diff --git a/Bugfix-for-CVE-2023-51103.patch b/Bugfix-for-CVE-2023-51103.patch deleted file mode 100644 index 4d5c92bf7371f4ceb2ac4c32f1728d40cf305aa6..0000000000000000000000000000000000000000 --- a/Bugfix-for-CVE-2023-51103.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 9393b0bae84dc422d33faeded16a0d4135ab7a5e Mon Sep 17 00:00:00 2001 -From: root -Date: Tue, 6 Aug 2024 11:03:32 +0800 -Subject: [PATCH] Bugfix-for-CVE-2023-51103 - ---- - source/fitz/pixmap.c | 23 ++++++++++++++--------- - 1 files changed, 14 insertions(+), 9 deletions(-) - create mode 100644 0001-CVE-2023-51105.patch - -diff --git a/source/fitz/pixmap.c b/source/fitz/pixmap.c -index db5838e..21af0d0 100644 ---- a/source/fitz/pixmap.c -+++ b/source/fitz/pixmap.c -@@ -1253,10 +1253,11 @@ calc_percentile(int *hist, float thr, float scale, float minval, float maxval) - } - - static void --calc_percentiles(fz_context *ctx, int nsamples, float *samples, float *minprct, float *maxprct) -+calc_percentiles(fz_context *ctx, size_t nsamples, float *samples, float *minprct, float *maxprct) - { - float minval, maxval, scale; -- int *hist, size, k; -+ size_t size, k; -+ int *hist; - - minval = maxval = samples[0]; - for (k = 1; k < nsamples; k++) -@@ -1271,7 +1272,7 @@ calc_percentiles(fz_context *ctx, int nsamples, float *samples, float *minprct, - return; - } - -- size = fz_mini(65535, nsamples); -+ size = fz_minz(65535, nsamples); - scale = (size - 1) / (maxval - minval); - - hist = fz_calloc(ctx, size, sizeof(int)); -@@ -1301,18 +1302,24 @@ fz_new_pixmap_from_float_data(fz_context *ctx, fz_colorspace *cs, int w, int h, - float minsample, maxsample, mu; - float k1, d0, sigma, sigmasq2; - float minprct, maxprct, range; -- int y, k, n = fz_colorspace_n(ctx, cs); -- int nsamples = w * h * n; -+ int y; -+ size_t k, nsamples; - #define KIMKAUTZC1 (3.0f) - #define KIMKAUTZC2 (0.5f) - #define MAXLD (logf(300.0f)) - #define MINLD (logf(0.3f)) - -- fz_var(pixmap); - fz_var(lsamples); - -+ pixmap = fz_new_pixmap(ctx, cs, w, h, NULL, 0); -+ - fz_try(ctx) - { -+ nsamples = (size_t) w * h; -+ if ((size_t) pixmap->n > SIZE_MAX / nsamples) -+ fz_throw(ctx, FZ_ERROR_COUNT, "too many floating point samples to convert to pixmap"); -+ nsamples *= pixmap->n; -+ - lsamples = fz_malloc(ctx, nsamples * sizeof(float)); - - mu = 0; -@@ -1345,8 +1352,6 @@ fz_new_pixmap_from_float_data(fz_context *ctx, fz_colorspace *cs, int w, int h, - calc_percentiles(ctx, nsamples, samples, &minprct, &maxprct); - range = maxprct - minprct; - -- pixmap = fz_new_pixmap(ctx, cs, w, h, NULL, 0); -- - dp = pixmap->samples + pixmap->stride * (h - 1); - sample = samples; - -@@ -1354,7 +1359,7 @@ fz_new_pixmap_from_float_data(fz_context *ctx, fz_colorspace *cs, int w, int h, - { - unsigned char *dpp = dp; - -- for (k = 0; k < w * n; k++) -+ for (k = 0; k < (size_t) w * pixmap->n; k++) - *dpp++ = 255.0f * (fz_clamp(*sample++, minprct, maxprct) - minprct) / range; - - dp -= pixmap->stride; --- -2.27.0 - diff --git a/Bugfix-for-CVE-2023-51104.patch b/Bugfix-for-CVE-2023-51104.patch deleted file mode 100644 index ce49c153f78a11997b0fa23c2de1e3a759b91f30..0000000000000000000000000000000000000000 --- a/Bugfix-for-CVE-2023-51104.patch +++ /dev/null @@ -1,45 +0,0 @@ -From c0093ce8bf279afaeaa225ee76207d3f8a6d0a55 Mon Sep 17 00:00:00 2001 -From: root -Date: Tue, 6 Aug 2024 11:06:42 +0800 -Subject: [PATCH] Bugfix-for-CVE-2023-51104 - ---- - source/fitz/load-pnm.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - -diff --git a/source/fitz/load-pnm.c b/source/fitz/load-pnm.c -index 53ae54f..6a951e1 100644 ---- a/source/fitz/load-pnm.c -+++ b/source/fitz/load-pnm.c -@@ -477,6 +477,10 @@ pnm_binary_read_image(fz_context *ctx, struct info *pnm, const unsigned char *p, - { - fz_pixmap *img = NULL; - size_t span; -+ int n; -+ -+ n = fz_colorspace_n(ctx, pnm->cs); -+ assert(n >= 1 && n <= 3); - - pnm->width = 0; - p = pnm_read_comments(ctx, p, e, 1); -@@ -516,14 +520,14 @@ pnm_binary_read_image(fz_context *ctx, struct info *pnm, const unsigned char *p, - if (pnm->bitdepth == 1) - { - /* Overly sensitive test, but we can live with it. */ -- if ((size_t)pnm->width > SIZE_MAX / (unsigned int)fz_colorspace_n(ctx, pnm->cs)) -+ if ((size_t)pnm->width > SIZE_MAX / (unsigned int)n) - fz_throw(ctx, FZ_ERROR_GENERIC, "image row too large"); -- span = ((size_t)fz_colorspace_n(ctx, pnm->cs) * pnm->width + 7)/8; -+ span = ((size_t)n * pnm->width + 7)/8; - } - else - { - size_t bytes_per_sample = (pnm->bitdepth-1)/8 + 1; -- span = (size_t)fz_colorspace_n(ctx, pnm->cs) * bytes_per_sample; -+ span = (size_t)n * bytes_per_sample; - if ((size_t)pnm->width > SIZE_MAX / span) - fz_throw(ctx, FZ_ERROR_GENERIC, "image row too large"); - span = (size_t)pnm->width * span; --- -2.27.0 - diff --git a/Bugfix-for-CVE-2023-51105.patch b/Bugfix-for-CVE-2023-51105.patch deleted file mode 100644 index d3c633ed87494d937fa05d703f9c87236c0bb1e4..0000000000000000000000000000000000000000 --- a/Bugfix-for-CVE-2023-51105.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 1cd2015f9f1fd6b575e262da23b6ed30884bd597 Mon Sep 17 00:00:00 2001 -From: root -Date: Tue, 6 Aug 2024 11:08:04 +0800 -Subject: [PATCH] Bugfix-for-CVE-2023-51105 - ---- - source/fitz/load-bmp.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/source/fitz/load-bmp.c b/source/fitz/load-bmp.c -index 5b6a79b..f8daa50 100644 ---- a/source/fitz/load-bmp.c -+++ b/source/fitz/load-bmp.c -@@ -580,6 +580,9 @@ bmp_read_bitmap(fz_context *ctx, struct info *info, const unsigned char *begin, - uint32_t x; - int32_t y; - -+ assert(info->width > 0 && info->width <= SHRT_MAX); -+ assert(info->height > 0 && info->height <= SHRT_MAX); -+ - if (info->compression == BI_NONE) - ssp = p; - else if (info->compression == BI_RLE4) --- -2.27.0 - diff --git a/mupdf-1.23.2-source.tar.gz b/mupdf-1.24.8-source.tar.gz similarity index 79% rename from mupdf-1.23.2-source.tar.gz rename to mupdf-1.24.8-source.tar.gz index 92bf7dc0aec84e2eac4e944e60d0f3680394a63c..003264c5911c51c4523ca24a85bedc1214071002 100644 Binary files a/mupdf-1.23.2-source.tar.gz and b/mupdf-1.24.8-source.tar.gz differ diff --git a/mupdf.spec b/mupdf.spec index 1a692a150c45440a4b355430494d3e592a7e3971..eefa935222302b6a27ec0da10615b0dadd133056 100644 --- a/mupdf.spec +++ b/mupdf.spec @@ -7,7 +7,7 @@ %global upversion %{version} Name: mupdf -Version: 1.23.2 +Version: 1.24.8 Release: %{anolis_release}%{?dist} Summary: A lightweight PDF viewer and toolkit License: AGPL-3.0-or-later @@ -16,18 +16,6 @@ Source0: http://mupdf.com/downloads/archive/%{name}-%{upversion}-source.t Source1: %{name}.desktop Source2: %{name}-gl.desktop -# CVE-2023-51103 -# Upstream fix: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=f1b5f87edd2675d5c79301e4ef2e1139f67f904b -Patch1: Bugfix-for-CVE-2023-51103.patch - -# CVE-2023-51104 -# Upstream fix: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0c06a4e51519515615f6ab2d5b1f25da6771e1f4 -Patch2: Bugfix-for-CVE-2023-51104.patch - -# CVE-2023-51105 -# Upstream fix: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=cee86dc519d5270a3b96476ad15809ceace64a26 -Patch3: Bugfix-for-CVE-2023-51105.patch - BuildRequires: gcc gcc-c++ make binutils desktop-file-utils coreutils pkgconfig BuildRequires: openjpeg2-devel desktop-file-utils BuildRequires: libjpeg-devel freetype-devel libXext-devel curl-devel @@ -143,6 +131,9 @@ cd %{buildroot}/%{_bindir} && ln -s %{name}-x11 %{name} %doc README CHANGES docs/* %changelog +* Wed Aug 21 2024 tingyin.duan - 1.24.8-1 +- update version 1.24.8 + * Tue Aug 06 2024 lidongyue - 1.23.2-2 - Fix CVE-2023-51103 - Fix CVE-2023-51104