diff options
author | Jonathan Callen <abcd@gentoo.org> | 2009-11-01 09:15:28 +0000 |
---|---|---|
committer | Jonathan Callen <abcd@gentoo.org> | 2009-11-01 09:15:28 +0000 |
commit | 61bc8529fc01e5fd054c760f5e89580c13bd0897 (patch) | |
tree | 04993ea41de6c7b968c9d39b519b8d2423bf4793 /app-office | |
parent | Drop old version (diff) | |
download | gentoo-2-61bc8529fc01e5fd054c760f5e89580c13bd0897.tar.gz gentoo-2-61bc8529fc01e5fd054c760f5e89580c13bd0897.tar.bz2 gentoo-2-61bc8529fc01e5fd054c760f5e89580c13bd0897.zip |
Drop old version
(Portage version: -svn/cvs/Linux i686)
Diffstat (limited to 'app-office')
-rw-r--r-- | app-office/kword/ChangeLog | 8 | ||||
-rw-r--r-- | app-office/kword/files/koffice-1.6.3-xpdf2-CVE-2007-4352-5392-5393.diff | 669 | ||||
-rw-r--r-- | app-office/kword/files/koffice-xpdf-CVE-2007-0104.diff | 74 | ||||
-rw-r--r-- | app-office/kword/files/koffice-xpdf-CVE-2007-3387.diff | 20 | ||||
-rw-r--r-- | app-office/kword/files/kword-gcc43.patch | 22 | ||||
-rw-r--r-- | app-office/kword/kword-1.6.3-r2.ebuild | 65 |
6 files changed, 7 insertions, 851 deletions
diff --git a/app-office/kword/ChangeLog b/app-office/kword/ChangeLog index d0e6b8fa7152..8b9f24b23bdd 100644 --- a/app-office/kword/ChangeLog +++ b/app-office/kword/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for app-office/kword # Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-office/kword/ChangeLog,v 1.134 2009/10/01 15:23:57 scarabeus Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-office/kword/ChangeLog,v 1.135 2009/11/01 09:15:28 abcd Exp $ + + 01 Nov 2009; Jonathan Callen <abcd@gentoo.org> -kword-1.6.3-r2.ebuild, + -files/koffice-1.6.3-xpdf2-CVE-2007-4352-5392-5393.diff, + -files/koffice-xpdf-CVE-2007-0104.diff, + -files/koffice-xpdf-CVE-2007-3387.diff, -files/kword-gcc43.patch: + Drop old version 01 Oct 2009; Tomáš Chvátal <scarabeus@gentoo.org> kword-2.0.2.ebuild: Update deps. Per bug #286964. diff --git a/app-office/kword/files/koffice-1.6.3-xpdf2-CVE-2007-4352-5392-5393.diff b/app-office/kword/files/koffice-1.6.3-xpdf2-CVE-2007-4352-5392-5393.diff deleted file mode 100644 index dabcf23d44aa..000000000000 --- a/app-office/kword/files/koffice-1.6.3-xpdf2-CVE-2007-4352-5392-5393.diff +++ /dev/null @@ -1,669 +0,0 @@ ---- filters/kword/pdf/xpdf/xpdf/Stream.cc -+++ filters/kword/pdf/xpdf/xpdf/Stream.cc -@@ -1239,6 +1239,7 @@ - // CCITTFaxStream - //------------------------------------------------------------------------ - -+#if 0 - CCITTFaxStream::CCITTFaxStream(Stream *strA, int encodingA, GBool endOfLineA, - GBool byteAlignA, int columnsA, int rowsA, - GBool endOfBlockA, GBool blackA): -@@ -1748,6 +1749,609 @@ - } - return (inputBuf >> (inputBits - n)) & (0xffff >> (16 - n)); - } -+#else // secfix -+CCITTFaxStream::CCITTFaxStream(Stream *strA, int encodingA, GBool endOfLineA, -+ GBool byteAlignA, int columnsA, int rowsA, -+ GBool endOfBlockA, GBool blackA): -+ FilterStream(strA) { -+ encoding = encodingA; -+ endOfLine = endOfLineA; -+ byteAlign = byteAlignA; -+ columns = columnsA; -+ if (columns < 1) { -+ columns = 1; -+ } else if (columns > (INT_MAX - 2)/sizeof(int)) { -+ columns = (INT_MAX - 2)/sizeof(int); -+ } -+ rows = rowsA; -+ endOfBlock = endOfBlockA; -+ black = blackA; -+ // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns -+ // ---> max codingLine size = columns + 1 -+ // refLine has one extra guard entry at the end -+ // ---> max refLine size = columns + 2 -+ codingLine = (int *)gmalloc((columns + 1) * sizeof(int)); -+ refLine = (int *)gmalloc((columns + 2) * sizeof(int)); -+ -+ eof = gFalse; -+ row = 0; -+ nextLine2D = encoding < 0; -+ inputBits = 0; -+ codingLine[0] = columns; -+ a0i = 0; -+ outputBits = 0; -+ -+ buf = EOF; -+} -+ -+CCITTFaxStream::~CCITTFaxStream() { -+ delete str; -+ gfree(refLine); -+ gfree(codingLine); -+} -+ -+void CCITTFaxStream::reset() { -+ short code1; -+ -+ str->reset(); -+ eof = gFalse; -+ row = 0; -+ nextLine2D = encoding < 0; -+ inputBits = 0; -+ codingLine[0] = columns; -+ a0i = 0; -+ outputBits = 0; -+ buf = EOF; -+ -+ // skip any initial zero bits and end-of-line marker, and get the 2D -+ // encoding tag -+ while ((code1 = lookBits(12)) == 0) { -+ eatBits(1); -+ } -+ if (code1 == 0x001) { -+ eatBits(12); -+ } -+ if (encoding > 0) { -+ nextLine2D = !lookBits(1); -+ eatBits(1); -+ } -+} -+ -+inline void CCITTFaxStream::addPixels(int a1, int blackPixels) { -+ if (a1 > codingLine[a0i]) { -+ if (a1 > columns) { -+ error(getPos(), "CCITTFax row is wrong length (%d)", a1); -+ err = gTrue; -+ a1 = columns; -+ } -+ if ((a0i & 1) ^ blackPixels) { -+ ++a0i; -+ } -+ codingLine[a0i] = a1; -+ } -+} -+ -+inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) { -+ if (a1 > codingLine[a0i]) { -+ if (a1 > columns) { -+ error(getPos(), "CCITTFax row is wrong length (%d)", a1); -+ err = gTrue; -+ a1 = columns; -+ } -+ if ((a0i & 1) ^ blackPixels) { -+ ++a0i; -+ } -+ codingLine[a0i] = a1; -+ } else if (a1 < codingLine[a0i]) { -+ if (a1 < 0) { -+ error(getPos(), "Invalid CCITTFax code"); -+ err = gTrue; -+ a1 = 0; -+ } -+ while (a0i > 0 && a1 <= codingLine[a0i - 1]) { -+ --a0i; -+ } -+ codingLine[a0i] = a1; -+ } -+} -+ -+int CCITTFaxStream::lookChar() { -+ short code1, code2, code3; -+ int b1i, blackPixels, i, bits; -+ GBool gotEOL; -+ -+ if (buf != EOF) { -+ return buf; -+ } -+ -+ // read the next row -+ if (outputBits == 0) { -+ -+ // if at eof just return EOF -+ if (eof) { -+ return EOF; -+ } -+ -+ err = gFalse; -+ -+ // 2-D encoding -+ if (nextLine2D) { -+ for (i = 0; codingLine[i] < columns; ++i) { -+ refLine[i] = codingLine[i]; -+ } -+ refLine[i++] = columns; -+ refLine[i] = columns; -+ codingLine[0] = 0; -+ a0i = 0; -+ b1i = 0; -+ blackPixels = 0; -+ // invariant: -+ // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] -+ // <= columns -+ // exception at left edge: -+ // codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible -+ // exception at right edge: -+ // refLine[b1i] = refLine[b1i+1] = columns is possible -+ while (codingLine[a0i] < columns) { -+ code1 = getTwoDimCode(); -+ switch (code1) { -+ case twoDimPass: -+ addPixels(refLine[b1i + 1], blackPixels); -+ if (refLine[b1i + 1] < columns) { -+ b1i += 2; -+ } -+ break; -+ case twoDimHoriz: -+ code1 = code2 = 0; -+ if (blackPixels) { -+ do { -+ code1 += code3 = getBlackCode(); -+ } while (code3 >= 64); -+ do { -+ code2 += code3 = getWhiteCode(); -+ } while (code3 >= 64); -+ } else { -+ do { -+ code1 += code3 = getWhiteCode(); -+ } while (code3 >= 64); -+ do { -+ code2 += code3 = getBlackCode(); -+ } while (code3 >= 64); -+ } -+ addPixels(codingLine[a0i] + code1, blackPixels); -+ if (codingLine[a0i] < columns) { -+ addPixels(codingLine[a0i] + code2, blackPixels ^ 1); -+ } -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ break; -+ case twoDimVertR3: -+ addPixels(refLine[b1i] + 3, blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ ++b1i; -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case twoDimVertR2: -+ addPixels(refLine[b1i] + 2, blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ ++b1i; -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case twoDimVertR1: -+ addPixels(refLine[b1i] + 1, blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ ++b1i; -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case twoDimVert0: -+ addPixels(refLine[b1i], blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ ++b1i; -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case twoDimVertL3: -+ addPixelsNeg(refLine[b1i] - 3, blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ if (b1i > 0) { -+ --b1i; -+ } else { -+ ++b1i; -+ } -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case twoDimVertL2: -+ addPixelsNeg(refLine[b1i] - 2, blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ if (b1i > 0) { -+ --b1i; -+ } else { -+ ++b1i; -+ } -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case twoDimVertL1: -+ addPixelsNeg(refLine[b1i] - 1, blackPixels); -+ blackPixels ^= 1; -+ if (codingLine[a0i] < columns) { -+ if (b1i > 0) { -+ --b1i; -+ } else { -+ ++b1i; -+ } -+ while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) { -+ b1i += 2; -+ } -+ } -+ break; -+ case EOF: -+ addPixels(columns, 0); -+ eof = gTrue; -+ break; -+ default: -+ error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1); -+ addPixels(columns, 0); -+ err = gTrue; -+ break; -+ } -+ } -+ -+ // 1-D encoding -+ } else { -+ codingLine[0] = 0; -+ a0i = 0; -+ blackPixels = 0; -+ while (codingLine[a0i] < columns) { -+ code1 = 0; -+ if (blackPixels) { -+ do { -+ code1 += code3 = getBlackCode(); -+ } while (code3 >= 64); -+ } else { -+ do { -+ code1 += code3 = getWhiteCode(); -+ } while (code3 >= 64); -+ } -+ addPixels(codingLine[a0i] + code1, blackPixels); -+ blackPixels ^= 1; -+ } -+ } -+ -+ // byte-align the row -+ if (byteAlign) { -+ inputBits &= ~7; -+ } -+ -+ // check for end-of-line marker, skipping over any extra zero bits -+ gotEOL = gFalse; -+ if (!endOfBlock && row == rows - 1) { -+ eof = gTrue; -+ } else { -+ code1 = lookBits(12); -+ while (code1 == 0) { -+ eatBits(1); -+ code1 = lookBits(12); -+ } -+ if (code1 == 0x001) { -+ eatBits(12); -+ gotEOL = gTrue; -+ } else if (code1 == EOF) { -+ eof = gTrue; -+ } -+ } -+ -+ // get 2D encoding tag -+ if (!eof && encoding > 0) { -+ nextLine2D = !lookBits(1); -+ eatBits(1); -+ } -+ -+ // check for end-of-block marker -+ if (endOfBlock && gotEOL) { -+ code1 = lookBits(12); -+ if (code1 == 0x001) { -+ eatBits(12); -+ if (encoding > 0) { -+ lookBits(1); -+ eatBits(1); -+ } -+ if (encoding >= 0) { -+ for (i = 0; i < 4; ++i) { -+ code1 = lookBits(12); -+ if (code1 != 0x001) { -+ error(getPos(), "Bad RTC code in CCITTFax stream"); -+ } -+ eatBits(12); -+ if (encoding > 0) { -+ lookBits(1); -+ eatBits(1); -+ } -+ } -+ } -+ eof = gTrue; -+ } -+ -+ // look for an end-of-line marker after an error -- we only do -+ // this if we know the stream contains end-of-line markers because -+ // the "just plow on" technique tends to work better otherwise -+ } else if (err && endOfLine) { -+ while (1) { -+ code1 = lookBits(13); -+ if (code1 == EOF) { -+ eof = gTrue; -+ return EOF; -+ } -+ if ((code1 >> 1) == 0x001) { -+ break; -+ } -+ eatBits(1); -+ } -+ eatBits(12); -+ if (encoding > 0) { -+ eatBits(1); -+ nextLine2D = !(code1 & 1); -+ } -+ } -+ -+ // set up for output -+ if (codingLine[0] > 0) { -+ outputBits = codingLine[a0i = 0]; -+ } else { -+ outputBits = codingLine[a0i = 1]; -+ } -+ -+ ++row; -+ } -+ -+ // get a byte -+ if (outputBits >= 8) { -+ buf = (a0i & 1) ? 0x00 : 0xff; -+ outputBits -= 8; -+ if (outputBits == 0 && codingLine[a0i] < columns) { -+ ++a0i; -+ outputBits = codingLine[a0i] - codingLine[a0i - 1]; -+ } -+ } else { -+ bits = 8; -+ buf = 0; -+ do { -+ if (outputBits > bits) { -+ buf <<= bits; -+ if (!(a0i & 1)) { -+ buf |= 0xff >> (8 - bits); -+ } -+ outputBits -= bits; -+ bits = 0; -+ } else { -+ buf <<= outputBits; -+ if (!(a0i & 1)) { -+ buf |= 0xff >> (8 - outputBits); -+ } -+ bits -= outputBits; -+ outputBits = 0; -+ if (codingLine[a0i] < columns) { -+ ++a0i; -+ outputBits = codingLine[a0i] - codingLine[a0i - 1]; -+ } else if (bits > 0) { -+ buf <<= bits; -+ bits = 0; -+ } -+ } -+ } while (bits); -+ } -+ if (black) { -+ buf ^= 0xff; -+ } -+ return buf; -+} -+ -+short CCITTFaxStream::getTwoDimCode() { -+ short code; -+ CCITTCode *p; -+ int n; -+ -+ code = 0; // make gcc happy -+ if (endOfBlock) { -+ code = lookBits(7); -+ p = &twoDimTab1[code]; -+ if (p->bits > 0) { -+ eatBits(p->bits); -+ return p->n; -+ } -+ } else { -+ for (n = 1; n <= 7; ++n) { -+ code = lookBits(n); -+ if (n < 7) { -+ code <<= 7 - n; -+ } -+ p = &twoDimTab1[code]; -+ if (p->bits == n) { -+ eatBits(n); -+ return p->n; -+ } -+ } -+ } -+ error(getPos(), "Bad two dim code (%04x) in CCITTFax stream", code); -+ return EOF; -+} -+ -+short CCITTFaxStream::getWhiteCode() { -+ short code; -+ CCITTCode *p; -+ int n; -+ -+ code = 0; // make gcc happy -+ if (endOfBlock) { -+ code = lookBits(12); -+ if (code == EOF) { -+ return 1; -+ } -+ if ((code >> 5) == 0) { -+ p = &whiteTab1[code]; -+ } else { -+ p = &whiteTab2[code >> 3]; -+ } -+ if (p->bits > 0) { -+ eatBits(p->bits); -+ return p->n; -+ } -+ } else { -+ for (n = 1; n <= 9; ++n) { -+ code = lookBits(n); -+ if (code == EOF) { -+ return 1; -+ } -+ if (n < 9) { -+ code <<= 9 - n; -+ } -+ p = &whiteTab2[code]; -+ if (p->bits == n) { -+ eatBits(n); -+ return p->n; -+ } -+ } -+ for (n = 11; n <= 12; ++n) { -+ code = lookBits(n); -+ if (code == EOF) { -+ return 1; -+ } -+ if (n < 12) { -+ code <<= 12 - n; -+ } -+ p = &whiteTab1[code]; -+ if (p->bits == n) { -+ eatBits(n); -+ return p->n; -+ } -+ } -+ } -+ error(getPos(), "Bad white code (%04x) in CCITTFax stream", code); -+ // eat a bit and return a positive number so that the caller doesn't -+ // go into an infinite loop -+ eatBits(1); -+ return 1; -+} -+ -+short CCITTFaxStream::getBlackCode() { -+ short code; -+ CCITTCode *p; -+ int n; -+ -+ code = 0; // make gcc happy -+ if (endOfBlock) { -+ code = lookBits(13); -+ if (code == EOF) { -+ return 1; -+ } -+ if ((code >> 7) == 0) { -+ p = &blackTab1[code]; -+ } else if ((code >> 9) == 0 && (code >> 7) != 0) { -+ p = &blackTab2[(code >> 1) - 64]; -+ } else { -+ p = &blackTab3[code >> 7]; -+ } -+ if (p->bits > 0) { -+ eatBits(p->bits); -+ return p->n; -+ } -+ } else { -+ for (n = 2; n <= 6; ++n) { -+ code = lookBits(n); -+ if (code == EOF) { -+ return 1; -+ } -+ if (n < 6) { -+ code <<= 6 - n; -+ } -+ p = &blackTab3[code]; -+ if (p->bits == n) { -+ eatBits(n); -+ return p->n; -+ } -+ } -+ for (n = 7; n <= 12; ++n) { -+ code = lookBits(n); -+ if (code == EOF) { -+ return 1; -+ } -+ if (n < 12) { -+ code <<= 12 - n; -+ } -+ if (code >= 64) { -+ p = &blackTab2[code - 64]; -+ if (p->bits == n) { -+ eatBits(n); -+ return p->n; -+ } -+ } -+ } -+ for (n = 10; n <= 13; ++n) { -+ code = lookBits(n); -+ if (code == EOF) { -+ return 1; -+ } -+ if (n < 13) { -+ code <<= 13 - n; -+ } -+ p = &blackTab1[code]; -+ if (p->bits == n) { -+ eatBits(n); -+ return p->n; -+ } -+ } -+ } -+ error(getPos(), "Bad black code (%04x) in CCITTFax stream", code); -+ // eat a bit and return a positive number so that the caller doesn't -+ // go into an infinite loop -+ eatBits(1); -+ return 1; -+} -+ -+short CCITTFaxStream::lookBits(int n) { -+ int c; -+ -+ while (inputBits < n) { -+ if ((c = str->getChar()) == EOF) { -+ if (inputBits == 0) { -+ return EOF; -+ } -+ // near the end of the stream, the caller may ask for more bits -+ // than are available, but there may still be a valid code in -+ // however many bits are available -- we need to return correct -+ // data in this case -+ return (inputBuf << (n - inputBits)) & (0xffff >> (16 - n)); -+ } -+ inputBuf = (inputBuf << 8) + c; -+ inputBits += 8; -+ } -+ return (inputBuf >> (inputBits - n)) & (0xffff >> (16 - n)); -+} -+ -+#endif - - GString *CCITTFaxStream::getPSFilter(const char *indent) { - GString *s; -@@ -1929,6 +2533,12 @@ - // allocate a buffer for the whole image - bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; - bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight; -+ if (bufWidth <= 0 || bufHeight <= 0 || -+ bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { -+ error(getPos(), "Invalid image size in DCT stream"); -+ y = height; -+ return; -+ } - for (i = 0; i < numComps; ++i) { - frameBuf[i] = (int *)gmalloc(bufWidth * bufHeight * sizeof(int)); - memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int)); -@@ -2975,6 +3585,11 @@ - } - scanInfo.firstCoeff = str->getChar(); - scanInfo.lastCoeff = str->getChar(); -+ if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 || -+ scanInfo.firstCoeff > scanInfo.lastCoeff) { -+ error(getPos(), "Bad DCT coefficient numbers in scan info block"); -+ return gFalse; -+ } - c = str->getChar(); - scanInfo.ah = (c >> 4) & 0x0f; - scanInfo.al = c & 0x0f; ---- filters/kword/pdf/xpdf/xpdf/Stream.h -+++ filters/kword/pdf/xpdf/xpdf/Stream.h -@@ -513,13 +513,17 @@ - int row; // current row - int inputBuf; // input buffer - int inputBits; // number of bits in input buffer -- short *refLine; // reference line changing elements -- int b1; // index into refLine -- short *codingLine; // coding line changing elements -- int a0; // index into codingLine -+ int *codingLine; // coding line changing elements -+ int *refLine; // reference line changing elements -+ int a0i; // index into codingLine -+ GBool err; // error on current line -+ - int outputBits; // remaining output bits - int buf; // character buffer - -+ void addPixels(int a1, int black); -+ void addPixelsNeg(int a1, int black); -+ - short getTwoDimCode(); - short getWhiteCode(); - short getBlackCode(); diff --git a/app-office/kword/files/koffice-xpdf-CVE-2007-0104.diff b/app-office/kword/files/koffice-xpdf-CVE-2007-0104.diff deleted file mode 100644 index f5e51a1c706e..000000000000 --- a/app-office/kword/files/koffice-xpdf-CVE-2007-0104.diff +++ /dev/null @@ -1,74 +0,0 @@ ------------------------------------------------------------------------- -r622463 | aacid | 2007-01-11 23:05:54 +0100 (Thu, 11 Jan 2007) | 2 lines -Changed paths: - M /branches/koffice/1.6/koffice/filters/kword/pdf/xpdf/xpdf/Catalog.cc - M /branches/koffice/1.6/koffice/filters/kword/pdf/xpdf/xpdf/Catalog.h - -Commiting the patch agreed between kpdf and poppler developers to fix MOAB-06-01-2007 issue. - ------------------------------------------------------------------------- -Index: filters/kword/pdf/xpdf/xpdf/Catalog.cc -=================================================================== ---- filters/kword/pdf/xpdf/xpdf/Catalog.cc (revision 622462) -+++ filters/kword/pdf/xpdf/xpdf/Catalog.cc (revision 622463) -@@ -24,6 +24,12 @@ - #include "Link.h" - #include "Catalog.h" - -+// This define is used to limit the depth of recursive readPageTree calls -+// This is needed because the page tree nodes can reference their parents -+// leaving us in an infinite loop -+// Most sane pdf documents don't have a call depth higher than 10 -+#define MAX_CALL_DEPTH 1000 -+ - //------------------------------------------------------------------------ - // Catalog - //------------------------------------------------------------------------ -@@ -77,7 +83,7 @@ Catalog::Catalog(XRef *xrefA) { - pageRefs[i].num = -1; - pageRefs[i].gen = -1; - } -- numPages = readPageTree(pagesDict.getDict(), NULL, 0); -+ numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0); - if (numPages != numPages0) { - error(-1, "Page count in top-level pages object is incorrect"); - } -@@ -171,7 +177,7 @@ GString *Catalog::readMetadata() { - return s; - } - --int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) { -+int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) { - Object kids; - Object kid; - Object kidRef; -@@ -221,9 +227,13 @@ int Catalog::readPageTree(Dict *pagesDic - // This should really be isDict("Pages"), but I've seen at least one - // PDF file where the /Type entry is missing. - } else if (kid.isDict()) { -- if ((start = readPageTree(kid.getDict(), attrs1, start)) -- < 0) -- goto err2; -+ if (callDepth > MAX_CALL_DEPTH) { -+ error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH); -+ } else { -+ if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1)) -+ < 0) -+ goto err2; -+ } - } else { - error(-1, "Kid object (page %d) is wrong type (%s)", - start+1, kid.getTypeName()); -Index: filters/kword/pdf/xpdf/xpdf/Catalog.h -=================================================================== ---- filters/kword/pdf/xpdf/xpdf/Catalog.h (revision 622462) -+++ filters/kword/pdf/xpdf/xpdf/Catalog.h (revision 622463) -@@ -82,7 +82,7 @@ private: - Object outline; // outline dictionary - GBool ok; // true if catalog is valid - -- int readPageTree(Dict *pages, PageAttrs *attrs, int start); -+ int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth); - Object *findDestInTree(Object *tree, GString *name, Object *obj); - }; - diff --git a/app-office/kword/files/koffice-xpdf-CVE-2007-3387.diff b/app-office/kword/files/koffice-xpdf-CVE-2007-3387.diff deleted file mode 100644 index ded0e07205a7..000000000000 --- a/app-office/kword/files/koffice-xpdf-CVE-2007-3387.diff +++ /dev/null @@ -1,20 +0,0 @@ ---- filters/kword/pdf/xpdf/xpdf/Stream.cc -+++ filters/kword/pdf/xpdf/xpdf/Stream.cc -@@ -413,13 +413,11 @@ StreamPredictor::StreamPredictor(Stream - predLine = NULL; - ok = gFalse; - -- if (width <= 0 || nComps <= 0 || nBits <= 0 || -- nComps >= INT_MAX / nBits || -- width >= INT_MAX / nComps / nBits) -- return; -- - nVals = width * nComps; -- if (nVals * nBits + 7 <= 0) -+ if (width <= 0 || nComps <= 0 || nBits <= 0 || -+ nComps >= 4 || nBits > 16 || -+ width >= INT_MAX / nComps || -+ nVals >= (INT_MAX - 7) / nBits) - return; - - pixBytes = (nComps * nBits + 7) >> 3; diff --git a/app-office/kword/files/kword-gcc43.patch b/app-office/kword/files/kword-gcc43.patch deleted file mode 100644 index 7da230f4fac4..000000000000 --- a/app-office/kword/files/kword-gcc43.patch +++ /dev/null @@ -1,22 +0,0 @@ ---- branches/koffice/1.6/koffice/filters/kword/wordperfect/import/TableStyle.cxx 2007/10/26 14:06:42 729649 -+++ branches/koffice/1.6/koffice/filters/kword/wordperfect/import/TableStyle.cxx 2007/10/26 14:20:47 729650 -@@ -36,6 +36,8 @@ - #include <minmax.h> - #endif - -+#include <cstring> -+ - TableCellStyle::TableCellStyle(const WPXPropertyList &xPropList, const char *psName) : - Style(psName), - mPropList(xPropList) ---- branches/koffice/1.6/koffice/filters/kword/wordperfect/import/TextRunStyle.cxx 2007/10/26 17:51:34 729711 -+++ branches/koffice/1.6/koffice/filters/kword/wordperfect/import/TextRunStyle.cxx 2007/10/26 17:51:55 729712 -@@ -37,6 +37,8 @@ - #include <minmax.h> - #endif - -+#include <cstring> -+ - ParagraphStyle::ParagraphStyle(WPXPropertyList *pPropList, const WPXPropertyListVector &xTabStops, const WPXString &sName) : - mpPropList(pPropList), - mxTabStops(xTabStops), diff --git a/app-office/kword/kword-1.6.3-r2.ebuild b/app-office/kword/kword-1.6.3-r2.ebuild deleted file mode 100644 index 76a2522d010a..000000000000 --- a/app-office/kword/kword-1.6.3-r2.ebuild +++ /dev/null @@ -1,65 +0,0 @@ -# Copyright 1999-2009 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/app-office/kword/kword-1.6.3-r2.ebuild,v 1.10 2009/06/30 21:38:23 tampakrap Exp $ - -KMNAME=koffice -MAXKOFFICEVER=${PV} -inherit kde-meta eutils - -DESCRIPTION="KOffice word processor." -HOMEPAGE="http://www.koffice.org/" -LICENSE="GPL-2 LGPL-2" - -SLOT="3.5" -KEYWORDS="alpha amd64 hppa ia64 ppc ppc64 sparc x86 ~x86-fbsd" -IUSE="" - -RDEPEND="$(deprange $PV $MAXKOFFICEVER app-office/koffice-libs) - $(deprange 1.6.2 $MAXKOFFICEVER app-office/kspread) - >=app-text/wv2-0.1.8 - >=media-gfx/imagemagick-5.5.2 - >=app-text/libwpd-0.8.2" - -DEPEND="${RDEPEND} - dev-util/pkgconfig" - -KMCOPYLIB="libkformula lib/kformula - libkofficecore lib/kofficecore - libkofficeui lib/kofficeui - libkopainter lib/kopainter - libkotext lib/kotext - libkwmf lib/kwmf - libkowmf lib/kwmf - libkstore lib/store - libkspreadcommon kspread" - -KMEXTRACTONLY=" - lib/ - kspread/" - -KMCOMPILEONLY="filters/liboofilter" - -KMEXTRA="filters/kword" - -need-kde 3.5 - -PATCHES=( "${FILESDIR}/koffice-xpdf-CVE-2007-3387.diff - ${FILESDIR}/koffice-1.6.3-xpdf2-CVE-2007-4352-5392-5393.diff - ${FILESDIR}/${PN}-gcc43.patch - ${FILESDIR}/${P}-gcc44.patch" ) - -src_unpack() { - kde-meta_src_unpack unpack - - # We need to compile libs first - echo "SUBDIRS = liboofilter kword" > "$S"/filters/Makefile.am - - for i in $(find "${S}"/lib -iname "*\.ui"); do - ${QTDIR}/bin/uic ${i} > ${i%.ui}.h - done - - kde-meta_src_unpack makefiles - - # Fix the desktop file. cf. bug 190006 - sed -i -e "s:x-mswrite:x-mswrite;:g" "${S}"/kword/kword.desktop -} |