fixing kpdf integer overflows, #68558

11 files changed, 378 insertions, 2 deletions

diff --git a/kde-base/kdegraphics/ChangeLog b/kde-base/kdegraphics/ChangeLog
index 0921db1d9eca..ff356cfb5c3d 100644
--- a/kde-base/kdegraphics/ChangeLog
+++ b/kde-base/kdegraphics/ChangeLog
@@ -1,6 +1,14 @@
 # ChangeLog for kde-base/kdegraphics
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/ChangeLog,v 1.113 2004/10/14 01:39:27 caleb Exp $
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/ChangeLog,v 1.114 2004/10/24 00:47:38 carlo Exp $
+
+*kdegraphics-3.3.1-r1 (24 Oct 2004)
+
+  24 Oct 2004; Carsten Lohrke <carlo@gentoo.org>
+  +files/post-3.2.3-kdegraphics.diff, +files/post-3.3.1-kdegraphics.diff,
+  +files/xpdf-3.3.0-kdegraphics.diff, +kdegraphics-3.2.3-r1.ebuild,
+  +kdegraphics-3.3.0-r1.ebuild, +kdegraphics-3.3.1-r1.ebuild:
+  fxing kpdf integer overflows, #68558
 
 *kdegraphics-3.3.1 (13 Oct 2004)
 
diff --git a/kde-base/kdegraphics/Manifest b/kde-base/kdegraphics/Manifest
index c10e5de47e60..60d014f239ae 100644
--- a/kde-base/kdegraphics/Manifest
+++ b/kde-base/kdegraphics/Manifest
@@ -1,11 +1,16 @@
 MD5 0c557af25ca14e9133483d1ff8414c74 kdegraphics-3.2.2.ebuild 1224
 MD5 5a60aa7288a3e688931b84fce55c4b6a kdegraphics-3.3.0.ebuild 1430
+MD5 0dcbff375e401ca8c354637670a32c43 kdegraphics-3.3.1-r1.ebuild 1485
+MD5 f0ed0e7caefb405bf47e3c2a23113256 kdegraphics-3.2.3-r1.ebuild 1278
+MD5 21f3f5db30c1c0820d9d3d0f0fcf03de kdegraphics-3.3.0-r1.ebuild 1484
 MD5 feb2b4270d15a98a32173a5ae04a19fb kdegraphics-3.1.5.ebuild 1048
 MD5 8e48bc60a542000e2ca8ca2173a21113 kdegraphics-3.2.3.ebuild 1226
 MD5 6b3fabad5f11df10503b136be549dc16 kdegraphics-3.3.1.ebuild 1434
-MD5 fcc565f2a337e252fcdfce2676dab8af ChangeLog 15375
+MD5 5aefc2683809a6dc7433ecf6082a50e0 ChangeLog 15705
 MD5 d34737e0c554fe641ce3a353c8b7fe8d kdegraphics-3.2.0.ebuild 1330
 MD5 14889ab75f97d76e58b0c1154e7683a9 metadata.xml 161
+MD5 33d7a652f3ae6f9e66d79fb818b684f6 files/digest-kdegraphics-3.3.0-r1 71
+MD5 fecf5cb3209323e56be3368df325411a files/digest-kdegraphics-3.3.1-r1 71
 MD5 eb03ab721af71700a0b445f1c50b55f8 files/kdegraphics-3.2.2-gcc34-compile.patch 7723
 MD5 78ab0a172f24863df0ba35300e95a890 files/digest-kdegraphics-3.1.5 71
 MD5 8c9db7f8d52169b544da66be07e9979a files/digest-kdegraphics-3.2.0 71
@@ -13,4 +18,8 @@ MD5 80f49f2fcc0bb31559666e47fc28b047 files/digest-kdegraphics-3.2.2 71
 MD5 e43eeb201ab38aa05917d4de1573ff59 files/digest-kdegraphics-3.2.3 71
 MD5 33d7a652f3ae6f9e66d79fb818b684f6 files/digest-kdegraphics-3.3.0 71
 MD5 fecf5cb3209323e56be3368df325411a files/digest-kdegraphics-3.3.1 71
+MD5 8d995a343d5083ba8ac84f1d4136d359 files/xpdf-3.3.0-kdegraphics.diff 1630
+MD5 4f854adb507f4d04e997702e44ffc2ea files/post-3.2.3-kdegraphics.diff 3853
 MD5 d97c962408abd235435f6857fc405ebf files/kdegraphics-3.2.3-gcc34-compile.patch 7162
+MD5 651fba579516ea947fbefee373f40a6c files/post-3.3.1-kdegraphics.diff 1533
+MD5 e43eeb201ab38aa05917d4de1573ff59 files/digest-kdegraphics-3.2.3-r1 71
diff --git a/kde-base/kdegraphics/files/digest-kdegraphics-3.2.3-r1 b/kde-base/kdegraphics/files/digest-kdegraphics-3.2.3-r1
new file mode 100644
index 000000000000..2e0072d98c01
--- /dev/null
+++ b/kde-base/kdegraphics/files/digest-kdegraphics-3.2.3-r1
@@ -0,0 +1 @@
+MD5 af7092f2afc5a8565eb5017ecee6b67e kdegraphics-3.2.3.tar.bz2 5676995
diff --git a/kde-base/kdegraphics/files/digest-kdegraphics-3.3.0-r1 b/kde-base/kdegraphics/files/digest-kdegraphics-3.3.0-r1
new file mode 100644
index 000000000000..6aa32ec56f90
--- /dev/null
+++ b/kde-base/kdegraphics/files/digest-kdegraphics-3.3.0-r1
@@ -0,0 +1 @@
+MD5 7bb9843f7b03cd2716079ac83b9c9304 kdegraphics-3.3.0.tar.bz2 6444906
diff --git a/kde-base/kdegraphics/files/digest-kdegraphics-3.3.1-r1 b/kde-base/kdegraphics/files/digest-kdegraphics-3.3.1-r1
new file mode 100644
index 000000000000..484cea392932
--- /dev/null
+++ b/kde-base/kdegraphics/files/digest-kdegraphics-3.3.1-r1
@@ -0,0 +1 @@
+MD5 18f063ec6fad27b304ae97cf4b480140 kdegraphics-3.3.1.tar.bz2 6419816
diff --git a/kde-base/kdegraphics/files/post-3.2.3-kdegraphics.diff b/kde-base/kdegraphics/files/post-3.2.3-kdegraphics.diff
new file mode 100644
index 000000000000..969f97fac84f
--- /dev/null
+++ b/kde-base/kdegraphics/files/post-3.2.3-kdegraphics.diff
@@ -0,0 +1,110 @@
+Index: kpdf/xpdf/Catalog.cc
+===================================================================
+RCS file: /home/kde/kdegraphics/kpdf/xpdf/Catalog.cc,v
+retrieving revision 1.3
+diff -u -5 -d -p -r1.3 Catalog.cc
+--- kpdf/xpdf/Catalog.cc	20 Aug 2003 21:25:12 -0000	1.3
++++ kpdf/xpdf/Catalog.cc	18 Oct 2004 20:12:09 -0000
+@@ -61,10 +61,16 @@ Catalog::Catalog(XRef *xrefA) {
+ 	  obj.getTypeName());
+     goto err3;
+   }
+   pagesSize = numPages0 = obj.getInt();
+   obj.free();
++  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++    error(-1, "Invalid 'pagesSize'");
++    ok = gFalse;
++    return;
++  }
+   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
+   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+   for (i = 0; i < pagesSize; ++i) {
+     pages[i] = NULL;
+     pageRefs[i].num = -1;
+@@ -188,10 +194,15 @@ int Catalog::readPageTree(Dict *pagesDic
+ 	++start;
+ 	goto err3;
+       }
+       if (start >= pagesSize) {
+ 	pagesSize += 32;
++        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++            pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++          error(-1, "Invalid 'pagesSize' parameter.");
++          goto err3;
++        }
+ 	pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
+ 	pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
+ 	for (j = pagesSize - 32; j < pagesSize; ++j) {
+ 	  pages[j] = NULL;
+ 	  pageRefs[j].num = -1;
+Index: kpdf/xpdf/XRef.cc
+===================================================================
+RCS file: /home/kde/kdegraphics/kpdf/xpdf/XRef.cc,v
+retrieving revision 1.3
+diff -u -5 -d -p -r1.3 XRef.cc
+--- kpdf/xpdf/XRef.cc	20 Aug 2003 21:25:12 -0000	1.3
++++ kpdf/xpdf/XRef.cc	18 Oct 2004 20:12:09 -0000
+@@ -74,10 +74,16 @@ XRef::XRef(BaseStream *strA, GString *ow
+       return;
+     }
+ 
+   // trailer is ok - read the xref table
+   } else {
++    if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
++      error(-1, "Invalid 'size' inside xref table.");
++      ok = gFalse;
++      errCode = errDamaged;
++      return;
++    }
+     entries = (XRefEntry *)gmalloc(size * sizeof(XRefEntry));
+     for (i = 0; i < size; ++i) {
+       entries[i].offset = 0xffffffff;
+       entries[i].used = gFalse;
+     }
+@@ -265,10 +271,14 @@ GBool XRef::readXRef(Guint *pos) {
+     }
+     // check for buggy PDF files with an incorrect (too small) xref
+     // table size
+     if (first + n > size) {
+       newSize = size + 256;
++      if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++        error(-1, "Invalid 'newSize'");
++        goto err2;
++      }
+       entries = (XRefEntry *)grealloc(entries, newSize * sizeof(XRefEntry));
+       for (i = size; i < newSize; ++i) {
+ 	entries[i].offset = 0xffffffff;
+ 	entries[i].used = gFalse;
+       }
+@@ -413,10 +423,14 @@ GBool XRef::constructXRef() {
+ 	      ++p;
+ 	    } while (*p && isspace(*p));
+ 	    if (!strncmp(p, "obj", 3)) {
+ 	      if (num >= size) {
+ 		newSize = (num + 1 + 255) & ~255;
++	        if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
++	          error(-1, "Invalid 'obj' parameters.");
++	          return gFalse;
++	        }
+ 		entries = (XRefEntry *)
+ 		            grealloc(entries, newSize * sizeof(XRefEntry));
+ 		for (i = size; i < newSize; ++i) {
+ 		  entries[i].offset = 0xffffffff;
+ 		  entries[i].used = gFalse;
+@@ -434,10 +448,15 @@ GBool XRef::constructXRef() {
+       }
+ 
+     } else if (!strncmp(p, "endstream", 9)) {
+       if (streamEndsLen == streamEndsSize) {
+ 	streamEndsSize += 64;
++        if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
++          error(-1, "Invalid 'endstream' parameter.");
++          return gFalse;
++        }
++
+ 	streamEnds = (Guint *)grealloc(streamEnds,
+ 				       streamEndsSize * sizeof(int));
+       }
+       streamEnds[streamEndsLen++] = pos;
+     }
diff --git a/kde-base/kdegraphics/files/post-3.3.1-kdegraphics.diff b/kde-base/kdegraphics/files/post-3.3.1-kdegraphics.diff
new file mode 100644
index 000000000000..aa79feb8716e
--- /dev/null
+++ b/kde-base/kdegraphics/files/post-3.3.1-kdegraphics.diff
@@ -0,0 +1,42 @@
+Index: kpdf/xpdf/Catalog.cc
+===================================================================
+RCS file: /home/kde/kdegraphics/kpdf/xpdf/Catalog.cc,v
+retrieving revision 1.3.4.1
+diff -u -5 -d -p -r1.3.4.1 Catalog.cc
+--- kpdf/xpdf/Catalog.cc	2 Sep 2004 21:30:18 -0000	1.3.4.1
++++ kpdf/xpdf/Catalog.cc	12 Oct 2004 21:15:38 -0000
+@@ -62,10 +62,19 @@ Catalog::Catalog(XRef *xrefA) {
+ 	  obj.getTypeName());
+     goto err3;
+   }
+   pagesSize = numPages0 = (int)obj.getNum();
+   obj.free();
++  // The gcc doesnt optimize this away, so this check is ok,
++  // even if it looks like a pagesSize != pagesSize check
++  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++    error(-1, "Invalid 'pagesSize'");
++    ok = gFalse;
++    return;
++  }
++
+   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
+   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+   for (i = 0; i < pagesSize; ++i) {
+     pages[i] = NULL;
+     pageRefs[i].num = -1;
+@@ -189,10 +198,14 @@ int Catalog::readPageTree(Dict *pagesDic
+ 	++start;
+ 	goto err3;
+       }
+       if (start >= pagesSize) {
+ 	pagesSize += 32;
++        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize) {
++          error(-1, "Invalid 'pagesSize' parameter.");
++          goto err3;
++        }
+ 	pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
+ 	pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
+ 	for (j = pagesSize - 32; j < pagesSize; ++j) {
+ 	  pages[j] = NULL;
+ 	  pageRefs[j].num = -1;
diff --git a/kde-base/kdegraphics/files/xpdf-3.3.0-kdegraphics.diff b/kde-base/kdegraphics/files/xpdf-3.3.0-kdegraphics.diff
new file mode 100644
index 000000000000..0e936cb81f5d
--- /dev/null
+++ b/kde-base/kdegraphics/files/xpdf-3.3.0-kdegraphics.diff
@@ -0,0 +1,49 @@
+--- ../../../kdegraphics-3.3.0-r1/work/kdegraphics-3.3.0/kpdf/xpdf/Catalog.cc	2003-08-20 23:25:12.000000000 +0200
++++ kpdf/xpdf/Catalog.cc	2004-10-24 02:03:30.000000000 +0200
+@@ -56,13 +56,23 @@
+     goto err2;
+   }
+   pagesDict.dictLookup("Count", &obj);
+-  if (!obj.isInt()) {
++  // some PDF files actually use real numbers here ("/Count 9.0")
++  if (!obj.isNum()) {
+     error(-1, "Page count in top-level pages object is wrong type (%s)",
+ 	  obj.getTypeName());
+     goto err3;
+   }
+-  pagesSize = numPages0 = obj.getInt();
++  pagesSize = numPages0 = (int)obj.getNum();
+   obj.free();
++  // The gcc doesnt optimize this away, so this check is ok,
++  // even if it looks like a pagesSize != pagesSize check
++  if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
++      pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
++    error(-1, "Invalid 'pagesSize'");
++    ok = gFalse;
++    return;
++  }
++
+   pages = (Page **)gmalloc(pagesSize * sizeof(Page *));
+   pageRefs = (Ref *)gmalloc(pagesSize * sizeof(Ref));
+   for (i = 0; i < pagesSize; ++i) {
+@@ -190,6 +200,10 @@
+       }
+       if (start >= pagesSize) {
+ 	pagesSize += 32;
++        if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize) {
++          error(-1, "Invalid 'pagesSize' parameter.");
++          goto err3;
++        }
+ 	pages = (Page **)grealloc(pages, pagesSize * sizeof(Page *));
+ 	pageRefs = (Ref *)grealloc(pageRefs, pagesSize * sizeof(Ref));
+ 	for (j = pagesSize - 32; j < pagesSize; ++j) {
+@@ -307,8 +321,8 @@
+ 	} else if (cmp < 0) {
+ 	  done = gTrue;
+ 	}
+-	name1.free();
+       }
++      name1.free();
+     }
+     names.free();
+     if (!found)
diff --git a/kde-base/kdegraphics/kdegraphics-3.2.3-r1.ebuild b/kde-base/kdegraphics/kdegraphics-3.2.3-r1.ebuild
new file mode 100644
index 000000000000..45743533b652
--- /dev/null
+++ b/kde-base/kdegraphics/kdegraphics-3.2.3-r1.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/kdegraphics-3.2.3-r1.ebuild,v 1.1 2004/10/24 00:47:38 carlo Exp $
+
+inherit kde-dist eutils
+
+DESCRIPTION="KDE graphics-related apps"
+
+KEYWORDS="x86 ~ppc ~sparc ~alpha ~hppa ~amd64 ~ia64"
+IUSE="gphoto2 tetex scanner opengl"
+
+DEPEND="~kde-base/kdebase-${PV}
+	gphoto2? ( media-gfx/gphoto2 )
+	scanner? ( media-gfx/sane-backends )
+	tetex? ( virtual/tetex )
+	dev-libs/fribidi
+	opengl? ( virtual/glut virtual/opengl )
+	media-libs/imlib
+	virtual/ghostscript
+	media-libs/tiff
+	x86? ( scanner? sys-libs/libieee1284 )"
+RDEPEND="${DEPEND}
+	app-text/xpdf"
+
+src_unpack() {
+	kde_src_unpack
+	epatch ${FILESDIR}/${P}-gcc34-compile.patch
+	epatch ${FILESDIR}/post-3.2.3-kdegraphics.diff
+}
+
+src_compile() {
+
+	use gphoto2	\
+		&& myconf="$myconf --with-kamera \
+				   --with-gphoto2-includes=/usr/include/gphoto2 \
+				   --with-gphoto2-libraries=/usr/lib/gphoto2" \
+		|| myconf="$myconf --without-kamera"
+
+	use tetex 	&& myconf="$myconf --with-system-kpathsea --with-tex-datadir=/usr/share"
+
+	use scanner	|| DO_NOT_COMPILE="$DO_NOT_COMPILE kooka libkscan"
+
+	myconf="$myconf --with-imlib --with-imlib-config=/usr/bin"
+	kde_src_compile
+}
diff --git a/kde-base/kdegraphics/kdegraphics-3.3.0-r1.ebuild b/kde-base/kdegraphics/kdegraphics-3.3.0-r1.ebuild
new file mode 100644
index 000000000000..bafc2d90e202
--- /dev/null
+++ b/kde-base/kdegraphics/kdegraphics-3.3.0-r1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/kdegraphics-3.3.0-r1.ebuild,v 1.1 2004/10/24 00:47:38 carlo Exp $
+
+inherit kde-dist eutils
+
+DESCRIPTION="KDE graphics-related apps"
+
+KEYWORDS="x86 ~amd64 ~ppc64 ~sparc ~ppc ~hppa"
+IUSE="gphoto2 imlib jpeg2k opengl povray scanner tetex"
+
+DEPEND="~kde-base/kdebase-${PV}
+	gphoto2? ( media-gfx/gphoto2 )
+	scanner? ( media-gfx/sane-backends )
+	dev-libs/fribidi
+	opengl? ( virtual/glut virtual/opengl )
+	imlib? ( media-libs/imlib )
+	virtual/ghostscript
+	media-libs/tiff
+	x86? ( scanner? sys-libs/libieee1284 )
+	povray? ( x86? ( media-gfx/povray ) )
+	jpeg2k? ( x86? ( media-libs/jasper ) )
+	!media-gfx/kolourpaint"
+RDEPEND="${DEPEND}
+	app-text/xpdf
+	tetex? (
+	|| ( >=app-text/tetex-2
+	app-text/ptex
+	app-text/cstetex
+	app-text/dvipdfm )
+	)"
+
+src_unpack() {
+	kde_src_unpack
+	epatch ${FILESDIR}/xpdf-3.3.0-kdegraphics.diff
+}
+
+src_compile() {
+
+	use gphoto2	\
+		&& myconf="$myconf --with-kamera \
+				   --with-gphoto2-includes=/usr/include/gphoto2 \
+				   --with-gphoto2-libraries=/usr/lib/gphoto2" \
+		|| myconf="$myconf --without-kamera"
+
+	use tetex 	&& myconf="$myconf --with-system-kpathsea --with-tex-datadir=/usr/share"
+
+	use scanner	|| DO_NOT_COMPILE="$DO_NOT_COMPILE kooka libkscan"
+
+	use imlib \
+		&& myconf="$myconf --with-imlib --with-imlib-config=/usr/bin" \
+		|| myconf="$myconf --without-imlib"
+
+	kde_src_compile
+}
diff --git a/kde-base/kdegraphics/kdegraphics-3.3.1-r1.ebuild b/kde-base/kdegraphics/kdegraphics-3.3.1-r1.ebuild
new file mode 100644
index 000000000000..cdb9856d3a76
--- /dev/null
+++ b/kde-base/kdegraphics/kdegraphics-3.3.1-r1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/kde-base/kdegraphics/kdegraphics-3.3.1-r1.ebuild,v 1.1 2004/10/24 00:47:38 carlo Exp $
+
+inherit kde-dist eutils
+
+DESCRIPTION="KDE graphics-related apps"
+
+KEYWORDS="~x86 ~amd64 ~ppc64 ~sparc ~ppc ~hppa"
+IUSE="gphoto2 imlib jpeg2k opengl povray scanner tetex"
+
+DEPEND="~kde-base/kdebase-${PV}
+	gphoto2? ( media-gfx/gphoto2 )
+	scanner? ( media-gfx/sane-backends )
+	dev-libs/fribidi
+	opengl? ( virtual/glut virtual/opengl )
+	imlib? ( media-libs/imlib )
+	virtual/ghostscript
+	media-libs/tiff
+	x86? ( scanner? sys-libs/libieee1284 )
+	povray? ( x86? ( media-gfx/povray ) )
+	jpeg2k? ( x86? ( media-libs/jasper ) )
+	!media-gfx/kolourpaint"
+RDEPEND="${DEPEND}
+	app-text/xpdf
+	tetex? (
+	|| ( >=app-text/tetex-2
+	app-text/ptex
+	app-text/cstetex
+	app-text/dvipdfm )
+	)"
+
+src_unpack() {
+	kde_src_unpack
+	epatch ${FILESDIR}/post-3.3.1-kdegraphics.diff
+}
+
+src_compile() {
+
+	use gphoto2	\
+		&& myconf="$myconf --with-kamera \
+				   --with-gphoto2-includes=/usr/include/gphoto2 \
+				   --with-gphoto2-libraries=/usr/lib/gphoto2" \
+		|| myconf="$myconf --without-kamera"
+
+	use tetex 	&& myconf="$myconf --with-system-kpathsea --with-tex-datadir=/usr/share"
+
+	use scanner	|| DO_NOT_COMPILE="$DO_NOT_COMPILE kooka libkscan"
+
+	use imlib \
+		&& myconf="$myconf --with-imlib --with-imlib-config=/usr/bin" \
+		|| myconf="$myconf --without-imlib"
+
+	kde_src_compile
+}