aboutsummaryrefslogtreecommitdiff
path: root/graphics/kdegraphics3/files/patch-post-3.5.5-kdegraphics-CVE-2007-0104.diff
diff options
context:
space:
mode:
Diffstat (limited to 'graphics/kdegraphics3/files/patch-post-3.5.5-kdegraphics-CVE-2007-0104.diff')
-rw-r--r--graphics/kdegraphics3/files/patch-post-3.5.5-kdegraphics-CVE-2007-0104.diff61
1 files changed, 0 insertions, 61 deletions
diff --git a/graphics/kdegraphics3/files/patch-post-3.5.5-kdegraphics-CVE-2007-0104.diff b/graphics/kdegraphics3/files/patch-post-3.5.5-kdegraphics-CVE-2007-0104.diff
deleted file mode 100644
index 092cf67f360b..000000000000
--- a/graphics/kdegraphics3/files/patch-post-3.5.5-kdegraphics-CVE-2007-0104.diff
+++ /dev/null
@@ -1,61 +0,0 @@
---- kpdf/xpdf/xpdf/Catalog.cc
-+++ kpdf/xpdf/xpdf/Catalog.cc
-@@ -26,6 +26,12 @@
- #include "UGString.h"
- #include "Catalog.h"
-
-+// This define is used to limit the depth of recursive readPageTree calls
-+// This is needed because the page tree nodes can reference their parents
-+// leaving us in an infinite loop
-+// Most sane pdf documents don't have a call depth higher than 10
-+#define MAX_CALL_DEPTH 1000
-+
- //------------------------------------------------------------------------
- // Catalog
- //------------------------------------------------------------------------
-@@ -76,7 +82,7 @@ Catalog::Catalog(XRef *xrefA) {
- pageRefs[i].num = -1;
- pageRefs[i].gen = -1;
- }
-- numPages = readPageTree(pagesDict.getDict(), NULL, 0);
-+ numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0);
- if (numPages != numPages0) {
- error(-1, "Page count in top-level pages object is incorrect");
- }
-@@ -191,7 +197,7 @@ GString *Catalog::readMetadata() {
- return s;
- }
-
--int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) {
-+int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) {
- Object kids;
- Object kid;
- Object kidRef;
-@@ -236,9 +242,13 @@ int Catalog::readPageTree(Dict *pagesDic
- // This should really be isDict("Pages"), but I've seen at least one
- // PDF file where the /Type entry is missing.
- } else if (kid.isDict()) {
-- if ((start = readPageTree(kid.getDict(), attrs1, start))
-- < 0)
-- goto err2;
-+ if (callDepth > MAX_CALL_DEPTH) {
-+ error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH);
-+ } else {
-+ if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1))
-+ < 0)
-+ goto err2;
-+ }
- } else {
- error(-1, "Kid object (page %d) is wrong type (%s)",
- start+1, kid.getTypeName());
---- kpdf/xpdf/xpdf/Catalog.h
-+++ kpdf/xpdf/xpdf/Catalog.h
-@@ -128,7 +128,7 @@ private:
- Object acroForm; // AcroForm dictionary
- GBool ok; // true if catalog is valid
-
-- int readPageTree(Dict *pages, PageAttrs *attrs, int start);
-+ int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth);
- Object *findDestInTree(Object *tree, GString *name, Object *obj);
- };
-