fix for #117494

(Portage version: 2.0.54)

5 files changed, 387 insertions, 32 deletions

diff --git a/app-text/gpdf/ChangeLog b/app-text/gpdf/ChangeLog
index 665883f79633..59e1976b7876 100644
--- a/app-text/gpdf/ChangeLog
+++ b/app-text/gpdf/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-text/gpdf
-# Copyright 2000-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-text/gpdf/ChangeLog,v 1.111 2005/12/14 11:32:59 ferdy Exp $
+# Copyright 2000-2006 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/app-text/gpdf/ChangeLog,v 1.112 2006/01/27 22:05:01 allanonjl Exp $
+
+*gpdf-2.10.0-r3 (27 Jan 2006)
+
+  27 Jan 2006; John N. Laliberte <allanonjl@gentoo.org>
+  +files/gpdf-2.10.0-2006-01-16-xpdf.patch, +gpdf-2.10.0-r3.ebuild:
+  fix for #117494
 
   14 Dec 2005; Fernando J. Pereda <ferdy@gentoo.org> gpdf-2.10.0-r2.ebuild:
   stable on alpha wrt bug #114428
diff --git a/app-text/gpdf/Manifest b/app-text/gpdf/Manifest
index 5428e019c5b8..126342de5066 100644
--- a/app-text/gpdf/Manifest
+++ b/app-text/gpdf/Manifest
@@ -1,36 +1,29 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
-MD5 a805385ef63f46517fcdf018fb0e08d9 gpdf-0.132-r2.ebuild 1169
-MD5 3ec94b0d7a37f7330404f3197c6bfbcd gpdf-2.8.2.ebuild 1130
-MD5 7d7e2cbba590130c10d7b18a3988c3c0 gpdf-2.10.0-r2.ebuild 1406
-MD5 87c5a4b5771c292e1dbcc39fee7d4a55 gpdf-2.10.0.ebuild 1264
-MD5 d094dcab1afd170dae62b054d98e3acb gpdf-0.132-r1.ebuild 1025
-MD5 8c3d9a19dbb04dec0a18a5189e9a36d6 gpdf-2.10.0-r1.ebuild 1337
-MD5 b492633bcb5170b71ce72fb7d24545c5 gpdf-2.8.3.ebuild 1153
 MD5 227a131debc0997c363e2275d129a064 ChangeLog 12165
-MD5 03ad2e6c4ab41244af1015a8bbb0b39f metadata.xml 158
-MD5 362296e34a1a04a6e5e2a7d9e97547c6 files/gpdf-xpdf2_underflow.patch 2363
-MD5 791fcfed94116d7bd13ff7868b9727d5 files/gpdf-2.10.0-CAN-2005-3193.patch 3880
-MD5 2a2fc64147e806f72bdda9e2e66731a0 files/digest-gpdf-2.8.2 64
-MD5 5bc556bc031d2f6ed2e0b609253e8b93 files/digest-gpdf-2.8.3 64
-MD5 c32a612ce419b9930ff273cf382558bf files/gpdf-xpdf-3.00pl3.patch 346
-MD5 2fce5bedd61300fad1566a41f991a782 files/gpdf-xpdf_goo_sizet.patch 1424
-MD5 651529b6e386b3a73ffd9cc0c19e9661 files/gpdf-xpdf-CAN-2004-1125.patch 1666
+MD5 167bcfd9a6e435acc241c07dc522b562 files/digest-gpdf-0.132-r1 64
+MD5 167bcfd9a6e435acc241c07dc522b562 files/digest-gpdf-0.132-r2 64
 MD5 388d05f1aabd1c48c3536ac69d0d8505 files/digest-gpdf-2.10.0 65
-MD5 5e63c86e19a1c1387cab38b7e2902c9e files/gpdf-xpdf_3_CAN-2004-0889.patch 8115
 MD5 388d05f1aabd1c48c3536ac69d0d8505 files/digest-gpdf-2.10.0-r1 65
 MD5 388d05f1aabd1c48c3536ac69d0d8505 files/digest-gpdf-2.10.0-r2 65
-MD5 167bcfd9a6e435acc241c07dc522b562 files/digest-gpdf-0.132-r1 64
-MD5 167bcfd9a6e435acc241c07dc522b562 files/digest-gpdf-0.132-r2 64
-MD5 610ea361ff30d6f30e4075d5bdb44806 files/gpdf-2.8.2-CAN-2005-2097.patch 1973
+MD5 388d05f1aabd1c48c3536ac69d0d8505 files/digest-gpdf-2.10.0-r3 65
+MD5 2a2fc64147e806f72bdda9e2e66731a0 files/digest-gpdf-2.8.2 64
+MD5 5bc556bc031d2f6ed2e0b609253e8b93 files/digest-gpdf-2.8.3 64
+MD5 9336bbbfbb54ba88fb5e4aba2da1833f files/gpdf-0.112-remove_gtk24_call.patch 607
+MD5 f2bd038a93ff5e20983d08d9c5d11e5e files/gpdf-2.10.0-2006-01-16-xpdf.patch 8708
+MD5 791fcfed94116d7bd13ff7868b9727d5 files/gpdf-2.10.0-CAN-2005-3193.patch 3880
 MD5 ba500e3211d62fc797db36fdcf1e2b76 files/gpdf-2.10.0-amd64-gcc4.patch 945
+MD5 610ea361ff30d6f30e4075d5bdb44806 files/gpdf-2.8.2-CAN-2005-2097.patch 1973
+MD5 c32a612ce419b9930ff273cf382558bf files/gpdf-xpdf-3.00pl3.patch 346
+MD5 651529b6e386b3a73ffd9cc0c19e9661 files/gpdf-xpdf-CAN-2004-1125.patch 1666
+MD5 362296e34a1a04a6e5e2a7d9e97547c6 files/gpdf-xpdf2_underflow.patch 2363
 MD5 b32f90fc9249d1f7434659642b36f9d9 files/gpdf-xpdf_2_CAN-2004-0888.patch 2716
-MD5 9336bbbfbb54ba88fb5e4aba2da1833f files/gpdf-0.112-remove_gtk24_call.patch 607
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.2 (GNU/Linux)
-
-iD8DBQFDoAMZViELBEf1JB0RAh/5AJwLQZwo5h2rjl7ks1yvV0fMmWLMnACdHD8A
-r3b6ix+DvsYDmzIP7DjflWs=
-=C1Ca
------END PGP SIGNATURE-----
+MD5 5e63c86e19a1c1387cab38b7e2902c9e files/gpdf-xpdf_3_CAN-2004-0889.patch 8115
+MD5 2fce5bedd61300fad1566a41f991a782 files/gpdf-xpdf_goo_sizet.patch 1424
+MD5 d094dcab1afd170dae62b054d98e3acb gpdf-0.132-r1.ebuild 1025
+MD5 a805385ef63f46517fcdf018fb0e08d9 gpdf-0.132-r2.ebuild 1169
+MD5 8c3d9a19dbb04dec0a18a5189e9a36d6 gpdf-2.10.0-r1.ebuild 1337
+MD5 7d7e2cbba590130c10d7b18a3988c3c0 gpdf-2.10.0-r2.ebuild 1406
+MD5 0820e548ef708dc4952460078e33683e gpdf-2.10.0-r3.ebuild 1415
+MD5 87c5a4b5771c292e1dbcc39fee7d4a55 gpdf-2.10.0.ebuild 1264
+MD5 3ec94b0d7a37f7330404f3197c6bfbcd gpdf-2.8.2.ebuild 1130
+MD5 b492633bcb5170b71ce72fb7d24545c5 gpdf-2.8.3.ebuild 1153
+MD5 03ad2e6c4ab41244af1015a8bbb0b39f metadata.xml 158
diff --git a/app-text/gpdf/files/digest-gpdf-2.10.0-r3 b/app-text/gpdf/files/digest-gpdf-2.10.0-r3
new file mode 100644
index 000000000000..05bc0c9effe5
--- /dev/null
+++ b/app-text/gpdf/files/digest-gpdf-2.10.0-r3
@@ -0,0 +1 @@
+MD5 9278cd3b9d06e3b1d364452f0e512fa9 gpdf-2.10.0.tar.bz2 1079944
diff --git a/app-text/gpdf/files/gpdf-2.10.0-2006-01-16-xpdf.patch b/app-text/gpdf/files/gpdf-2.10.0-2006-01-16-xpdf.patch
new file mode 100644
index 000000000000..63a9c6cb612b
--- /dev/null
+++ b/app-text/gpdf/files/gpdf-2.10.0-2006-01-16-xpdf.patch
@@ -0,0 +1,296 @@
+Index: xpdf-3.00/xpdf/JPXStream.cc
+===================================================================
+--- xpdf-3.00.orig/xpdf/JPXStream.cc
++++ xpdf-3.00/xpdf/JPXStream.cc
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -666,7 +667,7 @@ GBool JPXStream::readCodestream(Guint le
+   int segType;
+   GBool haveSIZ, haveCOD, haveQCD, haveSOT;
+   Guint precinctSize, style;
+-  Guint segLen, capabilities, comp, i, j, r;
++  Guint segLen, capabilities, nTiles, comp, i, j, r;
+ 
+   //----- main header
+   haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
+@@ -701,8 +702,19 @@ GBool JPXStream::readCodestream(Guint le
+ 	            / img.xTileSize;
+       img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
+ 	            / img.yTileSize;
+-      img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles *
+-				     sizeof(JPXTile));
++      // check for overflow before allocating memory
++      if (img.nXTiles <= 0 || img.nYTiles <= 0 || 
++              img.nXTiles >= INT_MAX/img.nYTiles) {
++          error(getPos(), "Bad tile count in JPX SIZ marker segment");
++          return gFalse;
++      }
++      nTiles = img.nXTiles * img.nYTiles;
++      if (nTiles >= INT_MAX/sizeof(JPXTile)) {
++	error(getPos(), "Bad tile count in JPX SIZ marker segment");
++	return gFalse;
++      }
++      img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile));
++
+       for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
+ 	img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps *
+ 							sizeof(JPXTileComp));
+Index: xpdf-3.00/xpdf/Stream.h
+===================================================================
+--- xpdf-3.00.orig/xpdf/Stream.h
++++ xpdf-3.00/xpdf/Stream.h
+@@ -233,6 +233,8 @@ public:
+ 
+   ~StreamPredictor();
+ 
++  GBool isOk() { return ok; }
++
+   int lookChar();
+   int getChar();
+ 
+@@ -250,6 +252,7 @@ private:
+   int rowBytes;			// bytes per line
+   Guchar *predLine;		// line buffer
+   int predIdx;			// current index in predLine
++  GBool ok;
+ };
+ 
+ //------------------------------------------------------------------------
+Index: xpdf-3.00/xpdf/Stream.cc
+===================================================================
+--- xpdf-3.00.orig/xpdf/Stream.cc
++++ xpdf-3.00/xpdf/Stream.cc
+@@ -15,6 +15,7 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <stddef.h>
++#include <limits.h>
+ #ifndef WIN32
+ #include <unistd.h>
+ #endif
+@@ -412,13 +413,28 @@ StreamPredictor::StreamPredictor(Stream 
+   width = widthA;
+   nComps = nCompsA;
+   nBits = nBitsA;
++  predLine = NULL;
++  ok = gFalse;
+ 
++  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
++      nComps >= INT_MAX/nBits ||
++      width >= INT_MAX/nComps/nBits) {
++    return;
++  }
+   nVals = width * nComps;
++  if (nVals * nBits + 7 <= 0) {
++    return;
++  }
+   pixBytes = (nComps * nBits + 7) >> 3;
+   rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
++  if (rowBytes < 0) {
++    return;
++  }
+   predLine = (Guchar *)gmalloc(rowBytes);
+   memset(predLine, 0, rowBytes);
+   predIdx = rowBytes;
++
++  ok = gTrue;
+ }
+ 
+ StreamPredictor::~StreamPredictor() {
+@@ -1012,6 +1028,10 @@ LZWStream::LZWStream(Stream *strA, int p
+     FilterStream(strA) {
+   if (predictor != 1) {
+     pred = new StreamPredictor(this, predictor, columns, colors, bits);
++    if (!pred->isOk()) {
++      delete pred;
++      pred = NULL;
++    }
+   } else {
+     pred = NULL;
+   }
+@@ -1260,6 +1280,10 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
+   endOfLine = endOfLineA;
+   byteAlign = byteAlignA;
+   columns = columnsA;
++  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
++    error(-1, "invalid number of columns: %d", columns);
++    exit(1);
++  }
+   rows = rowsA;
+   endOfBlock = endOfBlockA;
+   black = blackA;
+@@ -2897,6 +2921,11 @@ GBool DCTStream::readBaselineSOF() {
+   height = read16();
+   width = read16();
+   numComps = str->getChar();
++  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   if (prec != 8) {
+     error(getPos(), "Bad DCT precision %d", prec);
+     return gFalse;
+@@ -2923,6 +2952,11 @@ GBool DCTStream::readProgressiveSOF() {
+   height = read16();
+   width = read16();
+   numComps = str->getChar();
++  if (numComps <= 0 || numComps > 4) {
++    numComps = 0;
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   if (prec != 8) {
+     error(getPos(), "Bad DCT precision %d", prec);
+     return gFalse;
+@@ -2945,6 +2979,11 @@ GBool DCTStream::readScanInfo() {
+ 
+   length = read16() - 2;
+   scanInfo.numComps = str->getChar();
++  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
++    scanInfo.numComps = 0;
++    error(getPos(), "Bad number of components in DCT stream");
++    return gFalse;
++  }
+   --length;
+   if (length != 2 * scanInfo.numComps + 3) {
+     error(getPos(), "Bad DCT scan info block");
+@@ -3019,12 +3058,12 @@ GBool DCTStream::readHuffmanTables() {
+   while (length > 0) {
+     index = str->getChar();
+     --length;
+-    if ((index & 0x0f) >= 4) {
++    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
+       error(getPos(), "Bad DCT Huffman table");
+       return gFalse;
+     }
+     if (index & 0x10) {
+-      index &= 0x0f;
++      index &= 0x03;
+       if (index >= numACHuffTables)
+ 	numACHuffTables = index+1;
+       tbl = &acHuffTables[index];
+@@ -3142,9 +3181,11 @@ int DCTStream::readMarker() {
+   do {
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c != 0xff);
+     do {
+       c = str->getChar();
++      if(c == EOF) return EOF;
+     } while (c == 0xff);
+   } while (c == 0x00);
+   return c;
+@@ -3255,6 +3296,10 @@ FlateStream::FlateStream(Stream *strA, i
+     FilterStream(strA) {
+   if (predictor != 1) {
+     pred = new StreamPredictor(this, predictor, columns, colors, bits);
++    if (!pred->isOk()) {
++      delete pred;
++      pred = NULL;
++    }
+   } else {
+     pred = NULL;
+   }
+Index: xpdf-3.00/xpdf/JBIG2Stream.cc
+===================================================================
+--- xpdf-3.00.orig/xpdf/JBIG2Stream.cc
++++ xpdf-3.00/xpdf/JBIG2Stream.cc
+@@ -7,6 +7,7 @@
+ //========================================================================
+ 
+ #include <aconf.h>
++#include <limits.h>
+ 
+ #ifdef USE_GCC_PRAGMAS
+ #pragma implementation
+@@ -681,7 +682,16 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = wA;
+   h = hA;
+   line = (wA + 7) >> 3;
+-  data = (Guchar *)gmalloc(h * line);
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
++  // need to allocate one extra guard byte for use in combine()
++  data = (Guchar *)gmalloc(h * line + 1);
++  data[h * line] = 0;
+ }
+ 
+ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, JBIG2Bitmap *bitmap):
+@@ -690,8 +700,17 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, 
+   w = bitmap->w;
+   h = bitmap->h;
+   line = bitmap->line;
+-  data = (Guchar *)gmalloc(h * line);
++
++  if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
++    error(-1, "invalid width/height");
++    data = NULL;
++    return;
++  }
++
++  // need to allocate one extra guard byte for use in combine()
++  data = (Guchar *)gmalloc(h * line + 1);
+   memcpy(data, bitmap->data, h * line);
++  data[h * line] = 0;
+ }
+ 
+ JBIG2Bitmap::~JBIG2Bitmap() {
+@@ -716,10 +735,14 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
+ }
+ 
+ void JBIG2Bitmap::expand(int newH, Guint pixel) {
+-  if (newH <= h) {
++  if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) {
++    error(-1, "invalid width/height");
++    gfree(data);
++    data = NULL;
+     return;
+   }
+-  data = (Guchar *)grealloc(data, newH * line);
++  // need to allocate one extra guard byte for use in combine()
++  data = (Guchar *)grealloc(data, newH * line + 1);
+   if (pixel) {
+     memset(data + h * line, 0xff, (newH - h) * line);
+   } else {
+@@ -2256,6 +2279,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
+     error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
+     return;
+   }
++  if (gridH == 0 || gridW >= INT_MAX / gridH) {
++    error(getPos(), "Bad size in JBIG2 halftone segment");
++    return;
++  }
++  if (w == 0 || h >= INT_MAX / w) {
++     error(getPos(), "Bad size in JBIG2 bitmap segment");
++    return;
++  }
++
+   patternDict = (JBIG2PatternDict *)seg;
+   bpp = 0;
+   i = 1;
+@@ -2887,6 +2919,11 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
+   JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
+   int x, y, pix;
+ 
++  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
++    error(-1, "invalid width/height");
++    return NULL;
++  }
++
+   bitmap = new JBIG2Bitmap(0, w, h);
+   bitmap->clearToZero();
+ 
+# vim: syntax=diff
diff --git a/app-text/gpdf/gpdf-2.10.0-r3.ebuild b/app-text/gpdf/gpdf-2.10.0-r3.ebuild
new file mode 100644
index 000000000000..9d9b2119b94d
--- /dev/null
+++ b/app-text/gpdf/gpdf-2.10.0-r3.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2006 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-text/gpdf/gpdf-2.10.0-r3.ebuild,v 1.1 2006/01/27 22:05:01 allanonjl Exp $
+
+inherit gnome2 eutils
+
+DESCRIPTION="Viewer for Portable Document Format (PDF) files"
+HOMEPAGE="http://www.gnome.org/"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86"
+IUSE=""
+
+RDEPEND=">=x11-libs/gtk+-2.5.4
+	>=gnome-base/gconf-2
+	>=gnome-base/libgnomeui-2
+	>=gnome-base/libbonobo-2.2.1
+	>=gnome-base/libbonoboui-2
+	>=gnome-base/gnome-vfs-2
+	>=gnome-base/libgnomeprint-2.6
+	>=gnome-base/libgnomeprintui-2.2
+	>=gnome-base/libglade-2"
+
+DEPEND="${RDEPEND}
+	app-text/scrollkeeper
+	>=dev-util/intltool-0.29
+	>=dev-util/pkgconfig-0.12.0"
+
+PROVIDE="virtual/pdfviewer"
+
+DOCS="AUTHORS CHANGES ChangeLog NEWS README*"
+
+USE_DESTDIR="1"
+
+src_unpack() {
+
+	unpack ${A}
+
+	cd ${S}
+	# Fix sec vuln (#69662)
+	epatch ${FILESDIR}/${PN}-xpdf_goo_sizet.patch
+	# Fix building on amd64 with gcc4
+	epatch ${FILESDIR}/${P}-amd64-gcc4.patch
+	# Disable the tests, see bug #73882
+	sed -i -e "s:test-files::" Makefile.in
+	# Fix for bug #100265
+	epatch ${FILESDIR}/${PN}-2.8.2-CAN-2005-2097.patch
+	# fix for bug #117494
+	epatch ${FILESDIR}/${P}-2006-01-16-xpdf.patch
+}
+
+src_install() {
+
+	# fix #92920 FIXME
+	gnome2_src_install scrollkeeper_localstate_dir=${D}/var/lib/scrollkeeper/
+
+}
+