/gfile.h Wed Jun 20 06:16:47 2018 ++++ poppler-src/goo/gfile.h Wed Jun 20 14:32:44 2018 @@ -51,8 +51,6 @@ # include # endif @@ -10,9 +10,9 @@ diff -ur poppler-0.65.0/goo/gfile.h poppler-src/goo/gfile.h #else # include # include -diff -ur poppler-0.65.0/poppler/Form.h poppler-src/poppler/Form.h ---- poppler-0.65.0/poppler/Form.h Sun May 20 00:05:25 2018 -+++ poppler-src/poppler/Form.h Mon May 21 13:31:30 2018 +diff -ur poppler-0.66.0/poppler/Form.h poppler-src/poppler/Form.h +--- poppler-0.66.0/poppler/Form.h Wed Jun 20 06:16:47 2018 ++++ poppler-src/poppler/Form.h Wed Jun 20 14:31:47 2018 @@ -36,6 +36,7 @@ #include diff --git a/Build/source/libs/poppler/configure b/Build/source/libs/poppler/configure index 971aa9a6d58..7062703388d 100755 --- a/Build/source/libs/poppler/configure +++ b/Build/source/libs/poppler/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for poppler (TeX Live) 0.65.0. +# Generated by GNU Autoconf 2.69 for poppler (TeX Live) 0.66.0. # # Report bugs to . # @@ -580,8 +580,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='poppler (TeX Live)' PACKAGE_TARNAME='poppler--tex-live-' -PACKAGE_VERSION='0.65.0' -PACKAGE_STRING='poppler (TeX Live) 0.65.0' +PACKAGE_VERSION='0.66.0' +PACKAGE_STRING='poppler (TeX Live) 0.66.0' PACKAGE_BUGREPORT='tex-k@tug.org' PACKAGE_URL='' @@ -1307,7 +1307,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures poppler (TeX Live) 0.65.0 to adapt to many kinds of systems. +\`configure' configures poppler (TeX Live) 0.66.0 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1374,7 +1374,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of poppler (TeX Live) 0.65.0:";; + short | recursive ) echo "Configuration of poppler (TeX Live) 0.66.0:";; esac cat <<\_ACEOF @@ -1487,7 +1487,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -poppler (TeX Live) configure 0.65.0 +poppler (TeX Live) configure 0.66.0 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2134,7 +2134,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by poppler (TeX Live) $as_me 0.65.0, which was +It was created by poppler (TeX Live) $as_me 0.66.0, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -4057,7 +4057,7 @@ fi # Define the identity of the package. PACKAGE='poppler--tex-live-' - VERSION='0.65.0' + VERSION='0.66.0' # Some tools Automake needs. @@ -7647,7 +7647,7 @@ ac_config_headers="$ac_config_headers poppler-config.h:poppler-src/poppler/poppl cat >>confdefs.h <<_ACEOF -#define POPPLER_VERSION "0.65.0" +#define POPPLER_VERSION "0.66.0" _ACEOF @@ -8341,7 +8341,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by poppler (TeX Live) $as_me 0.65.0, which was +This file was extended by poppler (TeX Live) $as_me 0.66.0, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -8407,7 +8407,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -poppler (TeX Live) config.status 0.65.0 +poppler (TeX Live) config.status 0.66.0 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/Build/source/libs/poppler/poppler-src/CMakeLists.txt b/Build/source/libs/poppler/poppler-src/CMakeLists.txt index b5a86a5fde5..7b94037b6f1 100644 --- a/Build/source/libs/poppler/poppler-src/CMakeLists.txt +++ b/Build/source/libs/poppler/poppler-src/CMakeLists.txt @@ -30,7 +30,7 @@ if (ECM_FOUND) endif() set(POPPLER_MAJOR_VERSION "0") -set(POPPLER_MINOR_VERSION "65") +set(POPPLER_MINOR_VERSION "66") set(POPPLER_MICRO_VERSION "0") set(POPPLER_VERSION "${POPPLER_MAJOR_VERSION}.${POPPLER_MINOR_VERSION}.${POPPLER_MICRO_VERSION}") @@ -490,7 +490,7 @@ add_library(poppler STATIC ${poppler_SRCS}) else() add_library(poppler ${poppler_SRCS}) endif() -set_target_properties(poppler PROPERTIES VERSION 76.0.0 SOVERSION 76) +set_target_properties(poppler PROPERTIES VERSION 77.0.0 SOVERSION 77) if(MINGW) get_target_property(POPPLER_SOVERSION poppler SOVERSION) set_target_properties(poppler PROPERTIES SUFFIX "-${POPPLER_SOVERSION}${CMAKE_SHARED_LIBRARY_SUFFIX}") diff --git a/Build/source/libs/poppler/poppler-src/ChangeLog b/Build/source/libs/poppler/poppler-src/ChangeLog index d223f64a791..022b69a02cb 100644 --- a/Build/source/libs/poppler/poppler-src/ChangeLog +++ b/Build/source/libs/poppler/poppler-src/ChangeLog @@ -1,3 +1,990 @@ +commit 877dcec7e2357991d79508a2aefc39d1510bf235 +Author: Albert Astals Cid +Date: Tue Jun 19 23:16:47 2018 +0200 + + Poppler 0.66 + + CMakeLists.txt | 4 ++-- + NEWS | 7 +++++++ + cpp/Doxyfile | 2 +- + qt5/src/Doxyfile | 2 +- + 4 files changed, 11 insertions(+), 4 deletions(-) + +commit 37d2aa88409429397a6c8801b34213f6eded8e1e +Author: Albert Astals Cid +Date: Tue Jun 19 17:42:16 2018 +0200 + + PostScriptFunction::parseCode: Fix memory leak on malformed files + + Fixes oss-fuzz/8859 + + poppler/Function.cc | 1 + + 1 file changed, 1 insertion(+) + +commit e4f4cbddd11ae6386985879187007fa5add43624 +Author: Albert Astals Cid +Date: Tue Jun 12 09:32:57 2018 +0200 + + StreamPredictor: Move pixBytes calculation after checks + + fixes oss-fuzz/8835 + + poppler/Stream.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit adb7cac1b787b35c4f5d25e0441e459ab92d0469 +Author: Albert Astals Cid +Date: Tue Jun 12 09:00:33 2018 +0200 + + GfxImageColorMap: Initialize y to prevent uninit mem use + + Fixes oss-fuzz/8839 + + poppler/GfxState.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 6b37df791731e40837fa1eba86ae740650431438 +Author: Albert Astals Cid +Date: Wed Jun 6 17:56:27 2018 +0200 + + SampledFunction: Fix divide by zero + + Actual valid values are 1, 2, 4, 8, 12, 16, 24, and 32 but this + check is easier + + fixes oss-fuzz/8713 + + poppler/Function.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit d6a3dc3ebbc97fcdd3c45028b5741f4b99fc0279 +Author: Albert Astals Cid +Date: Wed Jun 6 17:46:17 2018 +0200 + + GfxAxialShading::parse: Fix memory leak on broken files + + fixes oss-fuzz/8742 + + poppler/GfxState.cc | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +commit 599e28433268ceaa933cf2a2492c81da4418e207 +Author: Albert Astals Cid +Date: Tue Jun 5 20:11:19 2018 +0200 + + JBIG2Stream::readSymbolDictSeg: Fix potential uninitialized memory + read + + fixes oss-fuzz/8748 + + poppler/JBIG2Stream.cc | 1 + + 1 file changed, 1 insertion(+) + +commit a231de883b438af1807726fab4265ecf4689cf50 +Author: Albert Astals Cid +Date: Tue Jun 5 20:00:03 2018 +0200 + + CMap::parse2: Initialize end + + fixes oss-fuzz/8747 + + poppler/CMap.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 2c629fefe2b2b1e2663521beeac432c808afe7c7 +Author: Albert Astals Cid +Date: Tue Jun 5 19:56:53 2018 +0200 + + JBIG2Stream::readSymbolDictSeg: Initialize dh + + fixes oss-fuzz/8751 + + poppler/JBIG2Stream.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 0053966d3ec5b5c4eb6480417b2c8a8ccd910964 +Author: Albert Astals Cid +Date: Mon Jun 4 20:38:41 2018 +0200 + + JBIG2Stream::readSymbolDictSeg: Initialize refDX + + fixes oss-fuzz/8696 + + poppler/JBIG2Stream.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 8dfe3fb37ec01e35eb22a0932fe708bc9b78cb4f +Author: Albert Astals Cid +Date: Wed May 30 17:09:16 2018 +0200 + + LONG_LONG_MAX -> LLONG_MAX + + that's the name the standard uses + + poppler/Parser.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit b4f0e2b27a0880801c7af0c82fe17894797511b2 +Author: Stefan Brüns +Date: Sat May 26 19:51:20 2018 +0200 + + Splash: Reserve space for path segments upfront + + Instead of iteratively growing the array reserve sufficient space + prior to populating the array. + + poppler/SplashOutputDev.cc | 2 ++ + splash/SplashPath.cc | 18 ++++++++++++++++++ + splash/SplashPath.h | 4 ++++ + 3 files changed, 24 insertions(+) + +commit 450a8a54e080b5bb80533b1777b3b670bea1f27a +Author: Albert Astals Cid +Date: Wed May 30 09:09:12 2018 +0200 + + JBIG2Stream::readSymbolDictSeg: Initialize refDY + + fixes oss-fuzz/8621 + + poppler/JBIG2Stream.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 1750c0155762e75d0a80ab55b50d1bfd172c2430 +Author: Stefan Brüns +Date: Tue May 29 23:49:05 2018 +0200 + + splash: Correctly manipulate spot colors if SPOT_NCOMPS != 4 + + The default number of spot colors is 4, in this case the change is + without effect, otherwise only the last 4 colors where handled. + + splash/SplashTypes.h | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +commit fb4629eb4b1787332b88b330da16353e5ade7b4d +Author: Albert Astals Cid +Date: Tue May 29 20:32:23 2018 +0200 + + SplashFTFont: Early return if face->units_per_EM is 0 + + fixes oss-fuzz/8617 + + splash/SplashFTFont.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 943a465d7b76b26de83d2038226c72bcf619c29f +Author: Albert Astals Cid +Date: Tue May 29 20:23:51 2018 +0200 + + SplashFTFont: Initialize textScale + + fixes oss-fuzz/8616 + + splash/SplashFTFont.cc | 1 + + 1 file changed, 1 insertion(+) + +commit f821faa1795c1b25104d84e9f5a7e8ad218baa61 +Author: Albert Astals Cid +Date: Tue May 29 20:18:26 2018 +0200 + + CMap::parse2: Initialize start + + fixes oss-fuzz/8611 + + poppler/CMap.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit a76c8fbd50a3a5cbe0487158e9d2b325e596d2c6 +Author: Albert Astals Cid +Date: Tue May 29 01:01:26 2018 +0200 + + GfxSeparationColorSpace::getRGB: ensure color2 doesn't have uninit + values + + if alt->getNComps() is bigger than func->getOutputSize() (which + is most + likely a faulty file) we init those indexes of color2 with 0 + + fixes oss-fuzz/8586 + + poppler/GfxState.cc | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +commit e35fdb1448b7860d697b9c2ec8bda49c7a8a3ae5 +Author: Albert Astals Cid +Date: Tue May 29 00:59:22 2018 +0200 + + JBIG2Stream::readTextRegion: Initialize ds + + fixes oss-fuzz/8594 + + poppler/JBIG2Stream.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit bb25c0d46f1f0e037805f0c6dde07f3ea9c9320c +Author: Albert Astals Cid +Date: Tue May 29 00:55:28 2018 +0200 + + Gfx::doRadialShFill: Initialize colorA, colorB and colorC + + fixes oss-fuzz/8587 + + poppler/Gfx.cc | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +commit b8cf8b04cbd1c0c5643cc77ed7b0b60525ecf080 +Author: Albert Astals Cid +Date: Mon May 28 23:51:32 2018 +0200 + + FoFiType1::parse: Don't copy to buf more than the available file + + fixes oss-fuzz/8576 + + fofi/FoFiType1.cc | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +commit 10a3dc2a9c92349e498ea36bb342b821dcfc9d76 +Author: Albert Astals Cid +Date: Mon May 28 17:44:34 2018 +0200 + + GfxState.cc: Fix undefined behaviour when compBits is 31 + + it's a technical issue since according to spec biggest + valid value for compBits is 16, but this is simpler imho + + fixes oss-fuzz/8582 + + poppler/GfxState.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 96e7bc19ffcaf46d4cb69660ed040c09d46815d6 +Author: Albert Astals Cid +Date: Sun May 27 09:42:24 2018 +0200 + + JBIG2Stream::readTextRegion: Initialize a few variables + + So if the stream is broken we don't use uninitialized variables + + fixes oss-fuzz/8547 + + poppler/JBIG2Stream.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 9c0c538e8d1aa39cd136cfb8fe0fbfe1def5174d +Author: Albert Astals Cid +Date: Sun May 27 09:34:16 2018 +0200 + + Gfx::doAxialShFill: initialize color1 + + fixes oss-fuzz/8546 + + poppler/Gfx.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 18f376c0dff184851b3ee4c05c40b4ee2c21da8c +Author: Albert Astals Cid +Date: Sun May 27 09:29:49 2018 +0200 + + FoFiType1::parse: Fix reading past font length + + fixes oss-fuzz/8545 + + fofi/FoFiType1.cc | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +commit 19d3993f3f40b5113141d5a55acea307c174f1d3 +Author: Albert Astals Cid +Date: Sun May 27 09:10:05 2018 +0200 + + XRef::fetch: Don't try to fetch objects with negative offset + + fixes oss-fuzz/8433 + + poppler/XRef.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 9a8d33246601dbd2bea98bb3404596848f71162a +Author: Albert Astals Cid +Date: Sun May 27 08:47:19 2018 +0200 + + Splash::fillGlyph2: fix buffer overflow + + Make sure xx / 8 + 1 is not out of bounds + + fixes oss-fuzz/8422 + + splash/Splash.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 1bc71245fa88dc23dc355f926f50f04896739fff +Author: Adam Reichold +Date: Sat May 26 11:54:41 2018 +0200 + + LZWStream: make inputBuf unsigned + + since shifting negative numbers is undefined according to spec + + poppler/Stream.cc | 6 +++--- + poppler/Stream.h | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +commit 68c5977980a60b2fbac0a5938e697cf09f37b0a2 +Author: Albert Astals Cid +Date: Fri May 25 23:06:53 2018 +0200 + + BaseCryptStream: Initialize all of objKey + + fixes oss-fuzz/8493 + + poppler/Decrypt.cc | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +commit 14adecb9693345b7e3baa6dee05f5c88dde7952c +Author: Albert Astals Cid +Date: Fri May 25 22:57:29 2018 +0200 + + Decrypt::md5: initialize x + + When msgLen is small enough x would had initialized values for some + parts of the md5 calculation + + fixes oss-fuzz/8492 + + poppler/Decrypt.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 71bb82bdecccc235e15255635cab2c31cce58e0e +Author: Albert Astals Cid +Date: Fri May 25 22:52:31 2018 +0200 + + Gfx::doAxialShFill: initialize color0 + + fixes oss-fuzz/8470 + + poppler/Gfx.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit b245154fdebc9a78db163bc95959c6c8f5b4126f +Author: Albert Astals Cid +Date: Fri May 25 22:46:22 2018 +0200 + + Parser::makeStream: Don't overflow length + + fixes oss-fuzz/8499 + + poppler/Parser.cc | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +commit 86777478387577aee8242eb2f11932041e87eff5 +Author: Albert Astals Cid +Date: Fri May 25 19:44:50 2018 +0200 + + Splash::fillWithPattern: initialize pipe + + Makes sure if things fail we're not painting with uninitialized memory + + fixes oss-fuzz/8538 + + splash/Splash.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 97caec070090d112d4fb5b63dc433a34e214c7e5 +Author: Albert Astals Cid +Date: Fri May 25 19:38:19 2018 +0200 + + FoFiType1C::readTopDict: Return early if parsing fails + + fixes oss-fuzz/8456 + + fofi/FoFiType1C.cc | 3 +++ + 1 file changed, 3 insertions(+) + +commit 7e2189377bfaa0594e25eaba26aca47bea59f315 +Author: Albert Astals Cid +Date: Fri May 25 17:47:07 2018 +0200 + + GfxGouraudTriangleShading::parse: Add bounds check for compBits + + The spec is much more strict on what is valid, but i'm only doing + a check so that the code doesn't break + + poppler/GfxState.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit fef32ba463a225618a967c541d939fd69e02f2dd +Author: Albert Astals Cid +Date: Fri May 25 17:42:22 2018 +0200 + + GfxPatchMeshShading::parse: Add bounds check for compBits + + The spec is much more strict on what is valid, but i'm only doing + a check so that the code doesn't break + + fixes oss-fuzz/8445 + + poppler/GfxState.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit 3b9d8025dbdfcfac94ede20b05d86d177393cde7 +Author: Albert Astals Cid +Date: Fri May 25 17:26:37 2018 +0200 + + Splash: Fix another potential uninitialized memory use + + fixes oss-fuzz/8466 + + splash/Splash.cc | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +commit 0e3b18a48c3907a49c51a0ceded6078a2fd790eb +Author: Albert Astals Cid +Date: Fri May 25 17:06:13 2018 +0200 + + SplashUnivariatePattern::getColor: Fix potential uninitialized + memory read + + If the GfxUnivariateShading doesn't provide enough bits of color + fill them with 0 as to not have random memory read + + fixes oss-fuzz/8470 + + poppler/GfxState.cc | 5 +++-- + poppler/GfxState.h | 4 +++- + poppler/SplashOutputDev.cc | 6 +++++- + 3 files changed, 11 insertions(+), 4 deletions(-) + +commit c75500bf6b2af4b9a26467ce55d1f2879e916b79 +Author: Albert Astals Cid +Date: Fri May 25 16:41:36 2018 +0200 + + T3FontCache: change the order in which the overflow checks are done + + fixes oss-fuzz/8479 + + poppler/SplashOutputDev.cc | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +commit 4ea7ac960d9ecb6a407d0e660312f5701d3dcd49 +Author: Albert Astals Cid +Date: Fri May 25 16:35:49 2018 +0200 + + SplashFTFont::getGlyphPath: early return if textScale == 0 + + fixes oss-fuzz/8529 + + splash/SplashFTFont.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit c1164653bd8d6bcb7da1d959634f63592a393235 +Author: Albert Astals Cid +Date: Fri May 25 16:26:44 2018 +0200 + + GfxGouraudTriangleShading::parse: Protect against coordBits <= 0 + + fixes oss-fuzz/8524 + + poppler/GfxState.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit a7154bcc6aba5429dc6cc024bd90dae2f1d2d0c1 +Author: Albert Astals Cid +Date: Fri May 25 16:21:45 2018 +0200 + + XRef::readXRefTable: Rewrite overflow check + + In a way that it doesn't depend on undefined behaviour + + fixes oss-fuzz/8528 + + poppler/XRef.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit f966b9096d046aaee4891de11f74207218cc929b +Author: Albert Astals Cid +Date: Thu May 24 23:58:41 2018 +0200 + + SplashOutputDev::drawSoftMaskedImage: Fix uninitialized memory read + + It can happen that maskStr->doGetChars doesn't give us the number + of chars we wanted, if that happens just set the remainder to zero + + poppler/SplashOutputDev.cc | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +commit b228892adb01f978d5e6045e1e61741bca1950d2 +Author: Albert Astals Cid +Date: Thu May 24 23:49:12 2018 +0200 + + Splash::blitImageClipped: initialize pixel + + At least this way if the getPixels call we're not drawing random + memory + and thus we get a stable render which helps with regtests + + splash/Splash.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 67be3708cc4dea9e03f5d0ce5b0214fff35748f2 +Author: Albert Astals Cid +Date: Thu May 24 23:29:55 2018 +0200 + + SplashFTFont::makeGlyph: Fix use of uninitialized data + + caused by the bugfix to not divide by zero + + splash/SplashFTFont.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit c758fc980834882528eeae82568494e46d189cc5 +Author: Albert Astals Cid +Date: Thu May 24 23:19:16 2018 +0200 + + FoFiType1::parse: Fix invalid memory access + + Make sure there's enough line left before calling strncmp + + fixes oss-fuzz/8425 + + fofi/FoFiType1.cc | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +commit 07318f3899248f67a58148b29a9555ff47a1b083 +Author: Albert Astals Cid +Date: Thu May 24 20:15:42 2018 +0200 + + StreamReader::cmp: Fix potential undefined behaviour + + going outside an array range is technically undefined behaviour, + even if then after you go back in range with the next operation, so + we first calculate the diff and then add it to the array + + fofi/FoFiIdentifier.cc | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +commit 6b91d37a704fb2b6fa9529d859c366c331327ab9 +Author: Albert Astals Cid +Date: Thu May 24 18:22:00 2018 +0200 + + SplashOutputDev: Fix memory leak on malformed files + + i.e. SplashOutputDev::endTextObject is not called after + SplashOutputDev::drawChar + + fixes oss-fuzz/8508 + + poppler/SplashOutputDev.cc | 1 + + 1 file changed, 1 insertion(+) + +commit c9650369c5dd74812db515d986ded898b9002ae4 +Author: Albert Astals Cid +Date: Thu May 24 18:20:12 2018 +0200 + + Splash::scaleMaskYuXu: Free internal bitmap data on error + + this way we don't try to use it later, which will be an uninitialized + memory read + + fixes oss-fuzz/8511 + + splash/Splash.cc | 1 + + 1 file changed, 1 insertion(+) + +commit f279778fe0aca610cdecb70d0a714bbaa08b0d22 +Author: Albert Astals Cid +Date: Thu May 24 13:06:00 2018 +0200 + + JBIG2Stream::readSymbolDictSeg: Fix potential uninitialized memory use + + fixes oss-fuzz/8468 + + poppler/JBIG2Stream.cc | 2 ++ + 1 file changed, 2 insertions(+) + +commit ea72a3f3dc1619482ab2502dc50fe628600f38b5 +Author: Albert Astals Cid +Date: Thu May 24 12:42:54 2018 +0200 + + gmallocn: move the operation after the checks + + fixes oss-fuzz/8423 + + goo/gmem.cc | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +commit aa39d079dc3b68b0a3512408706d053d664d557d +Author: Albert Astals Cid +Date: Thu May 24 12:40:38 2018 +0200 + + XRef::readXRefStreamSection: Add integer overflow check + + fixes oss-fuzz/8444 + + poppler/XRef.cc | 3 +++ + 1 file changed, 3 insertions(+) + +commit db73587c566f8e50f03b24628e8948a558ee7039 +Author: Albert Astals Cid +Date: Thu May 24 11:56:39 2018 +0200 + + StreamPredictor: move rowBytes calculation after overflow check + + fixes oss-fuzz/8498 + + poppler/Stream.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 76820f5ab932a9ed18913bc7d1a452ddf060c133 +Author: Albert Astals Cid +Date: Thu May 24 01:12:07 2018 +0200 + + JBIG2Stream::readPageInfoSeg: Fix memory leak on malformed documents + + fixes oss-fuzz/8463 + + poppler/JBIG2Stream.cc | 1 + + 1 file changed, 1 insertion(+) + +commit ffb0daefda688564c1456f4b8b3f5a715d228cdc +Author: Albert Astals Cid +Date: Wed May 23 19:06:51 2018 +0200 + + Apply previous optimization also to Splash::pipeRunAARGB8 + + splash/Splash.cc | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +commit f47936af75088c55a19fe6b1a67128fcc3f57b08 +Author: Stefan Brüns +Date: Wed May 23 19:05:50 2018 +0200 + + Small optimization for AAXRGB8 pipes + + Skip some computations if both src and dest alpha are zero, or if + src is fully opaque. For common cases (majority of pixels fully + opaque) like in fdo#81211, this reduces execution time of + pipeRunAAXBGR8 by 50% (-20% total execution time). + + splash/Splash.cc | 29 ++++++++++++++++++++--------- + 1 file changed, 20 insertions(+), 9 deletions(-) + +commit 60ec88b3ca5f109b3532dbf2f36df66aed2d7bbf +Author: Albert Astals Cid +Date: Wed May 23 19:49:29 2018 +0200 + + greallocn: move the operation to after the checks + + fixes oss-fuzz/8484 + + goo/gmem.cc | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +commit e0fb18040378659c98fedb4bdaff6a903ddd095b +Author: Albert Astals Cid +Date: Wed May 23 19:40:50 2018 +0200 + + Gfx::opSetExtGState: Fix memory leak on broken files + + doSoftMask was called just once, from opSetExtGState, but was + given the duty to delete blendingColorSpace that given doSoftMask + has various early returns is hard to do right, so i've moved + the deletion to opSetExtGState itself + + fixes oss-fuzz/8431 + + poppler/Gfx.cc | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +commit 86991adb172fd55decdc72ec6fc34d41b19beafa +Author: Albert Astals Cid +Date: Wed May 23 19:35:27 2018 +0200 + + Gfx::doRadialShFill: Fix potential divide by zero + + fixes oss-fuzz/8476 + + poppler/Gfx.cc | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +commit 62c7a6a135aa8c70f638bac9b41a11c4e69c8452 +Author: Albert Astals Cid +Date: Wed May 23 19:29:39 2018 +0200 + + GfxImageColorMap::GfxImageColorMap: Bail out early if bits <= 0 + + fixes oss-fuzz/8478 + + poppler/GfxState.cc | 3 +++ + 1 file changed, 3 insertions(+) + +commit 6e2de368f620d2e459a4cfe6533a8c29fae6d8c9 +Author: Albert Astals Cid +Date: Wed May 23 19:21:30 2018 +0200 + + SplashFTFont::SplashFTFont: Early return if textScale is 0 + + fixes oss-fuzz/8482 + + splash/SplashFTFont.cc | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +commit 8d715bfc7c3610b823721dc26368728795baa2fe +Author: Albert Astals Cid +Date: Wed May 23 15:44:05 2018 +0200 + + GfxPatchMeshShading::parse: Error out if BitsPerCoordinate <= 0 + + poppler/GfxState.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +commit f5fb32bd4b64040dc0f9b9e1555dabce804ba566 +Author: Albert Astals Cid +Date: Wed May 23 15:38:26 2018 +0200 + + Splash::scaleMaskYuXu: Also check for srcHeight <= 0 + + splash/Splash.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 0318e1667c7b137493f22be61b835eb914f68fa9 +Author: Albert Astals Cid +Date: Wed May 23 15:34:32 2018 +0200 + + GfxPatchMeshShading::parse: Fix memory leak on malformed documents + + fixes oss-fuzz/8487 + + poppler/GfxState.cc | 6 ++++++ + 1 file changed, 6 insertions(+) + +commit 3ca2d43b7ddcca08bc026c6564f89ffbe0dde506 +Author: Albert Astals Cid +Date: Wed May 23 00:27:08 2018 +0200 + + warning-- + + poppler/Decrypt.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 58e056c4b15f262b7715f8061d6885eb80044d0d +Author: Albert Astals Cid +Date: Wed May 23 00:23:19 2018 +0200 + + Revert 31c3832b996acbf04ea833e304d7d21ac4533a57 + + So shifting left negative values is undefined behaviour according + to the + spec but if we don't do it we break, so we seem to be depending + on this + undefined behaviour, will try to figure out a better fix + + poppler/Stream.cc | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +commit a6c2eb671f08beb682e086d5f6791fdb78906a7c +Author: Albert Astals Cid +Date: Tue May 22 22:12:03 2018 +0200 + + Make sure dash[i] is intialized + + even if obj is not a number + + fixes oss-fuzz/8462 + + poppler/Gfx.cc | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +commit 083bfa59378be1c008cb6543f7e9bebde29a4079 +Author: Albert Astals Cid +Date: Tue May 22 22:01:35 2018 +0200 + + nBitsDiffObjects can only be 32 as per spec + + fixes oss-fuzz/8464 + + poppler/Hints.cc | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +commit 942a426f2844b66758b6b443234c3686d61420cc +Author: Albert Astals Cid +Date: Tue May 22 21:41:51 2018 +0200 + + Parser::makeStream: Make sure length is not negative + + fixes oss-fuzz/8469 + + poppler/Parser.cc | 3 +++ + 1 file changed, 3 insertions(+) + +commit bf03344ad26b1227b5052420feabe062441c02ed +Author: Albert Astals Cid +Date: Tue May 22 20:36:05 2018 +0200 + + StandardSecurityHandler::isUnencrypted: Fix uninitialized memory use + + fixes oss-fuzz/8426 + + poppler/SecurityHandler.cc | 3 +++ + 1 file changed, 3 insertions(+) + +commit 31c3832b996acbf04ea833e304d7d21ac4533a57 +Author: Albert Astals Cid +Date: Tue May 22 20:25:18 2018 +0200 + + LZWStream::getCode: Don't left shift negative values + + it's undefined behaviour + + poppler/Stream.cc | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +commit 2c0a0b07fdb2c76487ca4af7b2f50da9904c6c23 +Author: Albert Astals Cid +Date: Tue May 22 20:15:39 2018 +0200 + + Gfx::doImage: Fix memory leak on malformed documents + + fixes oss-fuzz/8452 + + poppler/Gfx.cc | 1 + + 1 file changed, 1 insertion(+) + +commit ace7ca3e0dd1570ef6804c0f054742b2996b9b9f +Author: Albert Astals Cid +Date: Tue May 22 20:10:01 2018 +0200 + + SplashAxialPattern: fix potential divide by zero + + poppler/SplashOutputDev.cc | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +commit 3b8634e744aa5ba3b317fd3378ba07a438826827 +Author: Albert Astals Cid +Date: Tue May 22 20:07:50 2018 +0200 + + GfxAxialShading::getParameterRange: Fix potential divide by zero + + fixes oss-fuzz/8436 + + poppler/GfxState.cc | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +commit 91079d4f482b35f190a4f2bbd9f4fb6a8ad7c2a2 +Author: Albert Astals Cid +Date: Tue May 22 20:01:56 2018 +0200 + + SampledFunction: Fix potential divide by zero + + fixes oss-fuzz/8455 + + poppler/Function.cc | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +commit 6169bfb1ecd289a8235be0b8884a550f5d1ad926 +Author: Albert Astals Cid +Date: Tue May 22 19:56:34 2018 +0200 + + GfxState.cc: Fix potential division by zero + + fixes oss-fuzz/8465 + + poppler/GfxState.cc | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +commit 0868c499a9f5f37f8df5c9fef03c37496b40fc8a +Author: Albert Astals Cid +Date: Tue May 22 19:42:38 2018 +0200 + + Parser::makeStream: Fix potential integer overflow + + poppler/Parser.cc | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +commit dbe330678766d1260d7f595d238e90aeae1194d6 +Author: Albert Astals Cid +Date: Tue May 22 19:31:34 2018 +0200 + + XRef::constructXRef: Prevent overflow when calculating newSize + + fixes oss-fuzz/8421 + + poppler/XRef.cc | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +commit 224dda4d292a097866f109a9d2cec4b3ba78eb97 +Author: Albert Astals Cid +Date: Tue May 22 19:17:20 2018 +0200 + + Fix out of bounds write in BaseCryptStream + + fixes oss-fuzz/8420 + + poppler/Decrypt.cc | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +commit 0c0c368fed70c1db64ce04b135fd5b060a1f0653 +Author: Albert Astals Cid +Date: Tue May 22 18:26:29 2018 +0200 + + LZWStream::clearTable: init newChar to 0 + + it should not be needed because on well formed streams it will be + properly initialized in processNextCode but + this solves an uninitialized memory use on malformed documents + + fixes oss-fuzz/8457 + + poppler/Stream.cc | 1 + + 1 file changed, 1 insertion(+) + +commit e7f59e39a0aca2a8a363fc0edcf25fb5aaada7a5 +Author: Albert Astals Cid +Date: Tue May 22 18:22:29 2018 +0200 + + Splash::scaleMaskYuXu: Fix crash on malformed files + + fixes oss-fuzz/8435 + fixes oss-fuzz/8441 + + splash/Splash.cc | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +commit 547f19cd420f2d579d921620545e6496adb6a9fb +Author: Albert Astals Cid +Date: Tue May 22 18:17:58 2018 +0200 + + Fix crash in "generic" GlobalParams::findSystemFontFile + + Not very important since we usually either use the fontconfig or + the windows one + + fixes oss-fuzz/8427 + + poppler/GlobalParams.cc | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +commit d1d8dea64db53fb151fede27efd5fd3308820a51 +Author: Albert Astals Cid +Date: Tue May 22 18:13:19 2018 +0200 + + Fix memory leak on malformed files + + fixes oss-fuzz/8430 + + poppler/Gfx.cc | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +commit 127d0fe3a209b04fc9efb086d423bca4ba359dca +Author: Albert Astals Cid +Date: Tue May 22 01:08:12 2018 +0200 + + Fix overflownLongLong check + + We actually want integer math here since doubles lose the precision we + want at that high long long values + + poppler/Lexer.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + commit c9e2dc7ea7e098875e6b93566bdb1d14451c3673 Author: Albert Astals Cid Date: Sat May 19 17:05:25 2018 +0200 diff --git a/Build/source/libs/poppler/poppler-src/NEWS b/Build/source/libs/poppler/poppler-src/NEWS index 8e380f15799..328265617a5 100644 --- a/Build/source/libs/poppler/poppler-src/NEWS +++ b/Build/source/libs/poppler/poppler-src/NEWS @@ -1,3 +1,10 @@ +Release 0.66.0 + core: + * Fix lots of security/leak issues found by oss-fuzz + * Splash: Optimize some files, making them 20% faster + * Splash: Correctly manipulate spot colors if SPOT_NCOMPS != 4 + * Fix compilation with some strict compilers + Release 0.65.0 core: * SplashOutputDev: Add the invisible character check beginType3Char. Bug #106244 diff --git a/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc b/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc index 3d41145b15d..ffe9c47c742 100644 --- a/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc +++ b/Build/source/libs/poppler/poppler-src/fofi/FoFiIdentifier.cc @@ -378,13 +378,12 @@ GBool StreamReader::getUVarBE(int pos, int size, Guint *val) { } GBool StreamReader::cmp(int pos, const char *s) { - int n; - - n = (int)strlen(s); + const int n = (int)strlen(s); if (!fillBuf(pos, n)) { return gFalse; } - return !memcmp(buf - bufPos + pos, s, n); + const int posDiff = pos - bufPos; + return !memcmp(buf + posDiff, s, n); } GBool StreamReader::fillBuf(int pos, int len) { diff --git a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc index dbe95b67174..2806d92fbef 100644 --- a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc +++ b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1.cc @@ -226,9 +226,13 @@ void FoFiType1::parse() { ++i) { // get font name - if (!name && !strncmp(line, "/FontName", 9)) { - strncpy(buf, line, 255); - buf[255] = '\0'; + if (!name && + (line + 9 <= (char*)file + len) && + !strncmp(line, "/FontName", 9)) { + const auto availableFile = (char*)file + len - line; + const int lineLen = availableFile < 255 ? availableFile : 255; + strncpy(buf, line, lineLen); + buf[lineLen] = '\0'; if ((p = strchr(buf+9, '/')) && (p = strtok_r(p+1, " \t\n\r", &tokptr))) { name = copyString(p); @@ -237,9 +241,11 @@ void FoFiType1::parse() { // get encoding } else if (!encoding && + (line + 30 <= (char*)file + len) && !strncmp(line, "/Encoding StandardEncoding def", 30)) { encoding = (char **)fofiType1StandardEncoding; } else if (!encoding && + (line + 19 <= (char*)file + len) && !strncmp(line, "/Encoding 256 array", 19)) { encoding = (char **)gmallocn(256, sizeof(char *)); for (j = 0; j < 256; ++j) { @@ -331,9 +337,13 @@ void FoFiType1::parse() { } //~ check for getinterval/putinterval junk - } else if (!gotMatrix && !strncmp(line, "/FontMatrix", 11)) { - strncpy(buf, line + 11, 255); - buf[255] = '\0'; + } else if (!gotMatrix && + (line + 11 <= (char*)file + len) && + !strncmp(line, "/FontMatrix", 11)) { + const auto availableFile = (char*)file + len - (line + 11); + const int bufLen = availableFile < 255 ? availableFile : 255; + strncpy(buf, line + 11, bufLen); + buf[bufLen] = '\0'; if ((p = strchr(buf, '['))) { ++p; if ((p2 = strchr(p, ']'))) { diff --git a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc index b14561ff31e..37694869d9c 100644 --- a/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc +++ b/Build/source/libs/poppler/poppler-src/fofi/FoFiType1C.cc @@ -2126,6 +2126,9 @@ void FoFiType1C::readTopDict() { topDict.fdSelectOffset = 0; getIndexVal(&topDictIdx, 0, &topDictPtr, &parsedOk); + if (!parsedOk) { + return; + } pos = topDictPtr.pos; nOps = 0; while (pos < topDictPtr.pos + topDictPtr.len) { diff --git a/Build/source/libs/poppler/poppler-src/goo/gmem.cc b/Build/source/libs/poppler/poppler-src/goo/gmem.cc index 574997fadda..f118fd715d4 100644 --- a/Build/source/libs/poppler/poppler-src/goo/gmem.cc +++ b/Build/source/libs/poppler/poppler-src/goo/gmem.cc @@ -178,17 +178,15 @@ void *grealloc_checkoverflow(void *p, size_t size) { } inline static void *gmallocn(int nObjs, int objSize, bool checkoverflow) { - int n; - if (nObjs == 0) { return nullptr; } - n = nObjs * objSize; if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { fprintf(stderr, "Bogus memory allocation size\n"); if (checkoverflow) return nullptr; else exit(1); } + const int n = nObjs * objSize; return gmalloc(n, checkoverflow); } @@ -219,15 +217,12 @@ void *gmallocn3_checkoverflow(int a, int b, int c) { } inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflow) { - int n; - if (nObjs == 0) { if (p) { gfree(p); } return nullptr; } - n = nObjs * objSize; if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) { fprintf(stderr, "Bogus memory allocation size\n"); if (checkoverflow) { @@ -237,6 +232,7 @@ inline static void *greallocn(void *p, int nObjs, int objSize, bool checkoverflo exit(1); } } + const int n = nObjs * objSize; return grealloc(p, n, checkoverflow); } diff --git a/Build/source/libs/poppler/poppler-src/poppler/CMap.cc b/Build/source/libs/poppler/poppler-src/poppler/CMap.cc index 01bff352a08..614009b77ac 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/CMap.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/CMap.cc @@ -234,7 +234,7 @@ void CMap::parse2(CMapCache *cache, int (*getCharFunc)(void *), void *data) { PSTokenizer *pst; char tok1[256], tok2[256], tok3[256]; int n1, n2, n3; - Guint start, end, code; + Guint start = 0, end = 0, code; pst = new PSTokenizer(getCharFunc, data); pst->getToken(tok1, sizeof(tok1), &n1); diff --git a/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc b/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc index bf858cecaf1..9577b655234 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Decrypt.cc @@ -311,22 +311,26 @@ BaseCryptStream::BaseCryptStream(Stream *strA, Guchar *fileKey, CryptAlgorithm a int keyLength, int objNum, int objGen): FilterStream(strA) { - int i; - algo = algoA; // construct object key - for (i = 0; i < keyLength; ++i) { + for (int i = 0; i < keyLength; ++i) { objKey[i] = fileKey[i]; } + for (std::size_t i = keyLength; i < sizeof(objKey); ++i) { + objKey[i] = 0; + } + switch (algo) { case cryptRC4: - objKey[keyLength] = objNum & 0xff; - objKey[keyLength + 1] = (objNum >> 8) & 0xff; - objKey[keyLength + 2] = (objNum >> 16) & 0xff; - objKey[keyLength + 3] = objGen & 0xff; - objKey[keyLength + 4] = (objGen >> 8) & 0xff; - md5(objKey, keyLength + 5, objKey); + if (likely(keyLength < static_cast(sizeof(objKey) - 4))) { + objKey[keyLength] = objNum & 0xff; + objKey[keyLength + 1] = (objNum >> 8) & 0xff; + objKey[keyLength + 2] = (objNum >> 16) & 0xff; + objKey[keyLength + 3] = objGen & 0xff; + objKey[keyLength + 4] = (objGen >> 8) & 0xff; + md5(objKey, keyLength + 5, objKey); + } if ((objKeyLength = keyLength + 5) > 16) { objKeyLength = 16; } @@ -1148,7 +1152,7 @@ static inline Gulong md5Round4(Gulong a, Gulong b, Gulong c, Gulong d, } void md5(Guchar *msg, int msgLen, Guchar *digest) { - Gulong x[16]; + Gulong x[16] = {}; Gulong a, b, c, d, aa, bb, cc, dd; int n64; int i, j, k; diff --git a/Build/source/libs/poppler/poppler-src/poppler/Function.cc b/Build/source/libs/poppler/poppler-src/poppler/Function.cc index 5437de35616..cc32414b87b 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Function.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Function.cc @@ -13,7 +13,7 @@ // All changes made under the Poppler project to this file are licensed // under GPL version 2 or later // -// Copyright (C) 2006, 2008-2010, 2013-2015, 2017 Albert Astals Cid +// Copyright (C) 2006, 2008-2010, 2013-2015, 2017, 2018 Albert Astals Cid // Copyright (C) 2006 Jeff Muizelaar // Copyright (C) 2010 Christian Feuersänger // Copyright (C) 2011 Andrea Canciani @@ -295,6 +295,10 @@ SampledFunction::SampledFunction(Object *funcObj, Dict *dict) { return; } sampleBits = obj1.getInt(); + if (unlikely(sampleBits < 1 || sampleBits > 32)) { + error(errSyntaxError, -1, "Function invalid BitsPerSample"); + return; + } sampleMul = 1.0 / (pow(2.0, (double)sampleBits) - 1); //----- Encode @@ -321,6 +325,10 @@ SampledFunction::SampledFunction(Object *funcObj, Dict *dict) { } } for (i = 0; i < m; ++i) { + if (unlikely((domain[i][1] - domain[i][0]) == 0)) { + error(errSyntaxError, -1, "Illegal value in function domain array"); + return; + } inputMul[i] = (encode[i][1] - encode[i][0]) / (domain[i][1] - domain[i][0]); } @@ -1295,6 +1303,7 @@ GBool PostScriptFunction::parseCode(Stream *str, int *codePtr) { if (!tok->cmp("{")) { elsePtr = *codePtr; if (!parseCode(str, codePtr)) { + delete tok; return gFalse; } delete tok; diff --git a/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc b/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc index a4d12a70a35..572f435cd90 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Gfx.cc @@ -947,11 +947,10 @@ void Gfx::opSetDash(Object args[], int numArgs) { dash = nullptr; } else { dash = (double *)gmallocn(length, sizeof(double)); + bool dummyOk; for (i = 0; i < length; ++i) { - Object obj = a->get(i); - if (obj.isNum()) { - dash[i] = obj.getNum(); - } + const Object obj = a->get(i); + dash[i] = obj.getNum(&dummyOk); } } state->setLineDash(dash, length, args[1].getNum()); @@ -990,7 +989,6 @@ void Gfx::opSetExtGState(Object args[], int numArgs) { Function *funcs[4]; GfxColor backdropColor; GBool haveBackdropColor; - GfxColorSpace *blendingColorSpace; GBool alpha, isolated, knockout; double opac; int i; @@ -1197,7 +1195,7 @@ void Gfx::opSetExtGState(Object args[], int numArgs) { if (obj3.isStream()) { Object obj4 = obj3.streamGetDict()->lookup("Group"); if (obj4.isDict()) { - blendingColorSpace = nullptr; + GfxColorSpace *blendingColorSpace = nullptr; isolated = knockout = gFalse; Object obj5 = obj4.dictLookup("CS"); if (!obj5.isNull()) { @@ -1223,15 +1221,14 @@ void Gfx::opSetExtGState(Object args[], int numArgs) { } doSoftMask(&obj3, alpha, blendingColorSpace, isolated, knockout, funcs[0], &backdropColor); - if (funcs[0]) { - delete funcs[0]; - } + delete blendingColorSpace; } else { error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group"); } } else { error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState - missing group"); } + delete funcs[0]; } else if (!obj2.isNull()) { error(errSyntaxError, getPos(), "Invalid soft mask in ExtGState"); } @@ -1357,10 +1354,6 @@ void Gfx::doSoftMask(Object *str, GBool alpha, blendingColorSpace, isolated, knockout, alpha, transferFunc, backdropColor); --formDepth; - - if (blendingColorSpace) { - delete blendingColorSpace; - } } void Gfx::opSetRenderingIntent(Object args[], int numArgs) { @@ -2610,7 +2603,7 @@ void Gfx::doAxialShFill(GfxAxialShading *shading) { double t0, t1, tt; double ta[axialMaxSplits + 1]; int next[axialMaxSplits + 1]; - GfxColor color0, color1; + GfxColor color0 = {}, color1 = {}; int nComps; int i, j, k; GBool needExtend = gTrue; @@ -2910,7 +2903,7 @@ void Gfx::doRadialShFill(GfxRadialShading *shading) { double xMin, yMin, xMax, yMax; double x0, y0, r0, x1, y1, r1, t0, t1; int nComps; - GfxColor colorA, colorB; + GfxColor colorA = {}, colorB = {}, colorC = {}; double xa, ya, xb, yb, ra, rb; double ta, tb, sa, sb; double sz, xz, yz, sMin, sMax; @@ -2941,7 +2934,12 @@ void Gfx::doRadialShFill(GfxRadialShading *shading) { xz = x0 + sz * (x1 - x0); yz = y0 + sz * (y1 - y0); enclosed = (xz - x0) * (xz - x0) + (yz - y0) * (yz - y0) <= r0 * r0; - theta = asin(r0 / sqrt((x0 - xz) * (x0 - xz) + (y0 - yz) * (y0 - yz))); + const double theta_aux = sqrt((x0 - xz) * (x0 - xz) + (y0 - yz) * (y0 - yz)); + if (likely(theta_aux != 0)) { + theta = asin(r0 / theta_aux); + } else { + theta = 0; + } if (r0 > r1) { theta = -theta; } @@ -3081,7 +3079,6 @@ void Gfx::doRadialShFill(GfxRadialShading *shading) { // same color does not mean all the areas in between have the same color too int ic = ia + 1; for (; ic <= ib; ic++) { - GfxColor colorC; const double sc = sMin + ((double)ic / (double)radialMaxSplits) * (sMax - sMin); const double tc = t0 + sc * (t1 - t0); getShadingColorRadialHelper(t0, t1, tc, shading, &colorC); @@ -4457,6 +4454,7 @@ void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) { } maskColorSpace = GfxColorSpace::parse(nullptr, &obj1, out, state); if (!maskColorSpace || maskColorSpace->getMode() != csDeviceGray) { + delete maskColorSpace; goto err1; } obj1 = maskDict->lookup("Decode"); diff --git a/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc b/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc index 5d7cc6baa24..157bcf44181 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/GfxState.cc @@ -72,9 +72,13 @@ GBool Matrix::invertTo(Matrix *other) const { - double det; + const double det_denominator = determinant(); + if (unlikely(det_denominator == 0)) { + *other = {1, 0, 0, 1, 0, 0}; + return gFalse; + } - det = 1 / determinant(); + const double det = 1 / det_denominator; other->m[0] = m[3] * det; other->m[1] = -m[1] * det; other->m[2] = -m[2] * det; @@ -2812,9 +2816,15 @@ void GfxSeparationColorSpace::getRGB(GfxColor *color, GfxRGB *rgb) { } else { x = colToDbl(color->c[0]); func->transform(&x, c); - for (i = 0; i < alt->getNComps(); ++i) { + const int altNComps = alt->getNComps(); + for (i = 0; i < altNComps; ++i) { color2.c[i] = dblToCol(c[i]); } + if (unlikely(altNComps > func->getOutputSize())) { + for (i = func->getOutputSize(); i < altNComps; ++i) { + color2.c[i] = 0; + } + } alt->getRGB(&color2, rgb); } } @@ -3887,7 +3897,7 @@ GfxUnivariateShading::~GfxUnivariateShading() { gfree (cacheBounds); } -void GfxUnivariateShading::getColor(double t, GfxColor *color) { +int GfxUnivariateShading::getColor(double t, GfxColor *color) { double out[gfxColorMaxComps]; // NB: there can be one function with n outputs or n functions with @@ -3897,7 +3907,7 @@ void GfxUnivariateShading::getColor(double t, GfxColor *color) { if (unlikely(nFuncs < 1 || nComps > gfxColorMaxComps)) { for (int i = 0; i < gfxColorMaxComps; i++) color->c[i] = 0; - return; + return gfxColorMaxComps; } if (cacheSize > 0) { @@ -3937,6 +3947,7 @@ void GfxUnivariateShading::getColor(double t, GfxColor *color) { for (int i = 0; i < nComps; ++i) { color->c[i] = dblToCol(out[i]); } + return nComps; } void GfxUnivariateShading::setupCache(const Matrix *ctm, @@ -4059,7 +4070,6 @@ GfxAxialShading *GfxAxialShading::parse(GfxResources *res, Dict *dict, OutputDev int nFuncsA; GBool extend0A, extend1A; Object obj1; - int i; x0A = y0A = x1A = y1A = 0; obj1 = dict->lookup("Coords"); @@ -4098,9 +4108,11 @@ GfxAxialShading *GfxAxialShading::parse(GfxResources *res, Dict *dict, OutputDev error(errSyntaxWarning, -1, "Invalid Function array in shading dictionary"); return nullptr; } - for (i = 0; i < nFuncsA; ++i) { + for (int i = 0; i < nFuncsA; ++i) { Object obj2 = obj1.arrayGet(i); if (!(funcsA[i] = Function::parse(&obj2))) { + for (int j = 0; j < i; ++j) + delete funcsA[j]; return nullptr; } } @@ -4172,7 +4184,13 @@ void GfxAxialShading::getParameterRange(double *lower, double *upper, pdx = x1 - x0; pdy = y1 - y0; - invsqnorm = 1.0 / (pdx * pdx + pdy * pdy); + const double invsqnorm_denominator = (pdx * pdx + pdy * pdy); + if (unlikely(invsqnorm_denominator == 0)) { + *lower = 0; + *upper = 0; + return; + } + invsqnorm = 1.0 / invsqnorm_denominator; pdx *= invsqnorm; pdy *= invsqnorm; @@ -4771,6 +4789,10 @@ GfxGouraudTriangleShading *GfxGouraudTriangleShading::parse(GfxResources *res, i error(errSyntaxWarning, -1, "Missing or invalid BitsPerCoordinate in shading dictionary"); return nullptr; } + if (unlikely(coordBits <= 0)) { + error(errSyntaxWarning, -1, "Invalid BitsPerCoordinate in shading dictionary"); + return nullptr; + } obj1 = dict->lookup("BitsPerComponent"); if (obj1.isInt()) { compBits = obj1.getInt(); @@ -4778,6 +4800,10 @@ GfxGouraudTriangleShading *GfxGouraudTriangleShading::parse(GfxResources *res, i error(errSyntaxWarning, -1, "Missing or invalid BitsPerComponent in shading dictionary"); return nullptr; } + if (unlikely(compBits <= 0 || compBits > 31)) { + error(errSyntaxWarning, -1, "Invalid BitsPerComponent in shading dictionary"); + return nullptr; + } flagBits = vertsPerRow = 0; // make gcc happy if (typeA == 4) { obj1 = dict->lookup("BitsPerFlag"); @@ -4809,7 +4835,7 @@ GfxGouraudTriangleShading *GfxGouraudTriangleShading::parse(GfxResources *res, i for (i = 0; 5 + 2*i < obj1.arrayGetLength() && i < gfxColorMaxComps; ++i) { cMin[i] = (obj2 = obj1.arrayGet(4 + 2*i), obj2.getNum(&decodeOk)); cMax[i] = (obj2 = obj1.arrayGet(5 + 2*i), obj2.getNum(&decodeOk)); - cMul[i] = (cMax[i] - cMin[i]) / (double)((1 << compBits) - 1); + cMul[i] = (cMax[i] - cMin[i]) / (double)((1u << compBits) - 1); } nComps = i; @@ -5119,6 +5145,10 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di error(errSyntaxWarning, -1, "Missing or invalid BitsPerCoordinate in shading dictionary"); return nullptr; } + if (unlikely(coordBits <= 0)) { + error(errSyntaxWarning, -1, "Invalid BitsPerCoordinate in shading dictionary"); + return nullptr; + } obj1 = dict->lookup("BitsPerComponent"); if (obj1.isInt()) { compBits = obj1.getInt(); @@ -5126,6 +5156,10 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di error(errSyntaxWarning, -1, "Missing or invalid BitsPerComponent in shading dictionary"); return nullptr; } + if (unlikely(compBits <= 0 || compBits > 31)) { + error(errSyntaxWarning, -1, "Invalid BitsPerComponent in shading dictionary"); + return nullptr; + } obj1 = dict->lookup("BitsPerFlag"); if (obj1.isInt()) { flagBits = obj1.getInt(); @@ -5146,7 +5180,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di for (i = 0; 5 + 2*i < obj1.arrayGetLength() && i < gfxColorMaxComps; ++i) { cMin[i] = (obj2 = obj1.arrayGet(4 + 2*i), obj2.getNum(&decodeOk)); cMax[i] = (obj2 = obj1.arrayGet(5 + 2*i), obj2.getNum(&decodeOk)); - cMul[i] = (cMax[i] - cMin[i]) / (double)((1 << compBits) - 1); + cMul[i] = (cMax[i] - cMin[i]) / (double)((1u << compBits) - 1); } nComps = i; @@ -5283,6 +5317,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di case 1: if (nPatchesA == 0) { gfree(patchesA); + for (int k = 0; k < nFuncsA; ++k) delete funcsA[k]; return nullptr; } p->x[0][0] = patchesA[nPatchesA-1].x[0][3]; @@ -5319,6 +5354,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di case 2: if (nPatchesA == 0) { gfree(patchesA); + for (int k = 0; k < nFuncsA; ++k) delete funcsA[k]; return nullptr; } p->x[0][0] = patchesA[nPatchesA-1].x[3][3]; @@ -5355,6 +5391,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di case 3: if (nPatchesA == 0) { gfree(patchesA); + for (int k = 0; k < nFuncsA; ++k) delete funcsA[k]; return nullptr; } p->x[0][0] = patchesA[nPatchesA-1].x[3][0]; @@ -5434,6 +5471,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di case 1: if (nPatchesA == 0) { gfree(patchesA); + for (int k = 0; k < nFuncsA; ++k) delete funcsA[k]; return nullptr; } p->x[0][0] = patchesA[nPatchesA-1].x[0][3]; @@ -5478,6 +5516,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di case 2: if (nPatchesA == 0) { gfree(patchesA); + for (int k = 0; k < nFuncsA; ++k) delete funcsA[k]; return nullptr; } p->x[0][0] = patchesA[nPatchesA-1].x[3][3]; @@ -5522,6 +5561,7 @@ GfxPatchMeshShading *GfxPatchMeshShading::parse(GfxResources *res, int typeA, Di case 3: if (nPatchesA == 0) { gfree(patchesA); + for (int k = 0; k < nFuncsA; ++k) delete funcsA[k]; return nullptr; } p->x[0][0] = patchesA[nPatchesA-1].x[3][0]; @@ -5651,7 +5691,7 @@ GfxImageColorMap::GfxImageColorMap(int bitsA, Object *decode, Guchar *indexedLookup; Function *sepFunc; double x[gfxColorMaxComps]; - double y[gfxColorMaxComps]; + double y[gfxColorMaxComps] = {}; int i, j, k; double mapped; GBool useByteLookup; @@ -5677,6 +5717,9 @@ GfxImageColorMap::GfxImageColorMap(int bitsA, Object *decode, } byte_lookup = nullptr; + if (unlikely(bits <= 0)) + goto err1; + // get decode map if (decode->isNull()) { nComps = colorSpace->getNComps(); @@ -6745,10 +6788,18 @@ void GfxState::setPath(GfxPath *pathA) { void GfxState::getUserClipBBox(double *xMin, double *yMin, double *xMax, double *yMax) { double ictm[6]; - double xMin1, yMin1, xMax1, yMax1, det, tx, ty; + double xMin1, yMin1, xMax1, yMax1, tx, ty; // invert the CTM - det = 1 / (ctm[0] * ctm[3] - ctm[1] * ctm[2]); + const double det_denominator = (ctm[0] * ctm[3] - ctm[1] * ctm[2]); + if (unlikely(det_denominator == 0)) { + *xMin = 0; + *yMin = 0; + *xMax = 0; + *yMax = 0; + return; + } + const double det = 1 / det_denominator; ictm[0] = ctm[3] * det; ictm[1] = -ctm[1] * det; ictm[2] = -ctm[2] * det; diff --git a/Build/source/libs/poppler/poppler-src/poppler/GfxState.h b/Build/source/libs/poppler/poppler-src/poppler/GfxState.h index 6f4ae9a7c90..cd109045472 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/GfxState.h +++ b/Build/source/libs/poppler/poppler-src/poppler/GfxState.h @@ -915,7 +915,9 @@ public: GBool getExtend1() { return extend1; } int getNFuncs() { return nFuncs; } Function *getFunc(int i) { return funcs[i]; } - void getColor(double t, GfxColor *color); + // returns the nComps of the shading + // i.e. how many positions of color have been set + int getColor(double t, GfxColor *color); void setupCache(const Matrix *ctm, double xMin, double yMin, diff --git a/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc b/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc index 2d8ecad74c3..6d8941ea3bc 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/GlobalParams.cc @@ -1296,9 +1296,12 @@ GooString *GlobalParams::findSystemFontFile(GfxFont *font, SysFontInfo *fi; GooString *path; + const GooString *fontName = font->getName(); + if (!fontName) return nullptr; + path = NULL; lockGlobalParams; - if ((fi = sysFonts->find(font->getName(), font->isFixedWidth(), gFalse))) { + if ((fi = sysFonts->find(fontName, font->isFixedWidth(), gFalse))) { path = fi->path->copy(); *type = fi->type; *fontNum = fi->fontNum; diff --git a/Build/source/libs/poppler/poppler-src/poppler/Hints.cc b/Build/source/libs/poppler/poppler-src/poppler/Hints.cc index 2f5fec6ccdd..ecee04681c6 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Hints.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Hints.cc @@ -5,7 +5,7 @@ // This file is licensed under the GPLv2 or later // // Copyright 2010, 2012 Hib Eris -// Copyright 2010, 2011, 2013, 2014, 2016, 2017 Albert Astals Cid +// Copyright 2010, 2011, 2013, 2014, 2016-2018 Albert Astals Cid // Copyright 2010, 2013 Pino Toscano // Copyright 2013 Adrian Johnson // Copyright 2014 Fabio D'Urso @@ -258,6 +258,11 @@ GBool Hints::readPageOffsetTable(Stream *str) if (objectOffsetFirst >= hintsOffset) objectOffsetFirst += hintsLength; nBitsDiffObjects = sbr.readBits(16); + if (nBitsDiffObjects > 32) { + error(errSyntaxWarning, -1, "Invalid number of bits needed to represent the difference between the greatest and least number of objects in a page"); + nPages = 0; + return gFalse; + } pageLengthLeast = sbr.readBits(32); diff --git a/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc b/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc index ac7e7382c73..2ed787e0510 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/JBIG2Stream.cc @@ -1562,7 +1562,7 @@ GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint length, JBIG2Bitmap *collBitmap, *refBitmap; Guint *symWidths; Guint symHeight, symWidth, totalWidth, x, symID; - int dh, dw, refAggNum, refDX, refDY, bmSize; + int dh = 0, dw, refAggNum, refDX = 0, refDY = 0, bmSize; GBool ex; int run, cnt, c; Guint i, j, k; @@ -1896,6 +1896,7 @@ GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint length, } for (k = 0; k < (Guint)bmSize; ++k) { if ((c = curStr->getChar()) == EOF) { + memset(p, 0, bmSize - k); break; } *p++ = (Guchar)c; @@ -1930,6 +1931,8 @@ GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint length, // exported symbol list i = j = 0; ex = gFalse; + run = 0; // initialize it once in case the first decodeInt fails + // we do not want to use uninitialized memory while (i < numInputSyms + numNewSyms) { if (huff) { huffDecoder->decodeInt(&run, huffTableA); @@ -2335,8 +2338,8 @@ JBIG2Bitmap *JBIG2Stream::readTextRegion(GBool huff, GBool refine, JBIG2Bitmap *bitmap; JBIG2Bitmap *symbolBitmap; Guint strips; - int t, dt, tt, s, ds, sFirst, j; - int rdw, rdh, rdx, rdy, ri, refDX, refDY, bmSize; + int t = 0, dt = 0, tt, s, ds = 0, sFirst, j; + int rdw, rdh, rdx, rdy, ri = 0, refDX, refDY, bmSize; Guint symID, inst, bw, bh; strips = 1 << logStrips; @@ -4023,6 +4026,7 @@ void JBIG2Stream::readPageInfoSeg(Guint length) { } else { curPageH = pageH; } + delete pageBitmap; pageBitmap = new JBIG2Bitmap(0, pageW, curPageH); if (!pageBitmap->isOk()) { diff --git a/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc b/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc index a5090838e07..9ae19c34ae7 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Lexer.cc @@ -206,7 +206,7 @@ Object Lexer::getObj(int objNum) { xf = xf * 10.0 + (c - '0'); } else if (unlikely (overflownInteger)) { if (unlikely(xll > LongLongSafeLimit) && - (xll > (LLONG_MAX - (c - '0')) / 10.0)) { + (xll > (LLONG_MAX - (c - '0')) / 10)) { overflownLongLong = gTrue; xf = xll * 10.0 + (c - '0'); } else { diff --git a/Build/source/libs/poppler/poppler-src/poppler/Parser.cc b/Build/source/libs/poppler/poppler-src/poppler/Parser.cc index 869e94ad0c8..39c9a96720b 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Parser.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Parser.cc @@ -13,7 +13,7 @@ // All changes made under the Poppler project to this file are licensed // under GPL version 2 or later // -// Copyright (C) 2006, 2009, 201, 2010, 2013, 2014, 2017 Albert Astals Cid +// Copyright (C) 2006, 2009, 201, 2010, 2013, 2014, 2017, 2018 Albert Astals Cid // Copyright (C) 2006 Krzysztof Kowalczyk // Copyright (C) 2009 Ilya Gorenbein // Copyright (C) 2012 Hib Eris @@ -235,6 +235,12 @@ Stream *Parser::makeStream(Object &&dict, Guchar *fileKey, pos = pos - 1; lexer->lookCharLastValueCached = Lexer::LOOK_VALUE_NOT_CACHED; } + if (unlikely(length < 0)) { + return nullptr; + } + if (unlikely(pos > LLONG_MAX - length)) { + return nullptr; + } lexer->setPos(pos + length); // refill token buffers and check for 'endstream' @@ -255,7 +261,8 @@ Stream *Parser::makeStream(Object &&dict, Guchar *fileKey, // When building the xref we can't use it so use this // kludge for broken PDF files: just add 5k to the length, and // hope its enough - length += 5000; + if (length < LLONG_MAX - 5000) + length += 5000; } } diff --git a/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc b/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc index a643f45fa3a..bdfd89f8650 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/SecurityHandler.cc @@ -315,6 +315,9 @@ StandardSecurityHandler::~StandardSecurityHandler() { } GBool StandardSecurityHandler::isUnencrypted() { + if (!ok) { + return gTrue; + } return encVersion == -1 && encRevision == -1; } diff --git a/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc b/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc index a19e8c66e38..74953839a30 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/SplashOutputDev.cc @@ -39,6 +39,7 @@ // Copyright (C) 2016 Takahiro Hashimoto // Copyright (C) 2017 Even Rouault // Copyright (C) 2018 Klarälvdalens Datakonsult AB, a KDAB Group company, . Work sponsored by the LiMux project of the city of Munich +// Copyright (C) 2018 Stefan Brüns // // To see a description of the changes please see the Changelog file that // came with your tarball or type make ChangeLog if you are building from git @@ -315,7 +316,11 @@ GBool SplashUnivariatePattern::getColor(int x, int y, SplashColorPtr c) { if (! getParameter (xc, yc, &t)) return gFalse; - shading->getColor(t, &gfxColor); + const int filled = shading->getColor(t, &gfxColor); + if (unlikely(filled < shading->getColorSpace()->getNComps())) { + for (int i = filled; i < shading->getColorSpace()->getNComps(); ++i) + gfxColor.c[i] = 0; + } convertGfxColor(c, colorMode, shading->getColorSpace(), &gfxColor); return gTrue; } @@ -453,7 +458,12 @@ SplashAxialPattern::SplashAxialPattern(SplashColorMode colorModeA, GfxState *sta shadingA->getCoords(&x0, &y0, &x1, &y1); dx = x1 - x0; dy = y1 - y0; - mul = 1 / (dx * dx + dy * dy); + const double mul_denominator = (dx * dx + dy * dy); + if (unlikely(mul_denominator == 0)) { + mul = 0; + } else { + mul = 1 / mul_denominator; + } shadingA->getColorSpace()->getDefaultColor(&srcColor); convertGfxColor(defaultColor, colorModeA, shadingA->getColorSpace(), &srcColor); } @@ -1251,7 +1261,6 @@ T3FontCache::T3FontCache(const Ref *fontIDA, double m11A, double m12A, double m21A, double m22A, int glyphXA, int glyphYA, int glyphWA, int glyphHA, GBool validBBoxA, GBool aa) { - int i; fontID = *fontIDA; m11 = m11A; @@ -1265,8 +1274,7 @@ T3FontCache::T3FontCache(const Ref *fontIDA, double m11A, double m12A, validBBox = validBBoxA; // sanity check for excessively large glyphs (which most likely // indicate an incorrect BBox) - i = glyphW * glyphH; - if (i > 100000 || glyphW > INT_MAX / glyphH || glyphW <= 0 || glyphH <= 0) { + if (glyphW > INT_MAX / glyphH || glyphW <= 0 || glyphH <= 0 || glyphW * glyphH > 100000) { glyphW = glyphH = 100; validBBox = gFalse; } @@ -1293,7 +1301,7 @@ T3FontCache::T3FontCache(const Ref *fontIDA, double m11A, double m12A, { cacheTags = (T3FontCacheTag *)gmallocn(cacheSets * cacheAssoc, sizeof(T3FontCacheTag)); - for (i = 0; i < cacheSets * cacheAssoc; ++i) { + for (int i = 0; i < cacheSets * cacheAssoc; ++i) { cacheTags[i].mru = i & (cacheAssoc - 1); } } @@ -1445,6 +1453,7 @@ SplashOutputDev::~SplashOutputDev() { if (bitmap) { delete bitmap; } + delete textClipPath; } void SplashOutputDev::startDoc(PDFDoc *docA) { @@ -2360,6 +2369,7 @@ SplashPath *SplashOutputDev::convertPath(GfxState *state, GfxPath *path, for (i = 0; i < path->getNumSubpaths(); ++i) { subpath = path->getSubpath(i); if (subpath->getNumPoints() > n) { + sPath->reserve(subpath->getNumPoints() + 1); sPath->moveTo((SplashCoord)subpath->getX(0), (SplashCoord)subpath->getY(0)); j = 1; @@ -3982,11 +3992,15 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref, //----- set up the soft mask if (maskColorMap->getMatteColor() != nullptr) { - Guchar *data = (Guchar *) gmalloc(maskWidth * maskHeight); + const int maskChars = maskWidth * maskHeight; + Guchar *data = (Guchar *) gmalloc(maskChars); maskStr->reset(); - maskStr->doGetChars(maskWidth * maskHeight, data); + const int readChars = maskStr->doGetChars(maskChars, data); + if (unlikely(readChars < maskChars)) { + memset(&data[readChars], 0, maskChars - readChars); + } maskStr->close(); - maskStr = new AutoFreeMemStream((char *)data, 0, maskWidth * maskHeight, maskStr->getDictObject()->copy()); + maskStr = new AutoFreeMemStream((char *)data, 0, maskChars, maskStr->getDictObject()->copy()); } imgMaskData.imgStr = new ImageStream(maskStr, maskWidth, maskColorMap->getNumPixelComps(), diff --git a/Build/source/libs/poppler/poppler-src/poppler/Stream.cc b/Build/source/libs/poppler/poppler-src/poppler/Stream.cc index 15a6a9f9aa1..21bd3b9bdde 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Stream.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/Stream.cc @@ -28,7 +28,7 @@ // Copyright (C) 2012 Fabio D'Urso // Copyright (C) 2012 Even Rouault // Copyright (C) 2013, 2017, 2018 Adrian Johnson -// Copyright (C) 2013 Adam Reichold +// Copyright (C) 2013, 2018 Adam Reichold // Copyright (C) 2013 Pino Toscano // Copyright (C) 2015 Suzuki Toshiya // Copyright (C) 2015 Jason Crain @@ -572,8 +572,6 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA, ok = gFalse; nVals = width * nComps; - pixBytes = (nComps * nBits + 7) >> 3; - rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; if (width <= 0 || nComps <= 0 || nBits <= 0 || nComps > gfxColorMaxComps || nBits > 16 || @@ -581,6 +579,8 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA, nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes return; } + pixBytes = (nComps * nBits + 7) >> 3; + rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; predLine = (Guchar *)gmalloc(rowBytes); memset(predLine, 0, rowBytes); predIdx = rowBytes; @@ -1435,6 +1435,7 @@ void LZWStream::clearTable() { nextBits = 9; seqIndex = seqLength = 0; first = gTrue; + newChar = 0; } int LZWStream::getCode() { @@ -1444,10 +1445,10 @@ int LZWStream::getCode() { while (inputBits < nextBits) { if ((c = str->getChar()) == EOF) return EOF; - inputBuf = (inputBuf << 8) | (c & 0xff); + inputBuf = (inputBuf << 8) | static_cast(c & 0xff); inputBits += 8; } - code = (inputBuf >> (inputBits - nextBits)) & ((1 << nextBits) - 1); + code = static_cast((inputBuf >> (inputBits - nextBits)) & ((1 << nextBits) - 1)); inputBits -= nextBits; return code; } diff --git a/Build/source/libs/poppler/poppler-src/poppler/Stream.h b/Build/source/libs/poppler/poppler-src/poppler/Stream.h index a3faccd9b75..841c87a8c33 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/Stream.h +++ b/Build/source/libs/poppler/poppler-src/poppler/Stream.h @@ -24,7 +24,7 @@ // Copyright (C) 2012, 2013 Fabio D'Urso // Copyright (C) 2013, 2017 Adrian Johnson // Copyright (C) 2013 Peter Breitenlohner -// Copyright (C) 2013 Adam Reichold +// Copyright (C) 2013, 2018 Adam Reichold // Copyright (C) 2013 Pino Toscano // // To see a description of the changes please see the Changelog file that @@ -823,7 +823,7 @@ private: StreamPredictor *pred; // predictor int early; // early parameter GBool eof; // true if at eof - int inputBuf; // input buffer + unsigned int inputBuf; // input buffer int inputBits; // number of bits in input buffer struct { // decoding table int length; diff --git a/Build/source/libs/poppler/poppler-src/poppler/XRef.cc b/Build/source/libs/poppler/poppler-src/poppler/XRef.cc index 25bc18a4452..95e1a1d45b5 100644 --- a/Build/source/libs/poppler/poppler-src/poppler/XRef.cc +++ b/Build/source/libs/poppler/poppler-src/poppler/XRef.cc @@ -574,7 +574,7 @@ GBool XRef::readXRefTable(Parser *parser, Goffset *pos, std::vector *fo goto err0; } n = obj.getInt(); - if (first < 0 || n < 0 || first + n < 0) { + if (first < 0 || n < 0 || first > INT_MAX - n) { goto err0; } if (first + n > size) { @@ -789,6 +789,9 @@ GBool XRef::readXRefStreamSection(Stream *xrefStr, int *w, int first, int n) { unsigned long long offset, gen; int type, c, i, j; + if (first > INT_MAX - n) { + return gFalse; + } if (first + n < 0) { return gFalse; } @@ -866,7 +869,6 @@ GBool XRef::constructXRef(GBool *wasReconstructed, GBool needCatalogDict) { char buf[256]; Goffset pos; int num, gen; - int newSize; int streamEndsSize; char *p; GBool gotRoot; @@ -961,7 +963,11 @@ GBool XRef::constructXRef(GBool *wasReconstructed, GBool needCatalogDict) { while (*p && isspace(*p & 0xff)) ++p; if (!strncmp(p, "obj", 3)) { if (num >= size) { - newSize = (num + 1 + 255) & ~255; + if (unlikely(num >= INT_MAX - 1 - 255)) { + error(errSyntaxError, -1, "Bad object number"); + return gFalse; + } + const int newSize = (num + 1 + 255) & ~255; if (newSize < 0) { error(errSyntaxError, -1, "Bad object number"); return gFalse; @@ -1135,7 +1141,7 @@ Object XRef::fetch(int num, int gen, int recursion) { case xrefEntryUncompressed: { - if (e->gen != gen) { + if (e->gen != gen || e->offset < 0) { goto err; } parser = new Parser(this, diff --git a/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h b/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h index ca0e3bc0916..1bede11cd5e 100644 --- a/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h +++ b/Build/source/libs/poppler/poppler-src/splash/SplashTypes.h @@ -17,6 +17,7 @@ // Copyright (C) 2009 Stefan Thomas // Copyright (C) 2010 William Bader // Copyright (C) 2017 Adrian Johnson +// Copyright (C) 2018 Stefan Brüns // // To see a description of the changes please see the Changelog file that // came with your tarball or type make ChangeLog if you are building from git @@ -126,7 +127,7 @@ static inline void splashClearColor(SplashColorPtr dest) { dest[2] = 0; #ifdef SPLASH_CMYK dest[3] = 0; - for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++) + for (int i = 4; i < SPOT_NCOMPS + 4; i++) dest[i] = 0; #endif } @@ -137,7 +138,7 @@ static inline void splashColorCopy(SplashColorPtr dest, SplashColorPtr src) { dest[2] = src[2]; #ifdef SPLASH_CMYK dest[3] = src[3]; - for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++) + for (int i = 4; i < SPOT_NCOMPS + 4; i++) dest[i] = src[i]; #endif } @@ -148,7 +149,7 @@ static inline void splashColorXor(SplashColorPtr dest, SplashColorPtr src) { dest[2] ^= src[2]; #ifdef SPLASH_CMYK dest[3] ^= src[3]; - for (int i = SPOT_NCOMPS; i < SPOT_NCOMPS + 4; i++) + for (int i = 4; i < SPOT_NCOMPS + 4; i++) dest[i] ^= src[i]; #endif } diff --git a/Build/source/libs/poppler/version.ac b/Build/source/libs/poppler/version.ac index 16b8835644d..195b90c5486 100644 --- a/Build/source/libs/poppler/version.ac +++ b/Build/source/libs/poppler/version.ac @@ -9,4 +9,4 @@ dnl dnl -------------------------------------------------------- dnl dnl m4-include this file to define the current poppler version -m4_define([poppler_version], [0.65.0]) +m4_define([poppler_version], [0.66.0]) -- cgit v1.2.3