From 0b3e62cf851a7b75d9e066f86fe9c3ae8dbeda10 Mon Sep 17 00:00:00 2001 From: Michael J Gruber Date: Fri, 13 Apr 2018 11:00:12 +0200 Subject: [PATCH] mupdf 1.13.0rc1 test --- .gitignore | 1 + mupdf-1.12-CVE-2017-17858.patch | 102 ------------------ mupdf-1.12-CVE-2018-1000051.patch | 80 -------------- mupdf-1.12-CVE-2018-5686.patch | 57 ---------- mupdf-1.12-CVE-2018-6187.patch | 76 ------------- mupdf-1.12-CVE-2018-6192.patch | 42 -------- mupdf-1.12-CVE-2018-6544-1.patch | 46 -------- mupdf-1.12-CVE-2018-6544-2.patch | 54 ---------- ...penjpeg.patch => mupdf-1.13-openjpeg.patch | 14 +-- mupdf.spec | 28 ++--- sources | 2 +- 11 files changed, 15 insertions(+), 487 deletions(-) delete mode 100644 mupdf-1.12-CVE-2017-17858.patch delete mode 100644 mupdf-1.12-CVE-2018-1000051.patch delete mode 100644 mupdf-1.12-CVE-2018-5686.patch delete mode 100644 mupdf-1.12-CVE-2018-6187.patch delete mode 100644 mupdf-1.12-CVE-2018-6192.patch delete mode 100644 mupdf-1.12-CVE-2018-6544-1.patch delete mode 100644 mupdf-1.12-CVE-2018-6544-2.patch rename mupdf-1.12-openjpeg.patch => mupdf-1.13-openjpeg.patch (50%) diff --git a/.gitignore b/.gitignore index 9ee30b7..37d0d99 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /mupdf-1.11-source.tar.gz /mupdf-1.12-rc1-source.tar.gz /mupdf-1.12.0-source.tar.gz +/mupdf-1.13.0-rc1-source.tar.gz diff --git a/mupdf-1.12-CVE-2017-17858.patch b/mupdf-1.12-CVE-2017-17858.patch deleted file mode 100644 index 1e1476c..0000000 --- a/mupdf-1.12-CVE-2017-17858.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 55c3f68d638ac1263a386e0aaa004bb6e8bde731 Mon Sep 17 00:00:00 2001 -Message-Id: <55c3f68d638ac1263a386e0aaa004bb6e8bde731.1516782952.git.mjg@fedoraproject.org> -From: Sebastian Rasmussen -Date: Mon, 11 Dec 2017 14:09:15 +0100 -Subject: [PATCH] Bugs 698804/698810/698811: Keep PDF object numbers below - limit. - -This ensures that: - * xref tables with objects pointers do not grow out of bounds. - * other readers, e.g. Adobe Acrobat can parse PDFs written by mupdf. ---- - include/mupdf/pdf/object.h | 3 +++ - source/pdf/pdf-repair.c | 5 +---- - source/pdf/pdf-xref.c | 21 ++++++++++++--------- - 3 files changed, 16 insertions(+), 13 deletions(-) - -diff --git a/include/mupdf/pdf/object.h b/include/mupdf/pdf/object.h -index 21ed8595..4177112b 100644 ---- a/include/mupdf/pdf/object.h -+++ b/include/mupdf/pdf/object.h -@@ -3,6 +3,9 @@ - - typedef struct pdf_document_s pdf_document; - -+/* Defined in PDF 1.7 according to Acrobat limit. */ -+#define PDF_MAX_OBJECT_NUMBER 8388607 -+ - /* - * Dynamic objects. - * The same type of objects as found in PDF and PostScript. -diff --git a/source/pdf/pdf-repair.c b/source/pdf/pdf-repair.c -index ca149bd3..0c29758e 100644 ---- a/source/pdf/pdf-repair.c -+++ b/source/pdf/pdf-repair.c -@@ -6,9 +6,6 @@ - - /* Scan file for objects and reconstruct xref table */ - --/* Define in PDF 1.7 to be 8388607, but mupdf is more lenient. */ --#define MAX_OBJECT_NUMBER (10 << 20) -- - struct entry - { - int num; -@@ -436,7 +433,7 @@ pdf_repair_xref(fz_context *ctx, pdf_document *doc) - break; - } - -- if (num <= 0 || num > MAX_OBJECT_NUMBER) -+ if (num <= 0 || num > PDF_MAX_OBJECT_NUMBER) - { - fz_warn(ctx, "ignoring object with invalid object number (%d %d R)", num, gen); - goto have_next_token; -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 00586dbd..6284e70b 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -868,11 +868,12 @@ pdf_read_old_xref(fz_context *ctx, pdf_document *doc, pdf_lexbuf *buf) - fz_seek(ctx, file, -(2 + (int)strlen(s)), SEEK_CUR); - } - -- if (ofs < 0) -- fz_throw(ctx, FZ_ERROR_GENERIC, "out of range object num in xref: %d", (int)ofs); -- if (ofs > INT64_MAX - len) -- fz_throw(ctx, FZ_ERROR_GENERIC, "xref section object numbers too big"); -- -+ if (ofs < 0 || ofs > PDF_MAX_OBJECT_NUMBER -+ || len < 0 || len > PDF_MAX_OBJECT_NUMBER -+ || ofs + len - 1 > PDF_MAX_OBJECT_NUMBER) -+ { -+ fz_throw(ctx, FZ_ERROR_GENERIC, "xref subsection object numbers are out of range"); -+ } - /* broken pdfs where size in trailer undershoots entries in xref sections */ - if (ofs + len > xref_len) - { -@@ -933,10 +934,8 @@ pdf_read_new_xref_section(fz_context *ctx, pdf_document *doc, fz_stream *stm, in - pdf_xref_entry *table; - int i, n; - -- if (i0 < 0 || i1 < 0 || i0 > INT_MAX - i1) -- fz_throw(ctx, FZ_ERROR_GENERIC, "negative xref stream entry index"); -- //if (i0 + i1 > pdf_xref_len(ctx, doc)) -- // fz_throw(ctx, FZ_ERROR_GENERIC, "xref stream has too many entries"); -+ if (i0 < 0 || i0 > PDF_MAX_OBJECT_NUMBER || i1 < 0 || i1 > PDF_MAX_OBJECT_NUMBER || i0 + i1 - 1 > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "xref subsection object numbers are out of range"); - - table = pdf_xref_find_subsection(ctx, doc, i0, i1); - for (i = i0; i < i0 + i1; i++) -@@ -2086,6 +2085,10 @@ pdf_create_object(fz_context *ctx, pdf_document *doc) - /* TODO: reuse free object slots by properly linking free object chains in the ofs field */ - pdf_xref_entry *entry; - int num = pdf_xref_len(ctx, doc); -+ -+ if (num > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "too many objects stored in pdf"); -+ - entry = pdf_get_incremental_xref_entry(ctx, doc, num); - entry->type = 'f'; - entry->ofs = -1; --- -2.16.1.338.gd8f744ddde - diff --git a/mupdf-1.12-CVE-2018-1000051.patch b/mupdf-1.12-CVE-2018-1000051.patch deleted file mode 100644 index 7bd4d95..0000000 --- a/mupdf-1.12-CVE-2018-1000051.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 321ba1de287016b0036bf4a56ce774ad11763384 Mon Sep 17 00:00:00 2001 -Message-Id: <321ba1de287016b0036bf4a56ce774ad11763384.1518616543.git.mjg@fedoraproject.org> -From: Sebastian Rasmussen -Date: Tue, 19 Dec 2017 23:47:47 +0100 -Subject: [PATCH] Bug 698825: Do not drop borrowed colorspaces. - -Previously the borrowed colorspace was dropped when updating annotation -appearances, leading to use after free warnings from valgrind/ASAN. ---- - source/pdf/pdf-appearance.c | 8 ++------ - 1 file changed, 2 insertions(+), 6 deletions(-) - -diff --git a/source/pdf/pdf-appearance.c b/source/pdf/pdf-appearance.c -index 70f684f4..d7a1dddd 100644 ---- a/source/pdf/pdf-appearance.c -+++ b/source/pdf/pdf-appearance.c -@@ -2170,7 +2170,6 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p - fz_device *dev = NULL; - font_info font_rec; - fz_text *text = NULL; -- fz_colorspace *cs = NULL; - fz_matrix page_ctm; - - pdf_page_transform(ctx, annot->page, NULL, &page_ctm); -@@ -2184,11 +2183,11 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p - fz_var(dlist); - fz_var(dev); - fz_var(text); -- fz_var(cs); - fz_try(ctx) - { - char *contents = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, PDF_NAME_Contents)); - char *da = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, PDF_NAME_DA)); -+ fz_colorspace *cs; - fz_point pos; - fz_rect rect; - -@@ -2223,7 +2222,6 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p - fz_drop_display_list(ctx, dlist); - font_info_fin(ctx, &font_rec); - fz_drop_text(ctx, text); -- fz_drop_colorspace(ctx, cs); - } - fz_catch(ctx) - { -@@ -2359,7 +2357,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot - fz_device *dev = NULL; - font_info font_rec; - fz_text *text = NULL; -- fz_colorspace *cs = NULL; - fz_path *path = NULL; - fz_buffer *fzbuf = NULL; - fz_matrix page_ctm; -@@ -2375,7 +2372,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot - fz_var(dlist); - fz_var(dev); - fz_var(text); -- fz_var(cs); - fz_var(fzbuf); - fz_try(ctx) - { -@@ -2384,6 +2380,7 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot - fz_rect logo_bounds; - fz_matrix logo_tm; - fz_rect rect; -+ fz_colorspace *cs = fz_device_rgb(ctx); /* Borrowed reference */ - - pdf_to_rect(ctx, pdf_dict_get(ctx, annot->obj, PDF_NAME_Rect), &annot_rect); - rect = annot_rect; -@@ -2396,7 +2393,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot - fz_bound_path(ctx, path, NULL, &fz_identity, &logo_bounds); - center_rect_within_rect(&logo_bounds, &rect, &logo_tm); - fz_concat(&logo_tm, &logo_tm, &page_ctm); -- cs = fz_device_rgb(ctx); /* Borrowed reference */ - fz_fill_path(ctx, dev, path, 0, &logo_tm, cs, logo_color, 1.0f, NULL); - - get_font_info(ctx, doc, dr, da, &font_rec); --- -2.16.1.312.g365a692731 - diff --git a/mupdf-1.12-CVE-2018-5686.patch b/mupdf-1.12-CVE-2018-5686.patch deleted file mode 100644 index 2a723c7..0000000 --- a/mupdf-1.12-CVE-2018-5686.patch +++ /dev/null @@ -1,57 +0,0 @@ -From b70eb93f6936c03d8af52040bbca4d4a7db39079 Mon Sep 17 00:00:00 2001 -Message-Id: -From: Tor Andersson -Date: Tue, 9 Jan 2018 13:52:41 +0100 -Subject: [PATCH] Don't allow reading from a 'dead' fz_stream. - -Once a stream has thrown an exception or reached EOF, -don't allow further reading. - -The EOF flag is reset when fz_seek is invoked. ---- - include/mupdf/fitz/stream.h | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/include/mupdf/fitz/stream.h b/include/mupdf/fitz/stream.h -index cd26be90..790a0a83 100644 ---- a/include/mupdf/fitz/stream.h -+++ b/include/mupdf/fitz/stream.h -@@ -335,10 +335,11 @@ static inline size_t fz_available(fz_context *ctx, fz_stream *stm, size_t max) - - if (len) - return len; -+ if (stm->eof) -+ return 0; -+ - fz_try(ctx) -- { - c = stm->next(ctx, stm, max); -- } - fz_catch(ctx) - { - fz_rethrow_if(ctx, FZ_ERROR_TRYLATER); -@@ -369,10 +370,10 @@ static inline int fz_read_byte(fz_context *ctx, fz_stream *stm) - - if (stm->rp != stm->wp) - return *stm->rp++; -+ if (stm->eof) -+ return EOF; - fz_try(ctx) -- { - c = stm->next(ctx, stm, 1); -- } - fz_catch(ctx) - { - fz_rethrow_if(ctx, FZ_ERROR_TRYLATER); -@@ -398,6 +399,8 @@ static inline int fz_peek_byte(fz_context *ctx, fz_stream *stm) - - if (stm->rp != stm->wp) - return *stm->rp; -+ if (stm->eof) -+ return EOF; - - c = stm->next(ctx, stm, 1); - if (c != EOF) --- -2.16.1.338.gd8f744ddde - diff --git a/mupdf-1.12-CVE-2018-6187.patch b/mupdf-1.12-CVE-2018-6187.patch deleted file mode 100644 index 295579f..0000000 --- a/mupdf-1.12-CVE-2018-6187.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 6ba8c036e9a2147156a426550d97144d16f4cd02 Mon Sep 17 00:00:00 2001 -Message-Id: <6ba8c036e9a2147156a426550d97144d16f4cd02.1518615186.git.mjg@fedoraproject.org> -From: Sebastian Rasmussen -Date: Mon, 29 Jan 2018 23:40:19 +0100 -Subject: [PATCH] Bug 698908: Resize object use and renumbering lists after - repair. - -Previously repair might end up increasing xref_len, but the lists -were not correspodingly expanded, leading to ASAN complaints. ---- - source/pdf/pdf-write.c | 13 +++++++++---- - 1 file changed, 9 insertions(+), 4 deletions(-) - -diff --git a/source/pdf/pdf-write.c b/source/pdf/pdf-write.c -index 9fcdbf0a..beb49252 100644 ---- a/source/pdf/pdf-write.c -+++ b/source/pdf/pdf-write.c -@@ -633,7 +633,8 @@ expand_lists(fz_context *ctx, pdf_write_state *opts, int num) - { - int i; - -- num++; -+ /* objects are numbered 0..num and maybe two additional objects for linearization */ -+ num += 3; - opts->use_list = fz_resize_array(ctx, opts->use_list, num, sizeof(*opts->use_list)); - opts->ofs_list = fz_resize_array(ctx, opts->ofs_list, num, sizeof(*opts->ofs_list)); - opts->gen_list = fz_resize_array(ctx, opts->gen_list, num, sizeof(*opts->gen_list)); -@@ -1522,9 +1523,9 @@ static void preloadobjstms(fz_context *ctx, pdf_document *doc) - { - pdf_obj *obj; - int num; -- int xref_len = pdf_xref_len(ctx, doc); - -- for (num = 0; num < xref_len; num++) -+ /* xref_len may change due to repair, so check it every iteration */ -+ for (num = 0; num < pdf_xref_len(ctx, doc); num++) - { - if (pdf_get_xref_entry(ctx, doc, num)->type == 'o') - { -@@ -2755,7 +2756,7 @@ static void initialise_write_state(fz_context *ctx, pdf_document *doc, const pdf - opts->continue_on_error = in_opts->continue_on_error; - opts->errors = in_opts->errors; - -- expand_lists(ctx, opts, xref_len + 3); -+ expand_lists(ctx, opts, xref_len); - } - - /* Free the resources held by the dynamic write options */ -@@ -2892,6 +2893,8 @@ do_pdf_save_document(fz_context *ctx, pdf_document *doc, pdf_write_state *opts, - { - pdf_ensure_solid_xref(ctx, doc, xref_len); - preloadobjstms(ctx, doc); -+ xref_len = pdf_xref_len(ctx, doc); /* May have changed due to repair */ -+ expand_lists(ctx, opts, xref_len); - } - - /* Sweep & mark objects from the trailer */ -@@ -2900,6 +2903,7 @@ do_pdf_save_document(fz_context *ctx, pdf_document *doc, pdf_write_state *opts, - else - { - xref_len = pdf_xref_len(ctx, doc); /* May have changed due to repair */ -+ expand_lists(ctx, opts, xref_len); - for (num = 0; num < xref_len; num++) - opts->use_list[num] = 1; - } -@@ -2920,6 +2924,7 @@ do_pdf_save_document(fz_context *ctx, pdf_document *doc, pdf_write_state *opts, - if ((opts->do_garbage >= 2 || opts->do_linear) && !opts->do_incremental) - { - xref_len = pdf_xref_len(ctx, doc); /* May have changed due to repair */ -+ expand_lists(ctx, opts, xref_len); - while (xref_len > 0 && !opts->use_list[xref_len-1]) - xref_len--; - } --- -2.16.1.312.g365a692731 - diff --git a/mupdf-1.12-CVE-2018-6192.patch b/mupdf-1.12-CVE-2018-6192.patch deleted file mode 100644 index 7e2929a..0000000 --- a/mupdf-1.12-CVE-2018-6192.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 5e411a99604ff6be5db9e273ee84737204113299 Mon Sep 17 00:00:00 2001 -Message-Id: <5e411a99604ff6be5db9e273ee84737204113299.1518615489.git.mjg@fedoraproject.org> -From: Sebastian Rasmussen -Date: Tue, 30 Jan 2018 02:05:57 +0100 -Subject: [PATCH] Bug 698916: Indirect object numbers must be in range. - ---- - source/pdf/pdf-parse.c | 2 ++ - source/pdf/pdf-xref.c | 4 ++-- - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/source/pdf/pdf-parse.c b/source/pdf/pdf-parse.c -index 7904ebd7..b4783ae8 100644 ---- a/source/pdf/pdf-parse.c -+++ b/source/pdf/pdf-parse.c -@@ -623,6 +623,8 @@ pdf_parse_ind_obj(fz_context *ctx, pdf_document *doc, - fz_throw(ctx, FZ_ERROR_SYNTAX, "expected object number"); - } - num = buf->i; -+ if (num < 0 || num > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_SYNTAX, "object number out of range"); - - tok = pdf_lex(ctx, file, buf); - if (tok != PDF_TOK_INT) -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 4997ebe5..cfcd0a21 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -228,8 +228,8 @@ pdf_xref_entry *pdf_get_populating_xref_entry(fz_context *ctx, pdf_document *doc - } - - /* Prevent accidental heap underflow */ -- if (num < 0) -- fz_throw(ctx, FZ_ERROR_GENERIC, "object number must not be negative (%d)", num); -+ if (num < 0 || num > PDF_MAX_OBJECT_NUMBER) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "object number out of range (%d)", num); - - /* Return the pointer to the entry in the last section. */ - xref = &doc->xref_sections[doc->num_xref_sections-1]; --- -2.16.1.312.g365a692731 - diff --git a/mupdf-1.12-CVE-2018-6544-1.patch b/mupdf-1.12-CVE-2018-6544-1.patch deleted file mode 100644 index 33845da..0000000 --- a/mupdf-1.12-CVE-2018-6544-1.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 26527eef77b3e51c2258c8e40845bfbc015e405d Mon Sep 17 00:00:00 2001 -Message-Id: <26527eef77b3e51c2258c8e40845bfbc015e405d.1518616043.git.mjg@fedoraproject.org> -From: Sebastian Rasmussen -Date: Mon, 29 Jan 2018 02:00:48 +0100 -Subject: [PATCH] Bug 698830: Don't drop unkept stream if running out of error - stack. - -Under normal conditions where fz_keep_stream() is called inside -fz_try() we may call fz_drop_stream() in fz_catch() upon exceptions. -The issue comes when fz_keep_stream() has not yet been called but is -dropped in fz_catch(). This happens in the PDF from the bug when -fz_try() runs out of exception stack, and next the code in fz_catch() -runs, dropping the caller's reference to the filter chain stream! - -The simplest way of fixing this it to always keep the filter chain -stream before fz_try() is called. That way fz_catch() may drop the -stream whether an exception has occurred or if the fz_try() ran out of -exception stack. ---- - source/pdf/pdf-stream.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/source/pdf/pdf-stream.c b/source/pdf/pdf-stream.c -index c89da5c4..c6ba7ad3 100644 ---- a/source/pdf/pdf-stream.c -+++ b/source/pdf/pdf-stream.c -@@ -303,14 +303,13 @@ pdf_open_raw_filter(fz_context *ctx, fz_stream *chain, pdf_document *doc, pdf_ob - *orig_gen = 0; - } - -- fz_var(chain); -+ chain = fz_keep_stream(ctx, chain); - - fz_try(ctx) - { - len = pdf_to_int(ctx, pdf_dict_get(ctx, stmobj, PDF_NAME_Length)); - -- /* don't close chain when we close this filter */ -- chain2 = fz_keep_stream(ctx, chain); -+ chain2 = chain; - chain = NULL; - chain = fz_open_null(ctx, chain2, len, offset); - --- -2.16.1.312.g365a692731 - diff --git a/mupdf-1.12-CVE-2018-6544-2.patch b/mupdf-1.12-CVE-2018-6544-2.patch deleted file mode 100644 index 65121dd..0000000 --- a/mupdf-1.12-CVE-2018-6544-2.patch +++ /dev/null @@ -1,54 +0,0 @@ -From b03def134988da8c800adac1a38a41a1f09a1d89 Mon Sep 17 00:00:00 2001 -Message-Id: -From: Sebastian Rasmussen -Date: Thu, 1 Feb 2018 16:36:14 +0100 -Subject: [PATCH] Bug 698830: Avoid recursion when loading object streams - objects. - -If there were indirect references in the object stream dictionary and -one of those indirect references referred to an object inside the object -stream itself, mupdf would previously enter recursion only bounded by the -exception stack. After this commit the object stream is checked if it is -marked immediately after being loaded. If it is marked then we terminate -the recursion at this point, if it is not marked then mark it and -attempt to load the desired object within. We also take care to unmark -the stream object when done or upon exception. ---- - source/pdf/pdf-xref.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c -index 723b543c..ed09094c 100644 ---- a/source/pdf/pdf-xref.c -+++ b/source/pdf/pdf-xref.c -@@ -1576,6 +1576,19 @@ pdf_load_obj_stm(fz_context *ctx, pdf_document *doc, int num, pdf_lexbuf *buf, i - { - objstm = pdf_load_object(ctx, doc, num); - -+ if (pdf_obj_marked(ctx, objstm)) -+ fz_throw(ctx, FZ_ERROR_GENERIC, "recursive object stream lookup"); -+ } -+ fz_catch(ctx) -+ { -+ pdf_drop_obj(ctx, objstm); -+ fz_rethrow(ctx); -+ } -+ -+ fz_try(ctx) -+ { -+ pdf_mark_obj(ctx, objstm); -+ - count = pdf_to_int(ctx, pdf_dict_get(ctx, objstm, PDF_NAME_N)); - first = pdf_to_int(ctx, pdf_dict_get(ctx, objstm, PDF_NAME_First)); - -@@ -1655,6 +1668,7 @@ pdf_load_obj_stm(fz_context *ctx, pdf_document *doc, int num, pdf_lexbuf *buf, i - fz_drop_stream(ctx, stm); - fz_free(ctx, ofsbuf); - fz_free(ctx, numbuf); -+ pdf_unmark_obj(ctx, objstm); - pdf_drop_obj(ctx, objstm); - } - fz_catch(ctx) --- -2.16.1.312.g365a692731 - diff --git a/mupdf-1.12-openjpeg.patch b/mupdf-1.13-openjpeg.patch similarity index 50% rename from mupdf-1.12-openjpeg.patch rename to mupdf-1.13-openjpeg.patch index 9775b2f..d23ded0 100644 --- a/mupdf-1.12-openjpeg.patch +++ b/mupdf-1.13-openjpeg.patch @@ -1,25 +1,19 @@ diff --git i/source/fitz/load-jpx.c w/source/fitz/load-jpx.c -index 65699bab..800ee32c 100644 +index a1c39f9f..056209a4 100644 --- i/source/fitz/load-jpx.c +++ w/source/fitz/load-jpx.c -@@ -444,12 +444,15 @@ fz_load_jpx_info(fz_context *ctx, const unsigned char *data, size_t size, int *w +@@ -444,6 +444,10 @@ fz_load_jpx_info(fz_context *ctx, const unsigned char *data, size_t size, int *w } #else /* HAVE_LURATECH */ -- +#ifdef __cplusplus +extern "C" +{ - #define OPJ_STATIC - #define OPJ_HAVE_INTTYPES_H - #if !defined(_MSC_VER) || _MSC_VER >= 1600 - #define OPJ_HAVE_STDINT_H - #endif +#endif - #define USE_JPIP #include -@@ -931,6 +934,9 @@ fz_load_jpx_info(fz_context *ctx, const unsigned char *data, size_t size, int *w + +@@ -924,6 +928,9 @@ fz_load_jpx_info(fz_context *ctx, const unsigned char *data, size_t size, int *w } #endif /* HAVE_LURATECH */ diff --git a/mupdf.spec b/mupdf.spec index f391331..bba8c92 100644 --- a/mupdf.spec +++ b/mupdf.spec @@ -1,25 +1,19 @@ Name: mupdf -Version: 1.12.0 -Release: 6%{?dist} +Version: 1.13.0rc1 +%global origversion 1.13.0-rc1 +Release: 1%{?dist} Summary: A lightweight PDF viewer and toolkit Group: Applications/Publishing License: GPLv3 URL: http://mupdf.com/ -Source0: http://mupdf.com/downloads/%{name}-%{version}-source.tar.gz +Source0: http://mupdf.com/downloads/%{name}-%{origversion}-source.tar.gz Source1: %{name}.desktop BuildRequires: gcc make binutils desktop-file-utils coreutils BuildRequires: openjpeg2-devel jbig2dec-devel desktop-file-utils BuildRequires: libjpeg-devel freetype-devel libXext-devel curl-devel BuildRequires: harfbuzz-devel BuildRequires: mesa-libGL-devel freeglut-devel -Patch0: %{name}-1.12-openjpeg.patch -Patch1: %{name}-1.12-CVE-2017-17858.patch -Patch2: %{name}-1.12-CVE-2018-5686.patch -Patch3: %{name}-1.12-CVE-2018-6187.patch -Patch4: %{name}-1.12-CVE-2018-6192.patch -Patch5: %{name}-1.12-CVE-2018-6544-1.patch -Patch6: %{name}-1.12-CVE-2018-6544-2.patch -Patch7: %{name}-1.12-CVE-2018-1000051.patch +Patch0: %{name}-1.13-openjpeg.patch %description MuPDF is a lightweight PDF viewer and toolkit written in portable C. @@ -47,16 +41,9 @@ The mupdf-devel package contains header files for developing applications that use mupdf and static libraries %prep -%setup -q -n %{name}-%{version}-source +%setup -q -n %{name}-%{origversion}-source rm -rf thirdparty %patch0 -p1 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 %build export XCFLAGS="%{optflags} -fPIC -DJBIG_NO_MEMENTO -DTOFU -DTOFU_CJK" @@ -97,6 +84,9 @@ update-desktop-database &> /dev/null || : %{_libdir}/lib%{name}*.a %changelog +* Fri Apr 13 2018 Michael J Gruber - 1.13.0rc1-1 +- rc1 test + * Fri Apr 13 2018 Michael J Gruber - 1.12.0-6 - install svg icon diff --git a/sources b/sources index 5e8fec0..ff2f9e2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (mupdf-1.12.0-source.tar.gz) = 11ae620e55e9ebd5844abd7decacc0dafc90dd1f4907ba6ed12f5c725d3920187fc730a7fc33979bf3ff9451da7dbb51f34480a878083e2064f3455555f47d96 +SHA512 (mupdf-1.13.0-rc1-source.tar.gz) = 6ccf10c94edbc5d37a1122ff6b3b91b9808734d092e1c745ea8e5422062ab62584d1fc02756dd73a6b2cd04d87b1a8ebf4d63ca725aa3bcd08c8f351f37a36cb