Package: mupdf / 1.9a+ds1-4+deb9u4

0010-CVE-2017-5991.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
From: Robin Watts <robin.watts@artifex.com>
Date: Thu, 16 Feb 2017 23:28:37 +0800
Subject: Bug 697500: Fix NULL ptr access.

Cope better with errors during rendering - avoid letting the
gstate stack get out of sync.

This avoids us ever getting into the situation of popping
a clip when we should be popping a mask or a group. This was
causing an unexpected case in the painting.
---
 source/pdf/pdf-op-run.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/source/pdf/pdf-op-run.c b/source/pdf/pdf-op-run.c
index 593afe2..95d8c58 100644
--- a/source/pdf/pdf-op-run.c
+++ b/source/pdf/pdf-op-run.c
@@ -1201,6 +1201,7 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 	pdf_run_processor *pr = (pdf_run_processor *)proc;
 	pdf_gstate *gstate = NULL;
 	int oldtop = 0;
+	int oldbot = -1;
 	fz_matrix local_transform = *transform;
 	softmask_save softmask = { NULL };
 	int gparent_save;
@@ -1216,16 +1217,17 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 	fz_var(cleanup_state);
 	fz_var(gstate);
 	fz_var(oldtop);
+	fz_var(oldbot);
 
 	gparent_save = pr->gparent;
 	pr->gparent = pr->gtop;
+	oldtop = pr->gtop;
 
 	fz_try(ctx)
 	{
 		pdf_gsave(ctx, pr);
 
 		gstate = pr->gstate + pr->gtop;
-		oldtop = pr->gtop;
 
 		/* apply xobject's transform matrix */
 		fz_concat(&local_transform, &xobj->matrix, &local_transform);
@@ -1276,12 +1278,25 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 		if (!resources)
 			resources = page_resources;
 
+		oldbot = pr->gbot;
+		pr->gbot = pr->gtop;
+
 		pdf_process_contents(ctx, (pdf_processor*)pr, xobj->document, resources, xobj->contents, NULL);
 	}
 	fz_always(ctx)
 	{
+		/* Undo any gstate mismatches due to the pdf_process_contents call */
+		if (oldbot != -1)
+		{
+			while (pr->gtop > pr->gbot)
+			{
+				pdf_grestore(ctx, pr);
+			}
+			pr->gbot = oldbot;
+		}
+
 		if (cleanup_state >= 3)
-			pdf_grestore(ctx, pr); /* Remove the clippath */
+			pdf_grestore(ctx, pr); /* Remove the state we pushed for the clippath */
 
 		/* wrap up transparency stacks */
 		if (xobj->transparency)
@@ -1315,13 +1330,8 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
 		pr->gstate[pr->gparent].ctm = gparent_save_ctm;
 		pr->gparent = gparent_save;
 
-		if (gstate)
-		{
-			while (oldtop < pr->gtop)
-				pdf_grestore(ctx, pr);
-
+		while (oldtop < pr->gtop)
 			pdf_grestore(ctx, pr);
-		}
 
 		pdf_unmark_obj(ctx, xobj->me);
 	}