Version in base suite: 3.2.8b-3+deb12u1 Base version: fig2dev_3.2.8b-3+deb12u1 Target version: fig2dev_3.2.8b-3+deb12u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/fig2dev/fig2dev_3.2.8b-3+deb12u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/fig2dev/fig2dev_3.2.8b-3+deb12u2.dsc changelog | 9 +++++ patches/41_CVE-2025-46397.patch | 52 ++++++++++++++++++++++++++++++++ patches/42_CVE-2025-46398.patch | 20 ++++++++++++ patches/43_CVE-2025-46399.patch | 27 ++++++++++++++++ patches/44_CVE-2025-46400.patch | 64 ++++++++++++++++++++++++++++++++++++++++ patches/series | 4 ++ 6 files changed, 176 insertions(+) diff -Nru fig2dev-3.2.8b/debian/changelog fig2dev-3.2.8b/debian/changelog --- fig2dev-3.2.8b/debian/changelog 2025-03-28 21:51:19.000000000 +0000 +++ fig2dev-3.2.8b/debian/changelog 2025-04-25 07:55:59.000000000 +0000 @@ -1,3 +1,12 @@ +fig2dev (1:3.2.8b-3+deb12u2) bookworm; urgency=medium + + * 41_CVE-2025-46397: Detect nan in spline control values. + * 42_CVE-2025-46398: Permit \0 in 2nd line in fig file. + * 43_CVE-2025-46399: ge output: correct spline computation. + * 44_CVE-2025-46400: Reject arcs with a radius smaller than 3. + + -- Roland Rosenfeld Fri, 25 Apr 2025 09:55:59 +0200 + fig2dev (1:3.2.8b-3+deb12u1) bookworm; urgency=medium * 38_CVE-2025-31162: Reject huge pattern lengths. diff -Nru fig2dev-3.2.8b/debian/patches/41_CVE-2025-46397.patch fig2dev-3.2.8b/debian/patches/41_CVE-2025-46397.patch --- fig2dev-3.2.8b/debian/patches/41_CVE-2025-46397.patch 1970-01-01 00:00:00.000000000 +0000 +++ fig2dev-3.2.8b/debian/patches/41_CVE-2025-46397.patch 2025-04-25 07:55:59.000000000 +0000 @@ -0,0 +1,52 @@ +From: Thomas Loimer +Date: Thu, 10 Apr 2025 09:03:30 +0200 +Origin: upstream, https://sourceforge.net/p/mcj/fig2dev/ci/dfa8b66 +Bug: https://sourceforge.net/p/mcj/tickets/192/ +Forwarded: not-needed +Subject: Detect nan in spline control values, ticket #192 + Fixes CVE-2025-46397 + +--- a/fig2dev/read.c ++++ b/fig2dev/read.c +@@ -1469,8 +1469,11 @@ read_splineobject(FILE *fp, char **restr + free_splinestorage(s); + return NULL; + } +- if (lx < INT_MIN || lx > INT_MAX || ly < INT_MIN || ly > INT_MAX || +- rx < INT_MIN || rx > INT_MAX || ry < INT_MIN || ry > INT_MAX) { ++ if ( !isfinite(lx) || lx < INT_MIN || lx > INT_MAX || ++ !isfinite(ly) || ly < INT_MIN || ly > INT_MAX || ++ !isfinite(rx) || rx < INT_MIN || rx > INT_MAX || ++ !isfinite(ry) || ry < INT_MIN || ry > INT_MAX) ++ { + /* do not care to clean up, we exit anyway + cp->next = NULL; + free_splinestorage(s); */ +--- a/fig2dev/tests/read.at ++++ b/fig2dev/tests/read.at +@@ -581,6 +581,25 @@ EOF + ]) + AT_CLEANUP + ++AT_SETUP([reject nan in spline controls values, #192]) ++AT_KEYWORDS([read.c]) ++# Use an output language that does not natively support Bezier splines. ++# Otherwise, the huge values are simply copied to the output. ++AT_CHECK([fig2dev -L epic < +Date: Tue, 8 Apr 2025 21:34:23 +0200 +Origin: upstream, https://sourceforge.net/p/mcj/fig2dev/ci/5f22009 +Bug: https://sourceforge.net/p/mcj/tickets/191/ +Forwarded: not-needed +Subject: Permit \0 in the second line in the fig file, #191 + Fix CVE-2025-46398 + +--- a/fig2dev/read.c ++++ b/fig2dev/read.c +@@ -181,7 +181,8 @@ read_objects(FILE *fp, F_compound *obj) + } + + /* check for embedded '\0' */ +- if (strlen(buf) < sizeof buf - 1 && buf[strlen(buf) - 1] != '\n') { ++ if (*buf == '\0' || (strlen(buf) < sizeof buf - 1 && ++ buf[strlen(buf) - 1] != '\n')) { + put_msg("ASCII NUL ('\\0') character within the first line."); + exit(EXIT_FAILURE); + /* seek to the end of the first line diff -Nru fig2dev-3.2.8b/debian/patches/43_CVE-2025-46399.patch fig2dev-3.2.8b/debian/patches/43_CVE-2025-46399.patch --- fig2dev-3.2.8b/debian/patches/43_CVE-2025-46399.patch 1970-01-01 00:00:00.000000000 +0000 +++ fig2dev-3.2.8b/debian/patches/43_CVE-2025-46399.patch 2025-04-25 07:55:59.000000000 +0000 @@ -0,0 +1,27 @@ +From: Thomas Loimer +Date: Tue, 8 Apr 2025 22:45:57 +0200 +Origin: upstream, https://sourceforge.net/p/mcj/fig2dev/ci/2bd6c0b +Bug: https://sourceforge.net/p/mcj/tickets/190/ +Forwarded: not-needed +Subject: ge output: correct spline computation, ticket #190 + Fix CVE-2025-46399 + +--- a/fig2dev/dev/genge.c ++++ b/fig2dev/dev/genge.c +@@ -229,8 +229,6 @@ genge_itp_spline(F_spline *s) + int xmin, ymin; + + a = s->controls; +- +- a = s->controls; + p = s->points; + /* go through the points to find the last two */ + for (q = p->next; q != NULL; p = q, q = q->next) { +@@ -238,6 +236,7 @@ genge_itp_spline(F_spline *s) + a = b; + } + ++ a = s->controls; + p = s->points; + fprintf(tfp, "n %d %d m\n", p->x, p->y); + xmin = 999999; diff -Nru fig2dev-3.2.8b/debian/patches/44_CVE-2025-46400.patch fig2dev-3.2.8b/debian/patches/44_CVE-2025-46400.patch --- fig2dev-3.2.8b/debian/patches/44_CVE-2025-46400.patch 1970-01-01 00:00:00.000000000 +0000 +++ fig2dev-3.2.8b/debian/patches/44_CVE-2025-46400.patch 2025-04-25 07:55:59.000000000 +0000 @@ -0,0 +1,64 @@ +From: Thomas Loimer +Date: Sat, 25 Jan 2025 21:06:59 +0100 +Origin: upstream, https://sourceforge.net/p/mcj/fig2dev/ci/c4465e0 +Bug: https://sourceforge.net/p/mcj/tickets/187/ +Forwarded: not-needed +Subject: Reject arcs with a radius smaller than 3, #187 + An arc with too small radius caused a crash in pict2e output. Instead + of dealing with such arcs in the pict2e driver, reject them already + when reading. + Fixes CVE-2025-46400 + +--- a/fig2dev/object.h ++++ b/fig2dev/object.h +@@ -92,11 +92,14 @@ typedef struct f_ellipse { + struct f_ellipse *next; + } F_ellipse; + ++#define RADIUS2_MIN 9 + #define INVALID_ELLIPSE(e) \ + e->type < T_ELLIPSE_BY_RAD || e->type > T_CIRCLE_BY_DIA || \ + COMMON_PROPERTIES(e) || (e->direction != 1 && e->direction != 0) || \ + e->radiuses.x == 0 || e->radiuses.y == 0 || \ ++ e->radiuses.x + e->radiuses.y < RADIUS2_MIN || \ + e->angle < -7. || e->angle > 7. ++ /* radiuses are set to positive in read.c */ + + typedef struct f_arc { + int type; +@@ -131,7 +134,10 @@ typedef struct f_arc { + (a->direction != 0 && a->direction != 1) || \ + COINCIDENT(a->point[0], a->point[1]) || \ + COINCIDENT(a->point[0], a->point[2]) || \ +- COINCIDENT(a->point[1], a->point[2]) ++ COINCIDENT(a->point[1], a->point[2]) || \ ++ (a->point[0].x - a->center.x) * (a->point[0].x - a->center.x) + \ ++ (a->point[0].y - a->center.y) * (a->point[0].y - a->center.y) < \ ++ RADIUS2_MIN + + typedef struct f_line { + int type; +--- a/fig2dev/read1_3.c ++++ b/fig2dev/read1_3.c +@@ -157,8 +157,10 @@ read_arcobject(FILE *fp) + a->pen_color = a->fill_color = BLACK_COLOR; + a->depth = 0; + a->pen = 0; ++ a->fill_style = 0; + a->for_arrow = NULL; + a->back_arrow = NULL; ++ a->cap_style = 0; + a->comments = NULL; + a->next = NULL; + n = fscanf(fp, +@@ -329,6 +331,10 @@ read_ellipseobject(FILE *fp) + e->type = T_CIRCLE_BY_RAD; + else + e->type = T_CIRCLE_BY_DIA; ++ if (e->radiuses.x < 0) ++ e->radiuses.x *= -1; ++ if (e->radiuses.y < 0) ++ e->radiuses.y *= -1; + if (INVALID_ELLIPSE(e)) { + put_msg(Err_invalid, "ellipse"); + free(e); diff -Nru fig2dev-3.2.8b/debian/patches/series fig2dev-3.2.8b/debian/patches/series --- fig2dev-3.2.8b/debian/patches/series 2025-03-28 21:51:19.000000000 +0000 +++ fig2dev-3.2.8b/debian/patches/series 2025-04-25 07:55:59.000000000 +0000 @@ -10,3 +10,7 @@ 38_CVE-2025-31162.patch 39_CVE-2025-31163.patch 40_CVE-2025-31164.patch +41_CVE-2025-46397.patch +42_CVE-2025-46398.patch +43_CVE-2025-46399.patch +44_CVE-2025-46400.patch