Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (0b69f0d82b9030a4b184681ddf8a3d8e1b22d29c)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Vlad Glagolev <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (0b69f0d82b9030a4b184681ddf8a3d8e1b22d29c)
  • Date: Sat, 1 Oct 2016 13:49:37 +0000

GIT changes to stable-0.62 grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

doc/mupdf/BUILD | 2
doc/mupdf/DEPENDS | 18 ++
doc/mupdf/DETAILS | 17 +-
doc/mupdf/HISTORY | 24 +++
doc/mupdf/INSTALL | 2
doc/mupdf/PRE_BUILD | 15 ++
doc/mupdf/UP_TRIGGERS | 11 +
doc/mupdf/linebreak.patch | 10 +
doc/mupdf/mupdf-1.9-upstream_fix-1.patch | 28 ++++
doc/mupdf/openjpeg-1.5.patch | 187
+++++++++++++++++++++++++++++++
doc/mupdf/openjpeg-2.1.patch | 37 ++++++
11 files changed, 340 insertions(+), 11 deletions(-)

New commits:
commit 0b69f0d82b9030a4b184681ddf8a3d8e1b22d29c
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

mupdf: rebuild spells depending on static libs

(cherry picked from commit d384878fa2670e82f74a20cd1a35cd9123c5c4fd)

commit 691ebdbe044e75fa875e9fda803b8260fe932f36
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

mupdf: security update

(cherry picked from commit 3af4786c9e344ff073c5d6cea2e2db7a3b227d8a)

commit 745a9e9aa3b8ce52110f193152f31c067dd3f09a
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

mupdf: => 1.9a [security]

(cherry picked from commit bd83591c94edf1a5bf1ca10e3bd7b5a9fa475aab)

diff --git a/doc/mupdf/BUILD b/doc/mupdf/BUILD
index 447d986..f29510f 100755
--- a/doc/mupdf/BUILD
+++ b/doc/mupdf/BUILD
@@ -1 +1 @@
-CFLAGS= LIBS= make XCFLAGS="$CFLAGS" XLIBS="$LDFLAGS" build=release verbose=1
+CFLAGS= LIBS= make XCFLAGS="$CFLAGS" XLIBS="$LDFLAGS" ${OPTS} build=release
verbose=yes
diff --git a/doc/mupdf/DEPENDS b/doc/mupdf/DEPENDS
index 70e3d77..1738e92 100755
--- a/doc/mupdf/DEPENDS
+++ b/doc/mupdf/DEPENDS
@@ -1,7 +1,23 @@
depends JPEG &&
depends openjpeg &&
depends freetype2 &&
+depends harfbuzz &&
depends jbig2dec &&
depends zlib &&
depends libxext &&
-depends libx11
+depends libx11 &&
+
+optional_depends SSL \
+ "HAVE_OPENSSL=yes" \
+ "HAVE_OPENSSL=no" \
+ "for signature support" &&
+
+optional_depends curl \
+ "HAVE_CURL=yes" \
+ "HAVE_CURL=no" \
+ "for progressive loading support" &&
+
+optional_depends glfw \
+ "HAVE_GLFW=yes" \
+ "HAVE_GLFW=no" \
+ "for OpenGL-based viewer"
diff --git a/doc/mupdf/DETAILS b/doc/mupdf/DETAILS
index 4bc117b..8be6003 100755
--- a/doc/mupdf/DETAILS
+++ b/doc/mupdf/DETAILS
@@ -1,22 +1,23 @@
SPELL=mupdf
- VERSION=1.6
-
SOURCE_HASH=sha512:3a47d47b81550f531039153385fc22bb81a24df334706e23b7f118d08d97bb103566eef2a6ea3602ebe242fcb9d53304bb9d8230109572204491415a3a1b0645
+ VERSION=1.9a
+ SECURITY_PATCH=1
SOURCE=$SPELL-$VERSION-source.tar.gz
-SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION-source"
SOURCE_URL[0]=http://mupdf.com/downloads/$SOURCE
SOURCE_URL[1]=http://mupdf.com/downloads/archive/$SOURCE
+
SOURCE_HASH=sha512:9f804fd65c2dc6b7a3bd73961b1f1a8bf93d52903cccf6302acd6982dfa433125a3b8e77b808984921aee097877280fa21aafb87468cd0a8e4cfa900284a262b
+SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION-source"
WEB_SITE=http://www.mupdf.com/
ENTERED=20120426
LICENSE[0]=GPL
KEYWORDS="pdf"
- SHORT="lightweight PDF and XPS viewer"
+ SHORT="lightweight PDF, XPS, EPUB and CBZ viewer and
parser/rendering library"
cat << EOF
The renderer in MuPDF is tailored for high quality anti-aliased graphics. It
renders text with metrics and spacing accurate to within fractions of a pixel
for the highest fidelity in reproducing the look of a printed page on screen.

-MuPDF is also small, fast, and yet complete. It supports PDF 1.7 with
-transparency, encryption, hyperlinks, annotations, searching and more.
-
-It also reads OpenXPS documents.
+MuPDF is also small, fast, and yet complete. We support PDF 1.7 with
+transparency, encryption, hyperlinks, annotations, search and many other
bells
+and whistles. MuPDF can also read XPS documents (OpenXPS / ECMA-388),
+EPUB and CBZ (Comic Book archive) files.
EOF
diff --git a/doc/mupdf/HISTORY b/doc/mupdf/HISTORY
index 6d650e4..52a76ea 100644
--- a/doc/mupdf/HISTORY
+++ b/doc/mupdf/HISTORY
@@ -1,3 +1,27 @@
+2016-10-01 Vlad Glagolev <stealth AT sourcemage.org>
+ * UP_TRIGGERS: added, to rebuild spells depending on mupdf static libs
+
+2016-09-30 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: added forgotten SECURITY_PATCH
+ * BUILD: dropped not required '-fstack-protector-all', replaced by
+ linebreak.patch
+ * PRE_BUILD: apply the patch
+ * linebreak.patch: added my patch to prevent a DoS while opening a
+ malformed EPUB file
+
+2016-09-29 Vlad Glagolev <stealth AT sourcemage.org>
+ * DETAILS: updated spell to 1.9a; updated descriptions
+ * DEPENDS: added missing dependencies (harfbuzz, SSL, curl, glfw)
+ * BUILD: added '-fstack-protector-all' to prevent crashes on specific
+ EPUB files; fixed verbose output; respect OPTS
+ * INSTALL: respect OPTS
+ * PRE_BUILD: added, to apply patches and remove thirdparty libs to
+ respect system versions of those
+ * openjpeg-1.5.patch: added, to compile with openjpeg 1.5.2
+ * openjpeg-2.1.patch: added, to compile with openjpeg 2.1.2
+ * mupdf-1.9-upstream_fix-1.patch: added, official patch to fix
+ CVE-2016-6265
+
2014-10-10 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: updated spell to 1.6; added archive url

diff --git a/doc/mupdf/INSTALL b/doc/mupdf/INSTALL
index f68b9d4..4b8fac4 100755
--- a/doc/mupdf/INSTALL
+++ b/doc/mupdf/INSTALL
@@ -1 +1 @@
-make build=release prefix="$INSTAL_ROOT/usr" install
+make build=release prefix="$INSTAL_ROOT/usr" ${OPTS} install
diff --git a/doc/mupdf/PRE_BUILD b/doc/mupdf/PRE_BUILD
new file mode 100755
index 0000000..216359b
--- /dev/null
+++ b/doc/mupdf/PRE_BUILD
@@ -0,0 +1,15 @@
+default_pre_build &&
+cd "${SOURCE_DIRECTORY}" &&
+
+rm -rf thirdparty/{curl,freetype,harfbuzz,jbig2dec,jpeg,openjpeg,zlib} &&
+
+patch -p1 < "${SPELL_DIRECTORY}/mupdf-1.9-upstream_fix-1.patch" &&
+patch -p0 < "${SPELL_DIRECTORY}/linebreak.patch" &&
+
+if spell_ok openjpeg && is_version_less $(installed_version openjpeg) 2.0;
then
+ patch -p0 < "${SPELL_DIRECTORY}/openjpeg-1.5.patch" &&
+
+ sedit "s:libopenjp2:libopenjpeg:g" Makerules
+else
+ patch -p1 < "${SPELL_DIRECTORY}/openjpeg-2.1.patch"
+fi
diff --git a/doc/mupdf/UP_TRIGGERS b/doc/mupdf/UP_TRIGGERS
new file mode 100755
index 0000000..43ca680
--- /dev/null
+++ b/doc/mupdf/UP_TRIGGERS
@@ -0,0 +1,11 @@
+# up_trigger everything on recast because of static libs (libmupdf.a,
libmupdfthird.a)
+
+if spell_ok ${SPELL}; then
+ message "${MESSAGE_COLOR}This is due to rebuild of static libraries in
${SPELL_COLOR}${SPELL}${MESSAGE_COLOR}"
+ message "Figuring out what spells need to be recast, this may take a
while...${DEFAULT_COLOR}"
+ for each in $(show_up_depends ${SPELL} 1); do
+ if gaze install $each | xargs readelf -s 2> /dev/null | grep -q
"FUNC.*fz_"; then
+ up_trigger $each cast_self
+ fi
+ done
+fi
diff --git a/doc/mupdf/linebreak.patch b/doc/mupdf/linebreak.patch
new file mode 100644
index 0000000..603c2ab
--- /dev/null
+++ b/doc/mupdf/linebreak.patch
@@ -0,0 +1,10 @@
+--- source/html/html-layout.c.orig 2016-04-21 07:14:32.000000000 -0400
++++ source/html/html-layout.c 2016-09-30 12:05:50.251503828 -0400
+@@ -2094,6 +2094,7 @@
+ g.base_uri = base_uri;
+ g.at_bol = 0;
+ g.emit_white = 0;
++ g.last_brk_cls = UCDN_LINEBREAK_CLASS_OP;
+
+ xml = fz_parse_xml(ctx, buf->data, buf->len, 1);
+
diff --git a/doc/mupdf/mupdf-1.9-upstream_fix-1.patch
b/doc/mupdf/mupdf-1.9-upstream_fix-1.patch
new file mode 100644
index 0000000..666d891
--- /dev/null
+++ b/doc/mupdf/mupdf-1.9-upstream_fix-1.patch
@@ -0,0 +1,28 @@
+Submitted By: Ken Moffat <ken at linuxfromscratch dot org>
+Date: 2016-08-30
+Initial Package Version: 1.9 (possibly applies to 1.5 and 1.7 versions)
+Upstream Status: Applied
+Origin: Upstream
+Description: Fixes use after free, upstream bug 696941, CVE-2016-6265.
+
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 576c315..3222599 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1184,8 +1184,14 @@ pdf_load_xref(fz_context *ctx, pdf_document *doc,
pdf_lexbuf *buf)
+ fz_throw(ctx, FZ_ERROR_GENERIC, "object
offset out of range: %d (%d 0 R)", (int)entry->ofs, i);
+ }
+ if (entry->type == 'o')
+- if (entry->ofs <= 0 || entry->ofs >= xref_len ||
pdf_get_xref_entry(ctx, doc, entry->ofs)->type != 'n')
+- fz_throw(ctx, FZ_ERROR_GENERIC, "invalid
reference to an objstm that does not exist: %d (%d 0 R)", (int)entry->ofs, i);
++ {
++ /* Read this into a local variable here, because
pdf_get_xref_entry
++ * may solidify the xref, hence invalidating "entry",
meaning we
++ * need a stashed value for the throw. */
++ fz_off_t ofs = entry->ofs;
++ if (ofs <= 0 || ofs >= xref_len ||
pdf_get_xref_entry(ctx, doc, ofs)->type != 'n')
++ fz_throw(ctx, FZ_ERROR_GENERIC, "invalid
reference to an objstm that does not exist: %d (%d 0 R)", (int)ofs, i);
++ }
+ }
+ }
+
diff --git a/doc/mupdf/openjpeg-1.5.patch b/doc/mupdf/openjpeg-1.5.patch
new file mode 100644
index 0000000..bb6f7c0
--- /dev/null
+++ b/doc/mupdf/openjpeg-1.5.patch
@@ -0,0 +1,187 @@
+--- source/fitz/load-jpx.c.orig 2016-04-21 07:14:32.000000000 -0400
++++ source/fitz/load-jpx.c 2016-09-29 20:52:56.344529197 -0400
+@@ -8,7 +8,7 @@
+ #define OPJ_HAVE_STDINT_H
+ #endif
+
+-#include <openjpeg.h>
++#include <openjpeg-1.5/openjpeg.h>
+
+ static void fz_opj_error_callback(const char *msg, void *client_data)
+ {
+@@ -27,119 +27,51 @@
+ /* fz_warn("openjpeg info: %s", msg); */
+ }
+
+-typedef struct stream_block_s
+-{
+- unsigned char *data;
+- int size;
+- int pos;
+-} stream_block;
+-
+-static OPJ_SIZE_T fz_opj_stream_read(void * p_buffer, OPJ_SIZE_T
p_nb_bytes, void * p_user_data)
+-{
+- stream_block *sb = (stream_block *)p_user_data;
+- int len;
+-
+- len = sb->size - sb->pos;
+- if (len < 0)
+- len = 0;
+- if (len == 0)
+- return (OPJ_SIZE_T)-1; /* End of file! */
+- if ((OPJ_SIZE_T)len > p_nb_bytes)
+- len = p_nb_bytes;
+- memcpy(p_buffer, sb->data + sb->pos, len);
+- sb->pos += len;
+- return len;
+-}
+-
+-static OPJ_OFF_T fz_opj_stream_skip(OPJ_OFF_T skip, void * p_user_data)
+-{
+- stream_block *sb = (stream_block *)p_user_data;
+-
+- if (skip > sb->size - sb->pos)
+- skip = sb->size - sb->pos;
+- sb->pos += skip;
+- return sb->pos;
+-}
+-
+-static OPJ_BOOL fz_opj_stream_seek(OPJ_OFF_T seek_pos, void * p_user_data)
+-{
+- stream_block *sb = (stream_block *)p_user_data;
+-
+- if (seek_pos > sb->size)
+- return OPJ_FALSE;
+- sb->pos = seek_pos;
+- return OPJ_TRUE;
+-}
+-
+ fz_pixmap *
+ fz_load_jpx(fz_context *ctx, unsigned char *data, int size, fz_colorspace
*defcs, int indexed)
+ {
+ fz_pixmap *img;
++ fz_colorspace *origcs;
++ opj_event_mgr_t evtmgr;
+ opj_dparameters_t params;
+- opj_codec_t *codec;
++ opj_dinfo_t *codec;
+ opj_image_t *jpx;
+- opj_stream_t *stream;
++ opj_cio_t *stream;
+ fz_colorspace *colorspace;
+ unsigned char *p;
+ OPJ_CODEC_FORMAT format;
+ int a, n, w, h, depth, sgnd;
+ int x, y, k, v;
+- stream_block sb;
+
+ if (size < 2)
+ fz_throw(ctx, FZ_ERROR_GENERIC, "not enough data to determine
image format");
+
+ /* Check for SOC marker -- if found we have a bare J2K stream */
+ if (data[0] == 0xFF && data[1] == 0x4F)
+- format = OPJ_CODEC_J2K;
++ format = CODEC_J2K;
+ else
+- format = OPJ_CODEC_JP2;
++ format = CODEC_JP2;
++
++ memset(&evtmgr, 0, sizeof(evtmgr));
++ evtmgr.error_handler = fz_opj_error_callback;
++ evtmgr.warning_handler = fz_opj_warning_callback;
++ evtmgr.info_handler = fz_opj_info_callback;
+
+ opj_set_default_decoder_parameters(&params);
+ if (indexed)
+ params.flags |= OPJ_DPARAMETERS_IGNORE_PCLR_CMAP_CDEF_FLAG;
+
+ codec = opj_create_decompress(format);
+- opj_set_info_handler(codec, fz_opj_info_callback, ctx);
+- opj_set_warning_handler(codec, fz_opj_warning_callback, ctx);
+- opj_set_error_handler(codec, fz_opj_error_callback, ctx);
+- if (!opj_setup_decoder(codec, &params))
+- {
+- opj_destroy_codec(codec);
+- fz_throw(ctx, FZ_ERROR_GENERIC, "j2k decode failed");
+- }
++ opj_set_event_mgr((opj_common_ptr)codec, &evtmgr, ctx);
++ opj_setup_decoder(codec, &params);
+
+- stream = opj_stream_default_create(OPJ_TRUE);
+- sb.data = data;
+- sb.pos = 0;
+- sb.size = size;
++ stream = opj_cio_open((opj_common_ptr)codec, data, size);
+
+- opj_stream_set_read_function(stream, fz_opj_stream_read);
+- opj_stream_set_skip_function(stream, fz_opj_stream_skip);
+- opj_stream_set_seek_function(stream, fz_opj_stream_seek);
+- opj_stream_set_user_data(stream, &sb);
+- /* Set the length to avoid an assert */
+- opj_stream_set_user_data_length(stream, size);
++ jpx = opj_decode(codec, stream);
+
+- if (!opj_read_header(stream, codec, &jpx))
+- {
+- opj_stream_destroy(stream);
+- opj_destroy_codec(codec);
+- fz_throw(ctx, FZ_ERROR_GENERIC, "Failed to read JPX header");
+- }
++ opj_cio_close(stream);
++ opj_destroy_decompress(codec);
+
+- if (!opj_decode(codec, stream, jpx))
+- {
+- opj_stream_destroy(stream);
+- opj_destroy_codec(codec);
+- opj_image_destroy(jpx);
+- fz_throw(ctx, FZ_ERROR_GENERIC, "Failed to decode JPX image");
+- }
+-
+- opj_stream_destroy(stream);
+- opj_destroy_codec(codec);
+-
+- /* jpx should never be NULL here, but check anyway */
+ if (!jpx)
+ fz_throw(ctx, FZ_ERROR_GENERIC, "opj_decode failed");
+
+@@ -173,12 +105,13 @@
+ depth = jpx->comps[0].prec;
+ sgnd = jpx->comps[0].sgnd;
+
+- if (jpx->color_space == OPJ_CLRSPC_SRGB && n == 4) { n = 3; a = 1; }
+- else if (jpx->color_space == OPJ_CLRSPC_SYCC && n == 4) { n = 3; a =
1; }
++ if (jpx->color_space == CLRSPC_SRGB && n == 4) { n = 3; a = 1; }
++ else if (jpx->color_space == CLRSPC_SYCC && n == 4) { n = 3; a = 1; }
+ else if (n == 2) { n = 1; a = 1; }
+ else if (n > 4) { n = 4; a = 1; }
+ else { a = 0; }
+
++ origcs = defcs;
+ if (defcs)
+ {
+ if (defcs->n == n)
+@@ -224,8 +157,6 @@
+ v = v + (1 << (depth - 1));
+ if (depth > 8)
+ v = v >> (depth - 8);
+- else if (depth < 8)
+- v = v << (8 - depth);
+ *p++ = v;
+ }
+ if (!a)
+@@ -247,5 +178,13 @@
+ fz_premultiply_pixmap(ctx, img);
+ }
+
++ if (origcs != defcs)
++ {
++ fz_pixmap *tmp = fz_new_pixmap(ctx, origcs, w, h);
++ fz_convert_pixmap(ctx, tmp, img);
++ fz_drop_pixmap(ctx, img);
++ img = tmp;
++ }
++
+ return img;
+ }
diff --git a/doc/mupdf/openjpeg-2.1.patch b/doc/mupdf/openjpeg-2.1.patch
new file mode 100644
index 0000000..fa9e3dc
--- /dev/null
+++ b/doc/mupdf/openjpeg-2.1.patch
@@ -0,0 +1,37 @@
+--- a/source/fitz/load-jpx.c
++++ b/source/fitz/load-jpx.c
+@@ -3,12 +3,17 @@
+ /* Without the definition of OPJ_STATIC, compilation fails on windows
+ * due to the use of __stdcall. We believe it is required on some
+ * linux toolchains too. */
++
++#ifdef __cplusplus
++extern "C"
++{
+ #define OPJ_STATIC
+ #ifndef _MSC_VER
+ #define OPJ_HAVE_STDINT_H
+ #endif
++#endif
+
+-#include <openjpeg.h>
++#include <openjpeg-2.1/openjpeg.h>
+
+ static void fz_opj_error_callback(const char *msg, void *client_data)
+ {
+@@ -117,7 +122,7 @@ fz_load_jpx(fz_context *ctx, unsigned ch
+ opj_stream_set_read_function(stream, fz_opj_stream_read);
+ opj_stream_set_skip_function(stream, fz_opj_stream_skip);
+ opj_stream_set_seek_function(stream, fz_opj_stream_seek);
+- opj_stream_set_user_data(stream, &sb);
++ opj_stream_set_user_data(stream, &sb, NULL);
+ /* Set the length to avoid an assert */
+ opj_stream_set_user_data_length(stream, size);
+
+@@ -247,3 +252,6 @@ fz_load_jpx(fz_context *ctx, unsigned ch
+
+ return img;
+ }
++#ifdef __cplusplus
++}
++#endif



  • [SM-Commit] GIT changes to stable-0.62 grimoire by Vlad Glagolev (0b69f0d82b9030a4b184681ddf8a3d8e1b22d29c), Vlad Glagolev, 10/01/2016

Archive powered by MHonArc 2.6.24.

Top of Page