test/TokenizerTest/CMakeLists.txt | 7 0 + 7 - 0 !
1 file changed, 7 deletions(-)

 before cmake 3.12, trying to copy a non-existing dir didn't fail

src/CMakeLists.txt | 4 2 + 2 - 0 !
src/libpodofo.pc.in | 2 1 + 1 - 0 !
2 files changed, 3 insertions(+), 3 deletions(-)

 fix pkg-config to actually work with the way podofo is installed

src/base/PdfXRefStreamParserObject.h | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 workaround bug that makes impossible to link the test with -fvisibility=hidden
 This is a workaround, this class is *not* meant to be public.  It doesn't change
 the status quo from the 0.9.5 version as there we didn't build libpodofo with
 -fvisibility=hidden, so this was exposed anyway, and I consider this solution
 better than enabling global symbol visibility again.

test/unit/ParserTest.cpp | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix compilation failure on !linux

src/base/PdfCompilerCompat.h | 3 3 + 0 - 0 !
src/base/PdfVecObjects.cpp | 4 4 + 0 - 0 !
src/base/PdfVecObjects.h | 47 46 + 1 - 0 !
3 files changed, 53 insertions(+), 1 deletion(-)

 fix cve-2018-5783 by introducing singleton limit for indirect objects
 The limit is the standard one of 8,388,607 but can be changed by
 a newly introduced inline method (also a getter is provided).
 This also introduced a new define PODOFO_SIZE_FORMAT for formatting
 size_t values portably in printf()-like methods of PdfError etc.
 Please also cf. issue #4 in the issue tracker.

src/doc/PdfPagesTree.cpp | 176 35 + 141 - 0 !
src/doc/PdfPagesTree.h | 1 0 + 1 - 0 !
test/unit/PagesTreeTest.cpp | 230 230 + 0 - 0 !
test/unit/PagesTreeTest.h | 60 60 + 0 - 0 !
4 files changed, 325 insertions(+), 142 deletions(-)

 fix bugs in pdfpagestree
 The patch includes:
 1) A real fix of CVE-2017-8054 (not really fixed up to r1937!) for handling
    of cyclic trees, see testCyclicTree()
 2) A fix for handling of subtrees with /Kids [] and /Count 0 which is
    completely valid according to the PDF spec, see testEmptyKidsTree()
 3) A changed behavior for trees with nested kids array which are not valid
    according to the PDF spec and now yield an NULL ptr, see testNestedArrayTree()
 This patch actually drops the symbols PdfPagesTree::GetPageNodeFromArray,
 but it wasn't used by nothing.

src/doc/PdfDocument.cpp | 6 6 + 0 - 0 !
1 file changed, 6 insertions(+)

 fix cve-2018-11256: pdferror info gives not-found page 0-based (and says that)

src/base/PdfDictionary.h | 26 26 + 0 - 0 !
src/base/PdfEncrypt.cpp | 14 6 + 8 - 0 !
2 files changed, 32 insertions(+), 8 deletions(-)

 fix cve-2018-12982 implementing inline pdfdictionary::mustgetkey()
 That new method throws, therefore it makes NULL checks in the
 calling places unnecessary. That it's inline means that it doesn't
 change the ABI or API (AFAIK). It's called from the library itself
 therefore no recompile of applications is necessary. Please also
 cf. issue #22 in the issue tracker.

src/base/PdfEncoding.cpp | 12 12 + 0 - 0 !
test/unit/EncodingTest.cpp | 51 51 + 0 - 0 !
2 files changed, 63 insertions(+)

 cve-2018-14320 - possible undefined behaviour in pdfencoding::parsetounicode()
 There is undefined behaviour in PdfEncoding::ParseToUnicode() if the first
 token in the parsed stream is 'beginbfrange' or 'beginbfchar'. In both
 cases stkToken.top() is called when stkToken.size() == 0,  which results
 in the undefined behaviour.

tools/podofoimpose/pdftranslator.cpp | 8 7 + 1 - 0 !
1 file changed, 7 insertions(+), 1 deletion(-)

 cve-2018-19532: null pointer dereference in pdftranslator::settarget()
 This is in podofoimpose and fixed there (pdftranslator.cpp) directly.

tools/podofocrop/podofocrop.cpp | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 cve-2018-20751: null-pointer dereference in crop_page() of tools/podofocrop/podofocrop.cpp

tools/podofoimpose/pdftranslator.cpp | 7 6 + 1 - 0 !
1 file changed, 6 insertions(+), 1 deletion(-)

 cve-2019-9199 - null pointer dereference

src/base/PdfString.cpp | 29 25 + 4 - 0 !
1 file changed, 25 insertions(+), 4 deletions(-)

 cve-2019-9687 - heap-based buffer overflow in pdfstring::convertutf16toutf8