Source Mage code commit list

[Vlad Glagolev <scm AT sourcemage.org>]

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

 doc/mupdf/BUILD                          |    5 
 doc/mupdf/DEPENDS                        |   18 ++
 doc/mupdf/DETAILS                        |   16 +-
 doc/mupdf/HISTORY                        |   13 ++
 doc/mupdf/INSTALL                        |    2 
 doc/mupdf/PRE_BUILD                      |   14 ++
 doc/mupdf/mupdf-1.9-upstream_fix-1.patch |   28 ++++
 doc/mupdf/openjpeg-1.5.patch             |  187 
+++++++++++++++++++++++++++++++
 doc/mupdf/openjpeg-2.1.patch             |   37 ++++++
 9 files changed, 309 insertions(+), 11 deletions(-)

New commits:
commit bd83591c94edf1a5bf1ca10e3bd7b5a9fa475aab
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

    mupdf: => 1.9a [security]

diff --git a/doc/mupdf/BUILD b/doc/mupdf/BUILD
index 447d986..80705a7 100755
--- a/doc/mupdf/BUILD
+++ b/doc/mupdf/BUILD
@@ -1 +1,4 @@
-CFLAGS= LIBS= make XCFLAGS="$CFLAGS" XLIBS="$LDFLAGS" build=release verbose=1
+CFLAGS="-fstack-protector-all ${CFLAGS}" &&
+CXXFLAGS="-fstack-protector-all ${CXXFLAGS}" &&
+
+CFLAGS= LIBS= make XCFLAGS="$CFLAGS" XLIBS="$LDFLAGS" ${OPTS} build=release 
verbose=yes
diff --git a/doc/mupdf/DEPENDS b/doc/mupdf/DEPENDS
index 70e3d77..1738e92 100755
--- a/doc/mupdf/DEPENDS
+++ b/doc/mupdf/DEPENDS
@@ -1,7 +1,23 @@
 depends JPEG &&
 depends openjpeg &&
 depends freetype2 &&
+depends harfbuzz &&
 depends jbig2dec &&
 depends zlib &&
 depends libxext &&
-depends libx11
+depends libx11 &&
+
+optional_depends SSL \
+                 "HAVE_OPENSSL=yes" \
+                 "HAVE_OPENSSL=no" \
+                 "for signature support" &&
+
+optional_depends curl \
+                 "HAVE_CURL=yes" \
+                 "HAVE_CURL=no" \
+                 "for progressive loading support" &&
+
+optional_depends glfw \
+                 "HAVE_GLFW=yes" \
+                 "HAVE_GLFW=no" \
+                 "for OpenGL-based viewer"
diff --git a/doc/mupdf/DETAILS b/doc/mupdf/DETAILS
index 4bc117b..2b68715 100755
--- a/doc/mupdf/DETAILS
+++ b/doc/mupdf/DETAILS
@@ -1,22 +1,22 @@
            SPELL=mupdf
-         VERSION=1.6
-     
SOURCE_HASH=sha512:3a47d47b81550f531039153385fc22bb81a24df334706e23b7f118d08d97bb103566eef2a6ea3602ebe242fcb9d53304bb9d8230109572204491415a3a1b0645
+         VERSION=1.9a
           SOURCE=$SPELL-$VERSION-source.tar.gz
-SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION-source"
    SOURCE_URL[0]=http://mupdf.com/downloads/$SOURCE
    SOURCE_URL[1]=http://mupdf.com/downloads/archive/$SOURCE
+     
SOURCE_HASH=sha512:9f804fd65c2dc6b7a3bd73961b1f1a8bf93d52903cccf6302acd6982dfa433125a3b8e77b808984921aee097877280fa21aafb87468cd0a8e4cfa900284a262b
+SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION-source"
         WEB_SITE=http://www.mupdf.com/
          ENTERED=20120426
       LICENSE[0]=GPL
         KEYWORDS="pdf"
-           SHORT="lightweight PDF and XPS viewer"
+           SHORT="lightweight PDF, XPS, EPUB and CBZ viewer and 
parser/rendering library"
 cat << EOF
 The renderer in MuPDF is tailored for high quality anti-aliased graphics. It
 renders text with metrics and spacing accurate to within fractions of a pixel
 for the highest fidelity in reproducing the look of a printed page on screen.
 
-MuPDF is also small, fast, and yet complete. It supports PDF 1.7 with
-transparency, encryption, hyperlinks, annotations, searching and more.
-
-It also reads OpenXPS documents.
+MuPDF is also small, fast, and yet complete. We support PDF 1.7 with
+transparency, encryption, hyperlinks, annotations, search and many other 
bells
+and whistles. MuPDF can also read XPS documents (OpenXPS / ECMA-388),
+EPUB and CBZ (Comic Book archive) files.
 EOF
diff --git a/doc/mupdf/HISTORY b/doc/mupdf/HISTORY
index 6d650e4..e594a87 100644
--- a/doc/mupdf/HISTORY
+++ b/doc/mupdf/HISTORY
@@ -1,3 +1,16 @@
+2016-09-29 Vlad Glagolev <stealth AT sourcemage.org>
+       * DETAILS: updated spell to 1.9a; updated descriptions
+       * DEPENDS: added missing dependencies (harfbuzz, SSL, curl, glfw)
+       * BUILD: added '-fstack-protector-all' to prevent crashes on specific
+         EPUB files; fixed verbose output; respect OPTS
+       * INSTALL: respect OPTS
+       * PRE_BUILD: added, to apply patches and remove thirdparty libs to
+         respect system versions of those
+       * openjpeg-1.5.patch: added, to compile with openjpeg 1.5.2
+       * openjpeg-2.1.patch: added, to compile with openjpeg 2.1.2
+       * mupdf-1.9-upstream_fix-1.patch: added, official patch to fix
+         CVE-2016-6265
+
 2014-10-10 Vlad Glagolev <stealth AT sourcemage.org>
        * DETAILS: updated spell to 1.6; added archive url
 
diff --git a/doc/mupdf/INSTALL b/doc/mupdf/INSTALL
index f68b9d4..4b8fac4 100755
--- a/doc/mupdf/INSTALL
+++ b/doc/mupdf/INSTALL
@@ -1 +1 @@
-make build=release prefix="$INSTAL_ROOT/usr" install
+make build=release prefix="$INSTAL_ROOT/usr" ${OPTS} install
diff --git a/doc/mupdf/PRE_BUILD b/doc/mupdf/PRE_BUILD
new file mode 100755
index 0000000..b2642d4
--- /dev/null
+++ b/doc/mupdf/PRE_BUILD
@@ -0,0 +1,14 @@
+default_pre_build &&
+cd "${SOURCE_DIRECTORY}" &&
+
+rm -rf thirdparty/{curl,freetype,harfbuzz,jbig2dec,jpeg,openjpeg,zlib} &&
+
+patch -p1 < "${SPELL_DIRECTORY}/mupdf-1.9-upstream_fix-1.patch" &&
+
+if spell_ok openjpeg && is_version_less $(installed_version openjpeg) 2.0; 
then
+  patch -p0 < "${SPELL_DIRECTORY}/openjpeg-1.5.patch" &&
+
+  sedit "s:libopenjp2:libopenjpeg:g" Makerules
+else
+  patch -p1 < "${SPELL_DIRECTORY}/openjpeg-2.1.patch"
+fi
diff --git a/doc/mupdf/mupdf-1.9-upstream_fix-1.patch 
b/doc/mupdf/mupdf-1.9-upstream_fix-1.patch
new file mode 100644
index 0000000..666d891
--- /dev/null
+++ b/doc/mupdf/mupdf-1.9-upstream_fix-1.patch
@@ -0,0 +1,28 @@
+Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
+Date: 2016-08-30
+Initial Package Version: 1.9 (possibly applies to 1.5 and 1.7 versions)
+Upstream Status: Applied
+Origin: Upstream
+Description: Fixes use after free, upstream bug 696941, CVE-2016-6265.
+
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 576c315..3222599 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1184,8 +1184,14 @@ pdf_load_xref(fz_context *ctx, pdf_document *doc, 
pdf_lexbuf *buf)
+                               fz_throw(ctx, FZ_ERROR_GENERIC, "object 
offset out of range: %d (%d 0 R)", (int)entry->ofs, i);
+               }
+               if (entry->type == 'o')
+-                      if (entry->ofs <= 0 || entry->ofs >= xref_len || 
pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
+-                              fz_throw(ctx, FZ_ERROR_GENERIC, "invalid 
reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i);
++              {
++                      /* Read this into a local variable here, because 
pdf_get_xref_entry
++                       * may solidify the xref, hence invalidating "entry", 
meaning we
++                       * need a stashed value for the throw. */
++                      fz_off_t ofs = entry->ofs;
++                      if (ofs <= 0 || ofs >= xref_len || 
pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
++                              fz_throw(ctx, FZ_ERROR_GENERIC, "invalid 
reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
++              }
+       }
+ }
+ 
diff --git a/doc/mupdf/openjpeg-1.5.patch b/doc/mupdf/openjpeg-1.5.patch
new file mode 100644
index 0000000..bb6f7c0
--- /dev/null
+++ b/doc/mupdf/openjpeg-1.5.patch
@@ -0,0 +1,187 @@
+--- source/fitz/load-jpx.c.orig        2016-04-21 07:14:32.000000000 -0400
++++ source/fitz/load-jpx.c     2016-09-29 20:52:56.344529197 -0400
+@@ -8,7 +8,7 @@
+ #define OPJ_HAVE_STDINT_H
+ #endif
+ 
+-#include <openjpeg.h>
++#include <openjpeg-1.5/openjpeg.h>
+ 
+ static void fz_opj_error_callback(const char *msg, void *client_data)
+ {
+@@ -27,119 +27,51 @@
+       /* fz_warn("openjpeg info: %s", msg); */
+ }
+ 
+-typedef struct stream_block_s
+-{
+-      unsigned char *data;
+-      int size;
+-      int pos;
+-} stream_block;
+-
+-static OPJ_SIZE_T fz_opj_stream_read(void * p_buffer, OPJ_SIZE_T 
p_nb_bytes, void * p_user_data)
+-{
+-      stream_block *sb = (stream_block *)p_user_data;
+-      int len;
+-
+-      len = sb->size - sb->pos;
+-      if (len < 0)
+-              len = 0;
+-      if (len == 0)
+-              return (OPJ_SIZE_T)-1; /* End of file! */
+-      if ((OPJ_SIZE_T)len > p_nb_bytes)
+-              len = p_nb_bytes;
+-      memcpy(p_buffer, sb->data + sb->pos, len);
+-      sb->pos += len;
+-      return len;
+-}
+-
+-static OPJ_OFF_T fz_opj_stream_skip(OPJ_OFF_T skip, void * p_user_data)
+-{
+-      stream_block *sb = (stream_block *)p_user_data;
+-
+-      if (skip > sb->size - sb->pos)
+-              skip = sb->size - sb->pos;
+-      sb->pos += skip;
+-      return sb->pos;
+-}
+-
+-static OPJ_BOOL fz_opj_stream_seek(OPJ_OFF_T seek_pos, void * p_user_data)
+-{
+-      stream_block *sb = (stream_block *)p_user_data;
+-
+-      if (seek_pos > sb->size)
+-              return OPJ_FALSE;
+-      sb->pos = seek_pos;
+-      return OPJ_TRUE;
+-}
+-
+ fz_pixmap *
+ fz_load_jpx(fz_context *ctx, unsigned char *data, int size, fz_colorspace 
*defcs, int indexed)
+ {
+       fz_pixmap *img;
++      fz_colorspace *origcs;
++      opj_event_mgr_t evtmgr;
+       opj_dparameters_t params;
+-      opj_codec_t *codec;
++      opj_dinfo_t *codec;
+       opj_image_t *jpx;
+-      opj_stream_t *stream;
++      opj_cio_t *stream;
+       fz_colorspace *colorspace;
+       unsigned char *p;
+       OPJ_CODEC_FORMAT format;
+       int a, n, w, h, depth, sgnd;
+       int x, y, k, v;
+-      stream_block sb;
+ 
+       if (size < 2)
+               fz_throw(ctx, FZ_ERROR_GENERIC, "not enough data to determine 
image format");
+ 
+       /* Check for SOC marker -- if found we have a bare J2K stream */
+       if (data[0] == 0xFF && data[1] == 0x4F)
+-              format = OPJ_CODEC_J2K;
++              format = CODEC_J2K;
+       else
+-              format = OPJ_CODEC_JP2;
++              format = CODEC_JP2;
++
++      memset(&evtmgr, 0, sizeof(evtmgr));
++      evtmgr.error_handler = fz_opj_error_callback;
++      evtmgr.warning_handler = fz_opj_warning_callback;
++      evtmgr.info_handler = fz_opj_info_callback;
+ 
+       opj_set_default_decoder_parameters(&params);
+       if (indexed)
+               params.flags |= OPJ_DPARAMETERS_IGNORE_PCLR_CMAP_CDEF_FLAG;
+ 
+       codec = opj_create_decompress(format);
+-      opj_set_info_handler(codec, fz_opj_info_callback, ctx);
+-      opj_set_warning_handler(codec, fz_opj_warning_callback, ctx);
+-      opj_set_error_handler(codec, fz_opj_error_callback, ctx);
+-      if (!opj_setup_decoder(codec, &params))
+-      {
+-              opj_destroy_codec(codec);
+-              fz_throw(ctx, FZ_ERROR_GENERIC, "j2k decode failed");
+-      }
++      opj_set_event_mgr((opj_common_ptr)codec, &evtmgr, ctx);
++      opj_setup_decoder(codec, &params);
+ 
+-      stream = opj_stream_default_create(OPJ_TRUE);
+-      sb.data = data;
+-      sb.pos = 0;
+-      sb.size = size;
++      stream = opj_cio_open((opj_common_ptr)codec, data, size);
+ 
+-      opj_stream_set_read_function(stream, fz_opj_stream_read);
+-      opj_stream_set_skip_function(stream, fz_opj_stream_skip);
+-      opj_stream_set_seek_function(stream, fz_opj_stream_seek);
+-      opj_stream_set_user_data(stream, &sb);
+-      /* Set the length to avoid an assert */
+-      opj_stream_set_user_data_length(stream, size);
++      jpx = opj_decode(codec, stream);
+ 
+-      if (!opj_read_header(stream, codec, &jpx))
+-      {
+-              opj_stream_destroy(stream);
+-              opj_destroy_codec(codec);
+-              fz_throw(ctx, FZ_ERROR_GENERIC, "Failed to read JPX header");
+-      }
++      opj_cio_close(stream);
++      opj_destroy_decompress(codec);
+ 
+-      if (!opj_decode(codec, stream, jpx))
+-      {
+-              opj_stream_destroy(stream);
+-              opj_destroy_codec(codec);
+-              opj_image_destroy(jpx);
+-              fz_throw(ctx, FZ_ERROR_GENERIC, "Failed to decode JPX image");
+-      }
+-
+-      opj_stream_destroy(stream);
+-      opj_destroy_codec(codec);
+-
+-      /* jpx should never be NULL here, but check anyway */
+       if (!jpx)
+               fz_throw(ctx, FZ_ERROR_GENERIC, "opj_decode failed");
+ 
+@@ -173,12 +105,13 @@
+       depth = jpx->comps[0].prec;
+       sgnd = jpx->comps[0].sgnd;
+ 
+-      if (jpx->color_space == OPJ_CLRSPC_SRGB && n == 4) { n = 3; a = 1; }
+-      else if (jpx->color_space == OPJ_CLRSPC_SYCC && n == 4) { n = 3; a = 
1; }
++      if (jpx->color_space == CLRSPC_SRGB && n == 4) { n = 3; a = 1; }
++      else if (jpx->color_space == CLRSPC_SYCC && n == 4) { n = 3; a = 1; }
+       else if (n == 2) { n = 1; a = 1; }
+       else if (n > 4) { n = 4; a = 1; }
+       else { a = 0; }
+ 
++      origcs = defcs;
+       if (defcs)
+       {
+               if (defcs->n == n)
+@@ -224,8 +157,6 @@
+                                       v = v + (1 << (depth - 1));
+                               if (depth > 8)
+                                       v = v >> (depth - 8);
+-                              else if (depth < 8)
+-                                      v = v << (8 - depth);
+                               *p++ = v;
+                       }
+                       if (!a)
+@@ -247,5 +178,13 @@
+               fz_premultiply_pixmap(ctx, img);
+       }
+ 
++      if (origcs != defcs)
++      {
++              fz_pixmap *tmp = fz_new_pixmap(ctx, origcs, w, h);
++              fz_convert_pixmap(ctx, tmp, img);
++              fz_drop_pixmap(ctx, img);
++              img = tmp;
++      }
++
+       return img;
+ }
diff --git a/doc/mupdf/openjpeg-2.1.patch b/doc/mupdf/openjpeg-2.1.patch
new file mode 100644
index 0000000..fa9e3dc
--- /dev/null
+++ b/doc/mupdf/openjpeg-2.1.patch
@@ -0,0 +1,37 @@
+--- a/source/fitz/load-jpx.c
++++ b/source/fitz/load-jpx.c
+@@ -3,12 +3,17 @@
+ /* Without the definition of OPJ_STATIC, compilation fails on windows
+  * due to the use of __stdcall. We believe it is required on some
+  * linux toolchains too. */
++
++#ifdef __cplusplus
++extern "C"
++{
+ #define OPJ_STATIC
+ #ifndef _MSC_VER
+ #define OPJ_HAVE_STDINT_H
+ #endif
++#endif
+ 
+-#include <openjpeg.h>
++#include <openjpeg-2.1/openjpeg.h>
+ 
+ static void fz_opj_error_callback(const char *msg, void *client_data)
+ {
+@@ -117,7 +122,7 @@ fz_load_jpx(fz_context *ctx, unsigned ch
+       opj_stream_set_read_function(stream, fz_opj_stream_read);
+       opj_stream_set_skip_function(stream, fz_opj_stream_skip);
+       opj_stream_set_seek_function(stream, fz_opj_stream_seek);
+-      opj_stream_set_user_data(stream, &sb);
++      opj_stream_set_user_data(stream, &sb, NULL);
+       /* Set the length to avoid an assert */
+       opj_stream_set_user_data_length(stream, size);
+ 
+@@ -247,3 +252,6 @@ fz_load_jpx(fz_context *ctx, unsigned ch
+ 
+       return img;
+ }
++#ifdef __cplusplus
++}
++#endif