Added a security patch to fix bug #114428.

(Portage version: 2.0.53)

2 files changed, 180 insertions, 0 deletions

diff --git a/app-text/xpdf/files/digest-xpdf-3.01-r2 b/app-text/xpdf/files/digest-xpdf-3.01-r2
new file mode 100644
index 000000000000..a9aeca0c2984
--- /dev/null
+++ b/app-text/xpdf/files/digest-xpdf-3.01-r2
@@ -0,0 +1,12 @@
+MD5 e004c69c7dddef165d768b1362b44268 xpdf-3.01.tar.gz 599778
+MD5 67f05f65bc64bf022b36138c7c26746d xpdf-arabic.tar.gz 1058
+MD5 713659f0282b9e3d169390e246e5eb74 xpdf-chinese-simplified.tar.gz 756127
+MD5 5be730b859f8b01de569eb1bad188426 xpdf-chinese-traditional.tar.gz 698902
+MD5 21f57122247e2e2a63bfed4dc4f6c199 xpdf-cyrillic.tar.gz 1286
+MD5 2240a364b9c28ce09fd8c3107784ce40 xpdf-greek.tar.gz 1124
+MD5 438dd417517641cbb78a94facf2d938e xpdf-hebrew.tar.gz 1314
+MD5 57bb9359437583479b6670e75fa06c31 xpdf-japanese.tar.gz 430478
+MD5 10cd92e4eef065a6a26341d9a2a1b5c2 xpdf-korean.tar.gz 419081
+MD5 ac19ef990cd63afd2837c10dc7e1c3ab xpdf-latin2.tar.gz 1435
+MD5 9af495766ee4eaf3411d1fa74560f0ec xpdf-thai.tar.gz 1876
+MD5 f9233880805e3d8d2cf15a4fe679f25b xpdf-turkish.tar.gz 1140
diff --git a/app-text/xpdf/files/xpdf-3.01pl1.patch b/app-text/xpdf/files/xpdf-3.01pl1.patch
new file mode 100644
index 000000000000..8b038ad56f0d
--- /dev/null
+++ b/app-text/xpdf/files/xpdf-3.01pl1.patch
@@ -0,0 +1,168 @@
+diff -c -r xpdf-3.01-orig/xpdf/JPXStream.cc xpdf-3.01/xpdf/JPXStream.cc
+*** xpdf-3.01-orig/xpdf/JPXStream.cc	Tue Aug 16 22:34:31 2005
+--- xpdf-3.01/xpdf/JPXStream.cc	Thu Nov  3 16:50:39 2005
+***************
+*** 783,789 ****
+    int segType;
+    GBool haveSIZ, haveCOD, haveQCD, haveSOT;
+    Guint precinctSize, style;
+!   Guint segLen, capabilities, comp, i, j, r;
+  
+    //----- main header
+    haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
+--- 783,789 ----
+    int segType;
+    GBool haveSIZ, haveCOD, haveQCD, haveSOT;
+    Guint precinctSize, style;
+!   Guint segLen, capabilities, nTiles, comp, i, j, r;
+  
+    //----- main header
+    haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
+***************
+*** 818,825 ****
+  	            / img.xTileSize;
+        img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
+  	            / img.yTileSize;
+!       img.tiles = (JPXTile *)gmallocn(img.nXTiles * img.nYTiles,
+! 				      sizeof(JPXTile));
+        for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
+  	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
+  							 sizeof(JPXTileComp));
+--- 818,830 ----
+  	            / img.xTileSize;
+        img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
+  	            / img.yTileSize;
+!       nTiles = img.nXTiles * img.nYTiles;
+!       // check for overflow before allocating memory
+!       if (nTiles == 0 || nTiles / img.nXTiles != img.nYTiles) {
+! 	error(getPos(), "Bad tile count in JPX SIZ marker segment");
+! 	return gFalse;
+!       }
+!       img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
+        for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
+  	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
+  							 sizeof(JPXTileComp));
+diff -c -r xpdf-3.01-orig/xpdf/Stream.cc xpdf-3.01/xpdf/Stream.cc
+*** xpdf-3.01-orig/xpdf/Stream.cc	Tue Aug 16 22:34:31 2005
+--- xpdf-3.01/xpdf/Stream.cc	Thu Nov  3 16:50:39 2005
+***************
+*** 401,418 ****
+  
+  StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
+  				 int widthA, int nCompsA, int nBitsA) {
+    str = strA;
+    predictor = predictorA;
+    width = widthA;
+    nComps = nCompsA;
+    nBits = nBitsA;
+  
+    nVals = width * nComps;
+    pixBytes = (nComps * nBits + 7) >> 3;
+!   rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+    predLine = (Guchar *)gmalloc(rowBytes);
+    memset(predLine, 0, rowBytes);
+    predIdx = rowBytes;
+  }
+  
+  StreamPredictor::~StreamPredictor() {
+--- 401,433 ----
+  
+  StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
+  				 int widthA, int nCompsA, int nBitsA) {
++   int totalBits;
++ 
+    str = strA;
+    predictor = predictorA;
+    width = widthA;
+    nComps = nCompsA;
+    nBits = nBitsA;
++   predLine = NULL;
++   ok = gFalse;
+  
+    nVals = width * nComps;
++   totalBits = nVals * nBits;
++   if (totalBits == 0 ||
++       (totalBits / nBits) / nComps != width ||
++       totalBits + 7 < 0) {
++     return;
++   }
+    pixBytes = (nComps * nBits + 7) >> 3;
+!   rowBytes = ((totalBits + 7) >> 3) + pixBytes;
+!   if (rowBytes < 0) {
+!     return;
+!   }
+    predLine = (Guchar *)gmalloc(rowBytes);
+    memset(predLine, 0, rowBytes);
+    predIdx = rowBytes;
++ 
++   ok = gTrue;
+  }
+  
+  StreamPredictor::~StreamPredictor() {
+***************
+*** 1004,1009 ****
+--- 1019,1028 ----
+      FilterStream(strA) {
+    if (predictor != 1) {
+      pred = new StreamPredictor(this, predictor, columns, colors, bits);
++     if (!pred->isOk()) {
++       delete pred;
++       pred = NULL;
++     }
+    } else {
+      pred = NULL;
+    }
+***************
+*** 2899,2904 ****
+--- 2918,2931 ----
+    height = read16();
+    width = read16();
+    numComps = str->getChar();
++   if (numComps <= 0 || numComps > 4) {
++     error(getPos(), "Bad number of components in DCT stream", prec);
++     return gFalse;
++   }
++   if (numComps <= 0 || numComps > 4) {
++     error(getPos(), "Bad number of components in DCT stream", prec);
++     return gFalse;
++   }
+    if (prec != 8) {
+      error(getPos(), "Bad DCT precision %d", prec);
+      return gFalse;
+***************
+*** 3827,3832 ****
+--- 3854,3863 ----
+      FilterStream(strA) {
+    if (predictor != 1) {
+      pred = new StreamPredictor(this, predictor, columns, colors, bits);
++     if (!pred->isOk()) {
++       delete pred;
++       pred = NULL;
++     }
+    } else {
+      pred = NULL;
+    }
+diff -c -r xpdf-3.01-orig/xpdf/Stream.h xpdf-3.01/xpdf/Stream.h
+*** xpdf-3.01-orig/xpdf/Stream.h	Tue Aug 16 22:34:31 2005
+--- xpdf-3.01/xpdf/Stream.h	Thu Nov  3 16:50:39 2005
+***************
+*** 232,237 ****
+--- 232,239 ----
+  
+    ~StreamPredictor();
+  
++   GBool isOk() { return ok; }
++ 
+    int lookChar();
+    int getChar();
+  
+***************
+*** 249,254 ****
+--- 251,257 ----
+    int rowBytes;			// bytes per line
+    Guchar *predLine;		// line buffer
+    int predIdx;			// current index in predLine
++   GBool ok;
+  };
+  
+  //------------------------------------------------------------------------