patch against xpdf integer overflow, #68665

5 files changed, 130 insertions, 9 deletions

diff --git a/app-office/koffice/ChangeLog b/app-office/koffice/ChangeLog
index ab62cd449bbf..e38f1f485005 100644
--- a/app-office/koffice/ChangeLog
+++ b/app-office/koffice/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-office/koffice
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/ChangeLog,v 1.59 2004/10/17 10:07:37 absinthe Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/ChangeLog,v 1.60 2004/10/24 00:34:58 carlo Exp $
+
+*koffice-1.3.3-r1 (24 Oct 2004)
+
+  24 Oct 2004; Carsten Lohrke <carlo@gentoo.org>
+  +files/xpdf-CESA-2004-007-xpdf2-newer.diff, +koffice-1.3.3-r1.ebuild:
+  patch against xpdf integer overflow, #68665
 
   17 Oct 2004; Dylan Carlson <absinthe@gentoo.org> koffice-1.3.1.ebuild,
   koffice-1.3.2.ebuild, koffice-1.3.3.ebuild:
diff --git a/app-office/koffice/Manifest b/app-office/koffice/Manifest
index 65123fabe937..2607e9003873 100644
--- a/app-office/koffice/Manifest
+++ b/app-office/koffice/Manifest
@@ -1,16 +1,19 @@
 MD5 82d58e79457d600e2e1eb47c83d9fb8d koffice-1.2.1-r1.ebuild 875
-MD5 d93d51a8cdb431412e647dbd9f682a7f koffice-1.3.1-r1.ebuild 957
-MD5 a25f74f8d4bf4f7d759946f34ddf8ddc koffice-1.3.1.ebuild 875
 MD5 f073cce5ca5665ca1e11d32d285374aa koffice-1.3.ebuild 863
+MD5 a25f74f8d4bf4f7d759946f34ddf8ddc koffice-1.3.1.ebuild 875
+MD5 d93d51a8cdb431412e647dbd9f682a7f koffice-1.3.1-r1.ebuild 957
+MD5 44c793c4d545dfc597b841f02f57830c koffice-1.3.3.ebuild 889
+MD5 610f6b2d9bcaf95208a5011df963f78a koffice-1.3.3-r1.ebuild 981
+MD5 a03008cc2b5a277590af68412a53a19b ChangeLog 8958
 MD5 3567b0f5f53ad3a98e67fe21ecb23624 metadata.xml 225
 MD5 dc5570e8c4a82410322a3b38decfabfe koffice-1.3.2.ebuild 886
-MD5 44c793c4d545dfc597b841f02f57830c koffice-1.3.3.ebuild 889
-MD5 bd57050ebe097fd34d76963eeec4973b ChangeLog 8757
-MD5 75c9f696b717a82bf663b4c545be66d2 files/digest-koffice-1.2.1-r1 67
+MD5 3b1ec49bae2cb0bcdd35223574324335 files/koffice-1.3.1-gcc34.patch 482
+MD5 bd89862f0c15396ad54e30a1c9f2f5d9 files/koffice-1.2.1-kword-crashes.diff 3840
 MD5 65a32b814eb23f48f2392f1ae13ac167 files/digest-koffice-1.3 66
 MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1 68
-MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1-r1 68
-MD5 bd89862f0c15396ad54e30a1c9f2f5d9 files/koffice-1.2.1-kword-crashes.diff 3840
-MD5 3b1ec49bae2cb0bcdd35223574324335 files/koffice-1.3.1-gcc34.patch 482
 MD5 b2943ad7ba97995a7a1932a702250a67 files/digest-koffice-1.3.2 68
 MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3 68
+MD5 75c9f696b717a82bf663b4c545be66d2 files/digest-koffice-1.2.1-r1 67
+MD5 48048df40bacada1eaef7e9982f40927 files/digest-koffice-1.3.1-r1 68
+MD5 e5a6ea2ef1815721c7773577378931a2 files/digest-koffice-1.3.3-r1 68
+MD5 4736559193af7398788799098e16c3c8 files/xpdf-CESA-2004-007-xpdf2-newer.diff 2828
diff --git a/app-office/koffice/files/digest-koffice-1.3.3-r1 b/app-office/koffice/files/digest-koffice-1.3.3-r1
new file mode 100644
index 000000000000..8c8f121cb5f5
--- /dev/null
+++ b/app-office/koffice/files/digest-koffice-1.3.3-r1
@@ -0,0 +1 @@
+MD5 2c3b745c6218a9dc9b3f60edea2dca2b koffice-1.3.3.tar.bz2 10739168
diff --git a/app-office/koffice/files/xpdf-CESA-2004-007-xpdf2-newer.diff b/app-office/koffice/files/xpdf-CESA-2004-007-xpdf2-newer.diff
new file mode 100644
index 000000000000..2a9490640ec7
--- /dev/null
+++ b/app-office/koffice/files/xpdf-CESA-2004-007-xpdf2-newer.diff
@@ -0,0 +1,76 @@
+--- filters/kword/pdf/xpdf/xpdf/XRef.cc.orig	2004-09-17 23:54:38.000000000 -0700
++++ filters/kword/pdf/xpdf/xpdf/XRef.cc	2004-09-25 17:59:36.000000000 -0700
+@@ -76,6 +76,12 @@
+ 
+   // trailer is ok - read the xref table
+   } else {
++    if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
++      error(-1, "Invalid 'size' inside xref table.");
++      ok = gFalse;
++      errCode = errDamaged;
++      return;
++    }
+     entries = (XRefEntry *)gmalloc(size * sizeof(XRefEntry));
+     for (i = 0; i < size; ++i) {
+       entries[i].offset = 0xffffffff;
+@@ -267,6 +273,10 @@
+     // table size
+     if (first + n > size) {
+       newSize = size + 256;
++      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++        error(-1, "Invalid 'newSize'");
++        goto err2;
++      }
+       entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
+       for (i = size; i < newSize; ++i) {
+ 	entries[i].offset = 0xffffffff;
+@@ -410,6 +420,10 @@
+ 	    if (!strncmp(p, "obj", 3)) {
+ 	      if (num >= size) {
+ 		newSize = (num + 1 + 255) & ~255;
++	        if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++	          error(-1, "Invalid 'obj' parameters.");
++	          return gFalse;
++	        }
+ 		entries = (XRefEntry *)
+ 		            grealloc(entries, newSize * sizeof(XRefEntry));
+ 		for (i = size; i < newSize; ++i) {
+@@ -431,6 +445,11 @@
+     } else if (!strncmp(p, "endstream", 9)) {
+       if (streamEndsLen == streamEndsSize) {
+ 	streamEndsSize += 64;
++        if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
++          error(-1, "Invalid 'endstream' parameter.");
++          return gFalse;
++        }
++
+ 	streamEnds = (Guint *)grealloc(streamEnds,
+ 				       streamEndsSize * sizeof(int));
+       }
+--- filters/kword/pdf/xpdf/xpdf/Catalog.cc.orig	2004-10-18 16:26:39.388666476 +0200
++++ filters/kword/pdf/xpdf/xpdf/Catalog.cc	2004-10-18 16:27:28.004749073 +0200
+@@ -62,6 +62,12 @@
+   }
+   pagesSize = numPages0 = obj.getInt();
+   obj.free();
++  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++    error(-1, "Invalid 'pagesSize'");
++    ok = gFalse;
++    return;
++  }
+   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
+   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+   for (i = 0; i < pagesSize; ++i) {
+@@ -186,6 +192,11 @@
+       }
+       if (start >= pagesSize) {
+ 	pagesSize += 32;
++        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++            pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++          error(-1, "Invalid 'pagesSize' parameter.");
++          goto err3;
++        }
+ 	pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
+ 	pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
+ 	for (j = pagesSize - 32; j < pagesSize; ++j) {
diff --git a/app-office/koffice/koffice-1.3.3-r1.ebuild b/app-office/koffice/koffice-1.3.3-r1.ebuild
new file mode 100644
index 000000000000..8cbd829a245b
--- /dev/null
+++ b/app-office/koffice/koffice-1.3.3-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-office/koffice/koffice-1.3.3-r1.ebuild,v 1.1 2004/10/24 00:34:58 carlo Exp $
+
+inherit kde eutils
+
+# TODO : mysql support
+# other refs from configure: jasper, qt-docs, doxygen, libxml2, libxslt, freetype, fontconfig, qt being built with sql support (???)
+
+DESCRIPTION="A free, integrated office suite for KDE, the K Desktop Environment."
+HOMEPAGE="http://www.koffice.org/"
+SRC_URI="mirror://kde/stable/${P}/src/${P}.tar.bz2"
+
+LICENSE="GPL-2 LGPL-2"
+KEYWORDS="x86 ~amd64 ~ppc ~sparc ~alpha ~ppc64"
+
+IUSE=""
+SLOT="0"
+
+DEPEND=">=dev-lang/python-2.2.1
+	>=media-libs/libart_lgpl-2.3.9
+	>=media-gfx/imagemagick-5.4.5
+	>=app-text/wv2-0.1.8
+	dev-util/pkgconfig"
+need-kde 3.1
+
+src_unpack() {
+	kde_src_unpack
+	epatch ${FILESDIR}/xpdf-CESA-2004-007-xpdf2-newer.diff
+}
+
+src_compile() {
+	export LIBPYTHON="`python-config --libs`"
+	kde_src_compile
+}