Version in base suite: 3.5.5-3etch2 Version in overlay suite: 3.5.5-3etch3 Base version: kdegraphics_3.5.5-3etch2 Target version: kdegraphics_3.5.5-3etch4 Base file: /org/ftp.debian.org/ftp/pool/main/k/kdegraphics/kdegraphics_3.5.5-3etch2.dsc Target file: /org/ftp.debian.org/queue/o-p-u-new/kdegraphics_3.5.5-3etch4.dsc debian/patches/15_CVE-2009-0146,0147,0165,0166,0799,0800,1179-1183.diff | 981 ++++++++++ debian/patches/fix-CVE-2009-0945.diff | 26 debian/patches/fix-CVE-2009-1709.diff | 88 kdegraphics-3.5.5/debian/changelog | 67 4 files changed, 1162 insertions(+) diff -u kdegraphics-3.5.5/debian/changelog kdegraphics-3.5.5/debian/changelog --- kdegraphics-3.5.5/debian/changelog +++ kdegraphics-3.5.5/debian/changelog @@ -1,3 +1,70 @@ +kdegraphics (4:3.5.5-3etch4) oldstable-security; urgency=high + + * Non-maintainer upload. + * Fixed CVE-2009-0945: Null-pointer dereference due to an array index error + was found in the KDE KSVG SVGList interface implementation. A remote + attacker could create a specially-crafted SVG image, which once opened by + an unsuspecting user, would cause memory corruption leading to a denial of + service (Konqueror crash). (Closes: #534918) + * Fixed CVE-2009-1709: A pointer use-after-free flaw was found in the KDE's + KSVG Scalable Vector Graphics (SVG) animation element implementation. + A remote attacker could use this flaw to cause a denial of service + (konqueror crash) or, potentially, execute arbitrary code, with the + privileges of the user running "konqueror" web browser, if the victim was + tricked to open a specially-crafted SVG image. (Closes: #534951) + + -- Giuseppe Iuculano Sun, 09 Aug 2009 19:46:13 +0200 + +kdegraphics (4:3.5.5-3etch3) oldstable-security; urgency=high + + * Non-maintainer upload by the security team + - CVE-2009-0146: Multiple buffer overflows in the JBIG2 decoder in Xpdf + 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow + remote attackers to cause a denial of service (crash) via a crafted PDF + file, related to (1) JBIG2SymbolDict::setBitmap and (2) + JBIG2Stream::readSymbolDictSeg. + - CVE-2009-0147: Multiple integer overflows in the JBIG2 decoder in Xpdf + 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow + remote attackers to cause a denial of service (crash) via a crafted PDF + file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) + JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap. + - CVE-2009-0165: Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and + earlier, as used in Poppler and other products, when running on Mac OS X, + has unspecified impact, related to "g*allocn." + - CVE-2009-0166: The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 + and earlier, and other products allows remote attackers to cause a denial + of service (crash) via a crafted PDF file that triggers a free of + uninitialized memory. + - CVE-2009-0799: The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 + and earlier, Poppler before 0.10.6, and other products allows remote + attackers to cause a denial of service (crash) via a crafted PDF file + that triggers an out-of-bounds read. + - CVE-2009-0800: Multiple "input validation flaws" in the JBIG2 decoder in + Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, + and other products allow remote attackers to execute arbitrary code via + a crafted PDF file. + - CVE-2009-1179: Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and + earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products + allows remote attackers to execute arbitrary code via a crafted PDF file. + - CVE-2009-1180: The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 + and earlier, Poppler before 0.10.6, and other products allows remote + attackers to execute arbitrary code via a crafted PDF file that triggers + a free of invalid data. + - CVE-2009-1181: The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 + and earlier, Poppler before 0.10.6, and other products allows remote + attackers to cause a denial of service (crash) via a crafted PDF file that + triggers a NULL pointer dereference. + - CVE-2009-1182: Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf + 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and + other products allow remote attackers to execute arbitrary code via a + crafted PDF file. + - CVE-2009-1183: The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS + 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote + attackers to cause a denial of service (infinite loop and hang) via a + crafted PDF file. + + -- Noah Meyerhans Tue, 05 May 2009 09:45:16 -0400 + kdegraphics (4:3.5.5-3etch2) stable-security; urgency=low * Fix CVE-2007-4352, CVE-2007-5392 and CVE-2007-5493. only in patch2: unchanged: --- kdegraphics-3.5.5.orig/debian/patches/fix-CVE-2009-1709.diff +++ kdegraphics-3.5.5/debian/patches/fix-CVE-2009-1709.diff @@ -0,0 +1,88 @@ +--- a/ksvg/core/DocumentFactory.cpp ++++ b/ksvg/core/DocumentFactory.cpp +@@ -38,7 +38,7 @@ namespace KSVG + Private() { m_docs.setAutoDelete(true); } + ~Private() { m_docs.clear(); } + +- void setup(bool bFit) { m_docs.append(new SVGDocumentImpl(!bFit /* animations */, bFit)); } ++ void setup(bool bFit) { m_docs.append(new SVGDocumentImpl(false /* animations */, bFit)); } + SVGDocumentImpl *doc() const { return m_docs.current(); } + + private: +--- a/ksvg/impl/SVGAnimationElementImpl.cc ++++ b/ksvg/impl/SVGAnimationElementImpl.cc +@@ -43,7 +43,6 @@ SVGAnimationElementImpl::SVGAnimationEle + KSVG_EMPTY_FLAGS + + m_connected = false; +- m_targetElement = 0; + + m_values = new SVGStringListImpl(); + m_keyTimes= new SVGStringListImpl(); +@@ -56,22 +55,18 @@ SVGAnimationElementImpl::SVGAnimationEle + + SVGAnimationElementImpl::~SVGAnimationElementImpl() + { +- if(m_targetElement) +- m_targetElement->deref(); + } + + SVGElementImpl *SVGAnimationElementImpl::targetElement() const + { +- if(!m_targetElement) ++ if (ownerDoc()) + { +- SVGAnimationElementImpl *modify = const_cast(this); +- if(!m_href.isEmpty()) +- modify->setTargetElement(ownerDoc()->getElementByIdRecursive(ownerSVGElement(), SVGURIReferenceImpl::getTarget(m_href))); +- else if(!parentNode().isNull()) +- modify->setTargetElement(ownerDoc()->getElementFromHandle(parentNode().handle())); ++ if (!m_href.isEmpty()) ++ return ownerDoc()->getElementByIdRecursive(ownerSVGElement(), SVGURIReferenceImpl::getTarget(m_href)); ++ else if (!parentNode().isNull()) ++ return ownerDoc()->getElementFromHandle(parentNode().handle()); + } +- +- return m_targetElement; ++ return 0; + } + + double SVGAnimationElementImpl::parseClockValue(const QString &data) const +@@ -215,7 +210,6 @@ Value SVGAnimationElementImpl::getValueP + switch(token) + { + case TargetElement: +- return m_targetElement->cache(exec); + default: + kdWarning() << "Unhandled token in " << k_funcinfo << " : " << token << endl; + return Undefined(); +@@ -384,7 +378,6 @@ void SVGAnimationElementImpl::putValuePr + Value SVGAnimationElementImplProtoFunc::call(ExecState *exec, Object &thisObj, const List &) + { + KSVG_CHECK_THIS(SVGAnimationElementImpl) +- + switch(id) + { + case SVGAnimationElementImpl::GetStartTime: +@@ -420,11 +413,6 @@ void SVGAnimationElementImpl::setAttribu + + void SVGAnimationElementImpl::setTargetElement(SVGElementImpl *target) + { +- if(m_targetElement) +- m_targetElement->deref(); +- +- m_targetElement = target; +- m_targetElement->ref(); + } + + void SVGAnimationElementImpl::applyAttribute(const QString &name, const QString &value) +--- a/ksvg/impl/SVGAnimationElementImpl.h ++++ b/ksvg/impl/SVGAnimationElementImpl.h +@@ -108,7 +108,6 @@ protected: + ECalcMode m_calcMode : 2; + ERestart m_restart : 2; + EAttributeType m_attributeType : 2; +- SVGElementImpl *m_targetElement; + + QString m_href; + QString m_attributeName; only in patch2: unchanged: --- kdegraphics-3.5.5.orig/debian/patches/15_CVE-2009-0146,0147,0165,0166,0799,0800,1179-1183.diff +++ kdegraphics-3.5.5/debian/patches/15_CVE-2009-0146,0147,0165,0166,0799,0800,1179-1183.diff @@ -0,0 +1,981 @@ +diff -Nur -x '*.orig' -x '*~' kdegraphics-3.5.5/kpdf/xpdf/goo/gmem.c kdegraphics-3.5.5.new/kpdf/xpdf/goo/gmem.c +--- kdegraphics-3.5.5/kpdf/xpdf/goo/gmem.c 2006-01-19 11:38:22.000000000 -0500 ++++ kdegraphics-3.5.5.new/kpdf/xpdf/goo/gmem.c 2009-05-05 18:13:19.000000000 -0400 +@@ -55,7 +55,7 @@ + + #endif /* DEBUG_MEM */ + +-void *gmalloc(size_t size) { ++void *gmalloc(int size) GMEM_EXCEP { + #ifdef DEBUG_MEM + size_t size1; + char *mem; +@@ -64,6 +64,15 @@ + int lst; + unsigned long *trl, *p; + ++ if (size < 0) { ++#if USE_EXCEPTIONS ++ throw GMemException(); ++#else ++ fprintf(stderr, "Invalid memory allocation size\n"); ++ exit(1); ++#endif ++ } ++ + if (size == 0) + return NULL; + size1 = gMemDataSize(size); +@@ -87,6 +96,15 @@ + #else + void *p; + ++ if (size < 0) { ++#if USE_EXCEPTIONS ++ throw GMemException(); ++#else ++ fprintf(stderr, "Invalid memory allocation size\n"); ++ exit(1); ++#endif ++ } ++ + if (size == 0) + return NULL; + if (!(p = malloc(size))) { +@@ -97,12 +115,21 @@ + #endif + } + +-void *grealloc(void *p, size_t size) { ++void *grealloc(void *p, int size) GMEM_EXCEP { + #ifdef DEBUG_MEM + GMemHdr *hdr; + void *q; + size_t oldSize; + ++ if (size < 0) { ++#if USE_EXCEPTIONS ++ throw GMemException(); ++#else ++ fprintf(stderr, "Invalid memory allocation size\n"); ++ exit(1); ++#endif ++ } ++ + if (size == 0) { + if (p) + gfree(p); +@@ -138,7 +165,7 @@ + #endif + } + +-void *gmallocn(int nObjs, int objSize) { ++void *gmallocn(int nObjs, int objSize) GMEM_EXCEP { + int n; + + n = nObjs * objSize; +@@ -149,7 +176,7 @@ + return gmalloc(n); + } + +-void *greallocn(void *p, int nObjs, int objSize) { ++void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP { + int n; + + n = nObjs * objSize; +diff -Nur -x '*.orig' -x '*~' kdegraphics-3.5.5/kpdf/xpdf/goo/gmem.h kdegraphics-3.5.5.new/kpdf/xpdf/goo/gmem.h +--- kdegraphics-3.5.5/kpdf/xpdf/goo/gmem.h 2005-09-10 04:18:43.000000000 -0400 ++++ kdegraphics-3.5.5.new/kpdf/xpdf/goo/gmem.h 2009-05-05 18:12:10.000000000 -0400 +@@ -10,6 +10,23 @@ + #define GMEM_H + + #include ++#include ++ ++#if USE_EXCEPTIONS ++ ++class GMemException { ++public: ++ GMemException() {} ++ ~GMemException() {} ++}; ++ ++#define GMEM_EXCEP throw(GMemException) ++ ++#else /* USE_EXCEPTIONS */ ++ ++#define GMEM_EXCEP ++ ++#endif /* USE_EXCEPTIONS */ + + #ifdef __cplusplus + extern "C" { +@@ -19,13 +36,13 @@ + * Same as malloc, but prints error message and exits if malloc() + * returns NULL. + */ +-extern void *gmalloc(size_t size); ++extern void *gmalloc(int size) GMEM_EXCEP; + + /* + * Same as realloc, but prints error message and exits if realloc() + * returns NULL. If

is NULL, calls malloc instead of realloc(). + */ +-extern void *grealloc(void *p, size_t size); ++extern void *grealloc(void *p, int size) GMEM_EXCEP; + + /* + * These are similar to gmalloc and grealloc, but take an object count +@@ -33,8 +50,8 @@ + * bytes, but there is an additional error check that the total size + * doesn't overflow an int. + */ +-extern void *gmallocn(int nObjs, int objSize); +-extern void *greallocn(void *p, int nObjs, int objSize); ++extern void *gmallocn(int nObjs, int objSize) GMEM_EXCEP; ++extern void *greallocn(void *p, int nObjs, int objSize) GMEM_EXCEP; + + /* + * Same as free, but checks for and ignores NULL pointers. +diff -Nur -x '*.orig' -x '*~' kdegraphics-3.5.5/kpdf/xpdf/xpdf/JBIG2Stream.cc kdegraphics-3.5.5.new/kpdf/xpdf/xpdf/JBIG2Stream.cc +--- kdegraphics-3.5.5/kpdf/xpdf/xpdf/JBIG2Stream.cc 2006-05-22 14:05:33.000000000 -0400 ++++ kdegraphics-3.5.5.new/kpdf/xpdf/xpdf/JBIG2Stream.cc 2009-05-05 18:10:55.000000000 -0400 +@@ -422,12 +422,14 @@ + table[i] = table[len]; + + // assign prefixes +- i = 0; +- prefix = 0; +- table[i++].prefix = prefix++; +- for (; table[i].rangeLen != jbig2HuffmanEOT; ++i) { +- prefix <<= table[i].prefixLen - table[i-1].prefixLen; +- table[i].prefix = prefix++; ++ if (table[0].rangeLen != jbig2HuffmanEOT) { ++ i = 0; ++ prefix = 0; ++ table[i++].prefix = prefix++; ++ for (; table[i].rangeLen != jbig2HuffmanEOT; ++i) { ++ prefix <<= table[i].prefixLen - table[i-1].prefixLen; ++ table[i].prefix = prefix++; ++ } + } + } + +@@ -507,7 +509,7 @@ + ++nBytesRead; + } + while (1) { +- if (bufLen >= 7 && ((buf >> (bufLen - 7)) & 0x7f) == 0) { ++ if (bufLen >= 11 && ((buf >> (bufLen - 7)) & 0x7f) == 0) { + if (bufLen <= 12) { + code = buf << (12 - bufLen); + } else { +@@ -550,14 +552,15 @@ + ++nBytesRead; + } + while (1) { +- if (bufLen >= 6 && ((buf >> (bufLen - 6)) & 0x3f) == 0) { ++ if (bufLen >= 10 && ((buf >> (bufLen - 6)) & 0x3f) == 0) { + if (bufLen <= 13) { + code = buf << (13 - bufLen); + } else { + code = buf >> (bufLen - 13); + } + p = &blackTab1[code & 0x7f]; +- } else if (bufLen >= 4 && ((buf >> (bufLen - 4)) & 0x0f) == 0) { ++ } else if (bufLen >= 7 && ((buf >> (bufLen - 4)) & 0x0f) == 0 && ++ ((buf >> (bufLen - 6)) & 0x03) != 0) { + if (bufLen <= 12) { + code = buf << (12 - bufLen); + } else { +@@ -682,10 +685,10 @@ + w = wA; + h = hA; + line = (wA + 7) >> 3; +- +- if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line ) { +- data = NULL; +- return; ++ if (w <= 0 || h <= 0 || line <= 0 || h >= (INT_MAX -1) / line) { ++ // force a call to gmalloc(-1), which will throw an exception ++ h = -1; ++ line = 2; + } + + // need to allocate one extra guard byte for use in combine() +@@ -701,8 +704,9 @@ + line = bitmap->line; + + if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) { +- data = NULL; +- return; ++ // force a call to gmalloc(-1), which will throw an exception ++ h = -1; ++ line = 2; + } + + // need to allocate one extra guard byte for use in combine() +@@ -759,6 +763,8 @@ + inline void JBIG2Bitmap::getPixelPtr(int x, int y, JBIG2BitmapPtr *ptr) { + if (y < 0 || y >= h || x >= w) { + ptr->p = NULL; ++ ptr->shift = 0; // make gcc happy ++ ptr->x = 0; // make gcc happy + } else if (x < 0) { + ptr->p = &data[y * line]; + ptr->shift = 7; +@@ -803,6 +809,10 @@ + Guint src0, src1, src, dest, s1, s2, m1, m2, m3; + GBool oneByte; + ++ // check for the pathological case where y = -2^31 ++ if (y < -0x7fffffff) { ++ return; ++ } + if (y < 0) { + y0 = -y; + } else { +@@ -1016,8 +1026,13 @@ + JBIG2SymbolDict::JBIG2SymbolDict(Guint segNumA, Guint sizeA): + JBIG2Segment(segNumA) + { ++ Guint i; ++ + size = sizeA; + bitmaps = (JBIG2Bitmap **)gmallocn(size, sizeof(JBIG2Bitmap *)); ++ for (i = 0; i < size; ++i) { ++ bitmaps[i] = NULL; ++ } + genericRegionStats = NULL; + refinementRegionStats = NULL; + } +@@ -1026,7 +1041,9 @@ + Guint i; + + for (i = 0; i < size; ++i) { +- delete bitmaps[i]; ++ if (bitmaps[i]) { ++ delete bitmaps[i]; ++ } + } + gfree(bitmaps); + if (genericRegionStats) { +@@ -1298,6 +1315,13 @@ + // keep track of the start of the segment data + segDataPos = getPos(); + ++ // check for missing page information segment ++ if (!pageBitmap && ((segType >= 4 && segType <= 7) || ++ (segType >= 20 && segType <= 43))) { ++ error(getPos(), "First JBIG2 segment associated with a page must be a page information segment"); ++ goto syntaxError; ++ } ++ + // read the segment data + switch (segType) { + case 0: +@@ -1452,6 +1476,8 @@ + Guint i, j, k; + Guchar *p; + ++ symWidths = NULL; ++ + // symbol dictionary flags + if (!readUWord(&flags)) { + goto eofError; +@@ -1507,20 +1533,32 @@ + codeTables = new GList(); + numInputSyms = 0; + for (i = 0; i < nRefSegs; ++i) { +- seg = findSegment(refSegs[i]); +- if (seg->getType() == jbig2SegSymbolDict) { +- numInputSyms += ((JBIG2SymbolDict *)seg)->getSize(); +- } else if (seg->getType() == jbig2SegCodeTable) { +- codeTables->append(seg); ++ if ((seg = findSegment(refSegs[i]))) { ++ if (seg->getType() == jbig2SegSymbolDict) { ++ j = ((JBIG2SymbolDict *)seg)->getSize(); ++ if (numInputSyms > UINT_MAX - j) { ++ error(getPos(), "Too many input symbols in JBIG2 symbol dictionary"); ++ delete codeTables; ++ goto eofError; ++ } ++ numInputSyms += j; ++ } else if (seg->getType() == jbig2SegCodeTable) { ++ codeTables->append(seg); ++ } + } + } ++ if (numInputSyms > UINT_MAX - numNewSyms) { ++ error(getPos(), "Too many input symbols in JBIG2 symbol dictionary"); ++ delete codeTables; ++ goto eofError; ++ } + + // compute symbol code length +- symCodeLen = 0; +- i = 1; +- while (i < numInputSyms + numNewSyms) { ++ symCodeLen = 1; ++ i = (numInputSyms + numNewSyms) >> 1; ++ while (i) { + ++symCodeLen; +- i <<= 1; ++ i >>= 1; + } + + // get the input symbol bitmaps +@@ -1532,13 +1570,14 @@ + k = 0; + inputSymbolDict = NULL; + for (i = 0; i < nRefSegs; ++i) { +- seg = findSegment(refSegs[i]); +- if (seg->getType() == jbig2SegSymbolDict) { +- inputSymbolDict = (JBIG2SymbolDict *)seg; +- for (j = 0; j < inputSymbolDict->getSize(); ++j) { +- bitmaps[k++] = inputSymbolDict->getBitmap(j); +- } +- } ++ if ((seg = findSegment(refSegs[i]))) { ++ if (seg->getType() == jbig2SegSymbolDict) { ++ inputSymbolDict = (JBIG2SymbolDict *)seg; ++ for (j = 0; j < inputSymbolDict->getSize(); ++j) { ++ bitmaps[k++] = inputSymbolDict->getBitmap(j); ++ } ++ } ++ } + } + + // get the Huffman tables +@@ -1551,6 +1590,9 @@ + } else if (huffDH == 1) { + huffDHTable = huffTableE; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffDW == 0) { +@@ -1558,17 +1600,26 @@ + } else if (huffDW == 1) { + huffDWTable = huffTableC; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffBMSize == 0) { + huffBMSizeTable = huffTableA; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffBMSizeTable = + ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffAggInst == 0) { + huffAggInstTable = huffTableA; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffAggInstTable = + ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } +@@ -1601,7 +1652,6 @@ + } + + // allocate symbol widths storage +- symWidths = NULL; + if (huff && !refAgg) { + symWidths = (Guint *)gmallocn(numNewSyms, sizeof(Guint)); + } +@@ -1643,6 +1693,10 @@ + goto syntaxError; + } + symWidth += dw; ++ if (i >= numNewSyms) { ++ error(getPos(), "Too many symbols in JBIG2 symbol dictionary"); ++ goto syntaxError; ++ } + + // using a collective bitmap, so don't read a bitmap here + if (huff && !refAgg) { +@@ -1679,6 +1733,10 @@ + arithDecoder->decodeInt(&refDX, iardxStats); + arithDecoder->decodeInt(&refDY, iardyStats); + } ++ if (symID >= numInputSyms + i) { ++ error(getPos(), "Invalid symbol ID in JBIG2 symbol dictionary"); ++ goto syntaxError; ++ } + refBitmap = bitmaps[symID]; + bitmaps[numInputSyms + i] = + readGenericRefinementRegion(symWidth, symHeight, +@@ -1745,6 +1803,12 @@ + } else { + arithDecoder->decodeInt(&run, iaexStats); + } ++ if (i + run > numInputSyms + numNewSyms || ++ j + run > numExSyms) { ++ error(getPos(), "Too many exported symbols in JBIG2 symbol dictionary"); ++ delete symbolDict; ++ goto syntaxError; ++ } + if (ex) { + for (cnt = 0; cnt < run; ++cnt) { + symbolDict->setBitmap(j++, bitmaps[i++]->copy()); +@@ -1754,6 +1818,11 @@ + } + ex = !ex; + } ++ if (j != numExSyms) { ++ error(getPos(), "Too few symbols in JBIG2 symbol dictionary"); ++ delete symbolDict; ++ goto syntaxError; ++ } + + for (i = 0; i < numNewSyms; ++i) { + delete bitmaps[numInputSyms + i]; +@@ -1776,6 +1845,10 @@ + + return gTrue; + ++ codeTableError: ++ error(getPos(), "Missing code table in JBIG2 symbol dictionary"); ++ delete codeTables; ++ + syntaxError: + for (i = 0; i < numNewSyms; ++i) { + if (bitmaps[numInputSyms + i]) { +@@ -1878,6 +1951,8 @@ + } + } else { + error(getPos(), "Invalid segment reference in JBIG2 text region"); ++ delete codeTables; ++ return; + } + } + symCodeLen = 0; +@@ -1912,6 +1987,9 @@ + } else if (huffFS == 1) { + huffFSTable = huffTableG; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffFSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffDS == 0) { +@@ -1921,6 +1999,9 @@ + } else if (huffDS == 2) { + huffDSTable = huffTableJ; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffDSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffDT == 0) { +@@ -1930,6 +2011,9 @@ + } else if (huffDT == 2) { + huffDTTable = huffTableM; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffDTTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffRDW == 0) { +@@ -1937,6 +2021,9 @@ + } else if (huffRDW == 1) { + huffRDWTable = huffTableO; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffRDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffRDH == 0) { +@@ -1944,6 +2031,9 @@ + } else if (huffRDH == 1) { + huffRDHTable = huffTableO; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffRDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffRDX == 0) { +@@ -1951,6 +2041,9 @@ + } else if (huffRDX == 1) { + huffRDXTable = huffTableO; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffRDXTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffRDY == 0) { +@@ -1958,11 +2051,17 @@ + } else if (huffRDY == 1) { + huffRDYTable = huffTableO; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffRDYTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } + if (huffRSize == 0) { + huffRSizeTable = huffTableA; + } else { ++ if (i >= (Guint)codeTables->getLength()) { ++ goto codeTableError; ++ } + huffRSizeTable = + ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable(); + } +@@ -1989,7 +2088,7 @@ + runLengthTab[35].prefixLen = 0; + runLengthTab[35].rangeLen = jbig2HuffmanEOT; + huffDecoder->buildTable(runLengthTab, 35); +- symCodeTab = (JBIG2HuffmanTable *)gmallocn(numSyms + 1, ++ symCodeTab = (JBIG2HuffmanTable *)gmallocn((numSyms + 1), + sizeof(JBIG2HuffmanTable)); + for (i = 0; i < numSyms; ++i) { + symCodeTab[i].val = i; +@@ -2057,8 +2156,15 @@ + + return; + ++ codeTableError: ++ error(getPos(), "Missing code table in JBIG2 text region"); ++ gfree(codeTables); ++ delete syms; ++ return; ++ + eofError: + error(getPos(), "Unexpected EOF in JBIG2 stream"); ++ return; + } + + JBIG2Bitmap *JBIG2Stream::readTextRegion(GBool huff, GBool refine, +@@ -2311,6 +2417,7 @@ + + eofError: + error(getPos(), "Unexpected EOF in JBIG2 stream"); ++ return; + } + + void JBIG2Stream::readHalftoneRegionSeg(Guint segNum, GBool imm, +@@ -2451,6 +2558,9 @@ + + delete skipBitmap; + gfree(grayImg); ++ if (skipBitmap) { ++ delete skipBitmap; ++ } + + // combine the region bitmap into the page bitmap + if (imm) { +@@ -2523,7 +2633,7 @@ + + // read the bitmap + bitmap = readGenericBitmap(mmr, w, h, templ, tpgdOn, gFalse, +- NULL, atx, aty, mmr ? 0 : length - 18); ++ NULL, atx, aty, mmr ? length - 18 : 0); + + // combine the region bitmap into the page bitmap + if (imm) { +@@ -2545,6 +2655,43 @@ + error(getPos(), "Unexpected EOF in JBIG2 stream"); + } + ++inline void JBIG2Stream::mmrAddPixels(int a1, int blackPixels, ++ int *codingLine, int *a0i, int w) { ++ if (a1 > codingLine[*a0i]) { ++ if (a1 > w) { ++ error(getPos(), "JBIG2 MMR row is wrong length ({0:d})", a1); ++ a1 = w; ++ } ++ if ((*a0i & 1) ^ blackPixels) { ++ ++*a0i; ++ } ++ codingLine[*a0i] = a1; ++ } ++} ++ ++inline void JBIG2Stream::mmrAddPixelsNeg(int a1, int blackPixels, ++ int *codingLine, int *a0i, int w) { ++ if (a1 > codingLine[*a0i]) { ++ if (a1 > w) { ++ error(getPos(), "JBIG2 MMR row is wrong length ({0:d})", a1); ++ a1 = w; ++ } ++ if ((*a0i & 1) ^ blackPixels) { ++ ++*a0i; ++ } ++ codingLine[*a0i] = a1; ++ } else if (a1 < codingLine[*a0i]) { ++ if (a1 < 0) { ++ error(getPos(), "Invalid JBIG2 MMR code"); ++ a1 = 0; ++ } ++ while (*a0i > 0 && a1 <= codingLine[*a0i - 1]) { ++ --*a0i; ++ } ++ codingLine[*a0i] = a1; ++ } ++} ++ + JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h, + int templ, GBool tpgdOn, + GBool useSkip, JBIG2Bitmap *skip, +@@ -2557,7 +2704,7 @@ + JBIG2BitmapPtr atPtr0, atPtr1, atPtr2, atPtr3; + int *refLine, *codingLine; + int code1, code2, code3; +- int x, y, a0, pix, i, refI, codingI; ++ int x, y, a0i, b1i, blackPixels, pix, i; + + bitmap = new JBIG2Bitmap(0, w, h); + bitmap->clearToZero(); +@@ -2567,9 +2714,14 @@ + if (mmr) { + + mmrDecoder->reset(); ++ if (w > INT_MAX - 2) { ++ error(getPos(), "Bad width in JBIG2 generic bitmap"); ++ // force a call to gmalloc(-1), which will throw an exception ++ w = -3; ++ } ++ codingLine = (int *)gmallocn(w + 1, sizeof(int)); + refLine = (int *)gmallocn(w + 2, sizeof(int)); +- codingLine = (int *)gmallocn(w + 2, sizeof(int)); +- codingLine[0] = codingLine[1] = w; ++ codingLine[0] = w; + + for (y = 0; y < h; ++y) { + +@@ -2577,128 +2729,157 @@ + for (i = 0; codingLine[i] < w; ++i) { + refLine[i] = codingLine[i]; + } +- refLine[i] = refLine[i + 1] = w; ++ refLine[i++] = w; ++ refLine[i] = w; + + // decode a line +- refI = 0; // b1 = refLine[refI] +- codingI = 0; // a1 = codingLine[codingI] +- a0 = 0; +- do { ++ codingLine[0] = 0; ++ a0i = 0; ++ b1i = 0; ++ blackPixels = 0; ++ // invariant: ++ // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] <= w ++ // exception at left edge: ++ // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible ++ // exception at right edge: ++ // refLine[b1i] = refLine[b1i+1] = w is possible ++ while (codingLine[a0i] < w) { + code1 = mmrDecoder->get2DCode(); + switch (code1) { + case twoDimPass: +- if (refLine[refI] < w) { +- a0 = refLine[refI + 1]; +- refI += 2; +- } +- break; ++ mmrAddPixels(refLine[b1i + 1], blackPixels, codingLine, &a0i, w); ++ if (refLine[b1i + 1] < w) { ++ b1i += 2; ++ } ++ break; + case twoDimHoriz: +- if (codingI & 1) { +- code1 = 0; +- do { +- code1 += code3 = mmrDecoder->getBlackCode(); +- } while (code3 >= 64); +- code2 = 0; +- do { +- code2 += code3 = mmrDecoder->getWhiteCode(); +- } while (code3 >= 64); +- } else { +- code1 = 0; +- do { +- code1 += code3 = mmrDecoder->getWhiteCode(); +- } while (code3 >= 64); +- code2 = 0; +- do { +- code2 += code3 = mmrDecoder->getBlackCode(); +- } while (code3 >= 64); +- } +- if (code1 > 0 || code2 > 0) { +- a0 = codingLine[codingI++] = a0 + code1; +- a0 = codingLine[codingI++] = a0 + code2; +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- } +- break; +- case twoDimVert0: +- a0 = codingLine[codingI++] = refLine[refI]; +- if (refLine[refI] < w) { +- ++refI; +- } +- break; +- case twoDimVertR1: +- a0 = codingLine[codingI++] = refLine[refI] + 1; +- if (refLine[refI] < w) { +- ++refI; +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- } +- break; +- case twoDimVertR2: +- a0 = codingLine[codingI++] = refLine[refI] + 2; +- if (refLine[refI] < w) { +- ++refI; +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- } +- break; ++ code1 = code2 = 0; ++ if (blackPixels) { ++ do { ++ code1 += code3 = mmrDecoder->getBlackCode(); ++ } while (code3 >= 64); ++ do { ++ code2 += code3 = mmrDecoder->getWhiteCode(); ++ } while (code3 >= 64); ++ } else { ++ do { ++ code1 += code3 = mmrDecoder->getWhiteCode(); ++ } while (code3 >= 64); ++ do { ++ code2 += code3 = mmrDecoder->getBlackCode(); ++ } while (code3 >= 64); ++ } ++ mmrAddPixels(codingLine[a0i] + code1, blackPixels, ++ codingLine, &a0i, w); ++ if (codingLine[a0i] < w) { ++ mmrAddPixels(codingLine[a0i] + code2, blackPixels ^ 1, ++ codingLine, &a0i, w); ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ break; + case twoDimVertR3: +- a0 = codingLine[codingI++] = refLine[refI] + 3; +- if (refLine[refI] < w) { +- ++refI; +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- } +- break; +- case twoDimVertL1: +- a0 = codingLine[codingI++] = refLine[refI] - 1; +- if (refI > 0) { +- --refI; +- } else { +- ++refI; +- } +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- break; +- case twoDimVertL2: +- a0 = codingLine[codingI++] = refLine[refI] - 2; +- if (refI > 0) { +- --refI; +- } else { +- ++refI; +- } +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- break; ++ mmrAddPixels(refLine[b1i] + 3, blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertR2: ++ mmrAddPixels(refLine[b1i] + 2, blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertR1: ++ mmrAddPixels(refLine[b1i] + 1, blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVert0: ++ mmrAddPixels(refLine[b1i], blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ ++b1i; ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; + case twoDimVertL3: +- a0 = codingLine[codingI++] = refLine[refI] - 3; +- if (refI > 0) { +- --refI; +- } else { +- ++refI; +- } +- while (refLine[refI] <= a0 && refLine[refI] < w) { +- refI += 2; +- } +- break; ++ mmrAddPixelsNeg(refLine[b1i] - 3, blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertL2: ++ mmrAddPixelsNeg(refLine[b1i] - 2, blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; ++ case twoDimVertL1: ++ mmrAddPixelsNeg(refLine[b1i] - 1, blackPixels, codingLine, &a0i, w); ++ blackPixels ^= 1; ++ if (codingLine[a0i] < w) { ++ if (b1i > 0) { ++ --b1i; ++ } else { ++ ++b1i; ++ } ++ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) { ++ b1i += 2; ++ } ++ } ++ break; ++ case EOF: ++ mmrAddPixels(w, 0, codingLine, &a0i, w); ++ break; + default: + error(getPos(), "Illegal code in JBIG2 MMR bitmap data"); ++ mmrAddPixels(w, 0, codingLine, &a0i, w); + break; + } +- } while (a0 < w); +- codingLine[codingI++] = w; ++ } + + // convert the run lengths to a bitmap line + i = 0; +- while (codingLine[i] < w) { ++ while (1) { + for (x = codingLine[i]; x < codingLine[i+1]; ++x) { + bitmap->setPixel(x, y); + } ++ if (codingLine[i+1] >= w || codingLine[i+2] >= w) { ++ break; ++ } + i += 2; + } + } +@@ -2746,7 +2927,9 @@ + ltp = !ltp; + } + if (ltp) { +- bitmap->duplicateRow(y, y-1); ++ if (y > 0) { ++ bitmap->duplicateRow(y, y-1); ++ } + continue; + } + } +@@ -2949,8 +3132,8 @@ + return; + } + if (nRefSegs == 1) { +- seg = findSegment(refSegs[0]); +- if (seg->getType() != jbig2SegBitmap) { ++ if (!(seg = findSegment(refSegs[0])) || ++ seg->getType() != jbig2SegBitmap) { + error(getPos(), "Bad bitmap reference in JBIG2 generic refinement segment"); + return; + } +@@ -3047,6 +3230,10 @@ + tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2); + tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2); + tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2); ++ } else { ++ tpgrCXPtr0.p = tpgrCXPtr1.p = tpgrCXPtr2.p = NULL; // make gcc happy ++ tpgrCXPtr0.shift = tpgrCXPtr1.shift = tpgrCXPtr2.shift = 0; ++ tpgrCXPtr0.x = tpgrCXPtr1.x = tpgrCXPtr2.x = 0; + } + + for (x = 0; x < w; ++x) { +@@ -3118,6 +3305,10 @@ + tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2); + tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2); + tpgrCX2 = (tpgrCX2 << 1) | refBitmap->nextPixel(&tpgrCXPtr2); ++ } else { ++ tpgrCXPtr0.p = tpgrCXPtr1.p = tpgrCXPtr2.p = NULL; // make gcc happy ++ tpgrCXPtr0.shift = tpgrCXPtr1.shift = tpgrCXPtr2.shift = 0; ++ tpgrCXPtr0.x = tpgrCXPtr1.x = tpgrCXPtr2.x = 0; + } + + for (x = 0; x < w; ++x) { +diff -Nur -x '*.orig' -x '*~' kdegraphics-3.5.5/kpdf/xpdf/xpdf/JBIG2Stream.h kdegraphics-3.5.5.new/kpdf/xpdf/xpdf/JBIG2Stream.h +--- kdegraphics-3.5.5/kpdf/xpdf/xpdf/JBIG2Stream.h 2005-09-10 04:18:43.000000000 -0400 ++++ kdegraphics-3.5.5.new/kpdf/xpdf/xpdf/JBIG2Stream.h 2009-05-05 18:10:55.000000000 -0400 +@@ -77,6 +77,10 @@ + Guint *refSegs, Guint nRefSegs); + void readGenericRegionSeg(Guint segNum, GBool imm, + GBool lossless, Guint length); ++ void mmrAddPixels(int a1, int blackPixels, ++ int *codingLine, int *a0i, int w); ++ void mmrAddPixelsNeg(int a1, int blackPixels, ++ int *codingLine, int *a0i, int w); + JBIG2Bitmap *readGenericBitmap(GBool mmr, int w, int h, + int templ, GBool tpgdOn, + GBool useSkip, JBIG2Bitmap *skip, only in patch2: unchanged: --- kdegraphics-3.5.5.orig/debian/patches/fix-CVE-2009-0945.diff +++ kdegraphics-3.5.5/debian/patches/fix-CVE-2009-0945.diff @@ -0,0 +1,26 @@ +--- a/ksvg/impl/SVGList.h ++++ b/ksvg/impl/SVGList.h +@@ -139,13 +139,23 @@ public: + switch(id) + { + case SVGListDefs::GetItem: ++ if (static_cast(args[0].toNumber(exec)) >= m_impl.count()) ++ return KJS::Undefined(); + return obj->getItem(static_cast(args[0].toNumber(exec)))->cache(exec); + case SVGListDefs::RemoveItem: ++ if (static_cast(args[0].toNumber(exec)) >= m_impl.count()) ++ return KJS::Undefined(); + return obj->removeItem(static_cast(args[0].toNumber(exec)))->cache(exec); + case SVGListDefs::AppendItem: + return obj->appendItem(static_cast *>(args[0].imp())->impl())->cache(exec); + case SVGListDefs::InsertItemBefore: ++ if (static_cast(args[1].toNumber(exec)) >= m_impl.count()) ++ return KJS::Undefined(); + return obj->insertItemBefore(static_cast *>(args[0].imp())->impl(), static_cast(args[1].toNumber(exec)))->cache(exec); ++ case SVGListDefs::ReplaceItem: ++ if (static_cast(args[1].toNumber(exec)) >= m_impl.count()) ++ return KJS::Undefined(); ++ return obj->replaceItem(static_cast *>(args[0].imp())->impl(), static_cast(args[1].toNumber(exec)))->cache(exec); + case SVGListDefs::Initialize: + return obj->initialize(static_cast *>(args[0].imp())->impl())->cache(exec); + case SVGListDefs::Clear: