Control: tags 833417 + pending
Hi,
I've prepared an NMU for mupdf (versioned as 1.9a+ds1-1.2) and
uploaded it to DELAYED/10. Please feel free to tell me if I
should delay it longer.
Regards,
Salvatore
diff -Nru mupdf-1.9a+ds1/debian/changelog mupdf-1.9a+ds1/debian/changelog
--- mupdf-1.9a+ds1/debian/changelog 2016-08-01 14:17:57.000000000 +0200
+++ mupdf-1.9a+ds1/debian/changelog 2016-08-06 13:44:07.000000000 +0200
@@ -1,3 +1,10 @@
+mupdf (1.9a+ds1-1.2) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2016-6525: heap overflow in pdf_load_mesh_params() (Closes: #833417)
+
+ -- Salvatore Bonaccorso <car...@debian.org> Sat, 06 Aug 2016 13:44:07 +0200
+
mupdf (1.9a+ds1-1.1) unstable; urgency=medium
* Non-maintainer upload.
diff -Nru mupdf-1.9a+ds1/debian/patches/0007-CVE-2016-6525.patch mupdf-1.9a+ds1/debian/patches/0007-CVE-2016-6525.patch
--- mupdf-1.9a+ds1/debian/patches/0007-CVE-2016-6525.patch 1970-01-01 01:00:00.000000000 +0100
+++ mupdf-1.9a+ds1/debian/patches/0007-CVE-2016-6525.patch 2016-08-06 13:44:07.000000000 +0200
@@ -0,0 +1,26 @@
+From 39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e Mon Sep 17 00:00:00 2001
+From: Sebastian Rasmussen <seb...@gmail.com>
+Date: Wed, 27 Jul 2016 22:19:39 +0800
+Subject: [PATCH] Make sure that number of colors in mesh params is valid.
+
+Fixes bug 696954.
+---
+ source/pdf/pdf-shade.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/source/pdf/pdf-shade.c b/source/pdf/pdf-shade.c
+index 7815b3c..6e25efa 100644
+--- a/source/pdf/pdf-shade.c
++++ b/source/pdf/pdf-shade.c
+@@ -206,7 +206,7 @@ pdf_load_mesh_params(fz_context *ctx, pdf_document *doc, fz_shade *shade, pdf_ob
+ obj = pdf_dict_get(ctx, dict, PDF_NAME_Decode);
+ if (pdf_array_len(ctx, obj) >= 6)
+ {
+- n = (pdf_array_len(ctx, obj) - 4) / 2;
++ n = fz_mini(FZ_MAX_COLORS, (pdf_array_len(ctx, obj) - 4) / 2);
+ shade->u.m.x0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 0));
+ shade->u.m.x1 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 1));
+ shade->u.m.y0 = pdf_to_real(ctx, pdf_array_get(ctx, obj, 2));
+--
+2.9.1
+
diff -Nru mupdf-1.9a+ds1/debian/patches/series mupdf-1.9a+ds1/debian/patches/series
--- mupdf-1.9a+ds1/debian/patches/series 2016-08-01 14:17:57.000000000 +0200
+++ mupdf-1.9a+ds1/debian/patches/series 2016-08-06 13:44:07.000000000 +0200
@@ -4,3 +4,4 @@
0004-Fix-build-with-system-gl-and-glfw.patch
0005-Don-t-communicate-via-tty.patch
0006-CVE-2016-6265.patch
+0007-CVE-2016-6525.patch
