branch master updated: gnu: mupdf: Fix CVE-2021-3407.

[guix-commits]

This is an automated email from the git hooks/post-receive script.

kkebreau pushed a commit to branch master
in repository guix.

The following commit(s) were added to refs/heads/master by this push:
     new 6891f95  gnu: mupdf: Fix CVE-2021-3407.
6891f95 is described below

commit 6891f95739c733df217ceaf5d0787cbed380ec1c
Author: Kei Kebreau <kkebreau@posteo.net>
AuthorDate: Thu Mar 4 19:43:17 2021 -0500

    gnu: mupdf: Fix CVE-2021-3407.
    
    * gnu/packages/pdf.scm (mupdf)[source]: Add patch.
    * gnu/packages/patches/mupdf-CVE-2021-3407.patch: New file.
    * gnu/local.mk (dist_patch_DATA): Register it.
---
 gnu/local.mk                                   |  1 +
 gnu/packages/patches/mupdf-CVE-2021-3407.patch | 51 ++++++++++++++++++++++++++
 gnu/packages/pdf.scm                           |  3 +-
 3 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 3557d9f..25afb99 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1382,6 +1382,7 @@ dist_patch_DATA =                                         
\
   %D%/packages/patches/mumps-shared-mumps.patch                        \
   %D%/packages/patches/mumps-shared-pord.patch                 \
   %D%/packages/patches/mupdf-fix-linkage.patch                 \
+  %D%/packages/patches/mupdf-CVE-2021-3407.patch               \
   %D%/packages/patches/mupen64plus-ui-console-notice.patch     \
   %D%/packages/patches/mupen64plus-video-z64-glew-correct-path.patch    \
   %D%/packages/patches/musl-cross-locale.patch                 \
diff --git a/gnu/packages/patches/mupdf-CVE-2021-3407.patch 
b/gnu/packages/patches/mupdf-CVE-2021-3407.patch
new file mode 100644
index 0000000..9f90151
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2021-3407.patch
@@ -0,0 +1,51 @@
+This patch came from 
https://git.ghostscript.com/?p=mupdf.git;a=patch;h=cee7cefc610d42fd383b3c80c12cbc675443176a
+and fixes CVE-2021-3407.
+
+From cee7cefc610d42fd383b3c80c12cbc675443176a Mon Sep 17 00:00:00 2001
+From: Robin Watts <Robin.Watts@artifex.com>
+Date: Fri, 22 Jan 2021 17:05:15 +0000
+Subject: [PATCH] Bug 703366: Fix double free of object during linearization.
+
+This appears to happen because we parse an illegal object from
+a broken file and assign it to object 0, which is defined to
+be free.
+
+Here, we fix the parsing code so this can't happen.
+---
+ source/pdf/pdf-parse.c | 6 ++++++
+ source/pdf/pdf-xref.c  | 2 ++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c
+index 7abc8c3d4..5761c3351 100644
+--- a/source/pdf/pdf-parse.c
++++ b/source/pdf/pdf-parse.c
+@@ -749,6 +749,12 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc,
+               fz_throw(ctx, FZ_ERROR_SYNTAX, "expected generation number (%d 
? obj)", num);
+       }
+       gen = buf->i;
++      if (gen < 0 || gen >= 65536)
++      {
++              if (try_repair)
++                      *try_repair = 1;
++              fz_throw(ctx, FZ_ERROR_SYNTAX, "invalid generation number 
(%d)", gen);
++      }
+ 
+       tok = pdf_lex(ctx, file, buf);
+       if (tok != PDF_TOK_OBJ)
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 1b2bdcd59..30197b4b8 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1190,6 +1190,8 @@ pdf_read_new_xref(fz_context *ctx, pdf_document *doc, 
pdf_lexbuf *buf)
+       {
+               ofs = fz_tell(ctx, doc->file);
+               trailer = pdf_parse_ind_obj(ctx, doc, doc->file, buf, &num, 
&gen, &stm_ofs, NULL);
++              if (num == 0)
++                      fz_throw(ctx, FZ_ERROR_GENERIC, "Trailer object number 
cannot be 0\n");
+       }
+       fz_catch(ctx)
+       {
+-- 
+2.17.1
+
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index daea7ee..e81c3ca 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -724,7 +724,8 @@ extracting content or merging files.")
                            "mupdf-" version "-source.tar.xz"))
        (sha256
         (base32 "16m5sksil22sshxy70xkslsb2qhvcqb1d95i9savnhds1xn4ybar"))
-       (patches (search-patches "mupdf-fix-linkage.patch"))
+       (patches (search-patches "mupdf-fix-linkage.patch"
+                                "mupdf-CVE-2021-3407.patch"))
        (modules '((guix build utils)))
        (snippet
         '(begin