diff --git a/app-text/tetex/files/tetex-3.0_p1-xpdf-vulnerabilities.patch b/app-text/tetex/files/tetex-3.0_p1-xpdf-vulnerabilities.patch deleted file mode 100644 --- a/app-text/tetex/files/tetex-3.0_p1-xpdf-vulnerabilities.patch +++ /dev/null @@ -1,140 +0,0 @@ ---- tetex-src-3.0/libs/xpdf/xpdf/JPXStream.cc.old 2006-01-22 16:55:56.000000000 +0100 -+++ tetex-src-3.0/libs/xpdf/xpdf/JPXStream.cc 2006-01-22 16:56:09.000000000 +0100 -@@ -7,6 +7,7 @@ - //======================================================================== - - #include -+#include - - #ifdef USE_GCC_PRAGMAS - #pragma implementation ---- tetex-src-3.0/libs/xpdf/xpdf/Stream.cc.old 2006-01-22 16:57:41.000000000 +0100 -+++ tetex-src-3.0/libs/xpdf/xpdf/Stream.cc 2006-01-22 17:08:11.000000000 +0100 -@@ -7,6 +7,7 @@ - //======================================================================== - - #include -+#include - - #ifdef USE_GCC_PRAGMAS - #pragma implementation -@@ -1275,8 +1276,9 @@ - endOfLine = endOfLineA; - byteAlign = byteAlignA; - columns = columnsA; -- if (columns < 1) { -- columns = 1; -+ if (columns < 1 || columns >= INT_MAX / sizeof(short)) { -+ error (-1, "invalid number of columns: %d\n", columns); -+ exit (1); - } - rows = rowsA; - endOfBlock = endOfBlockA; -@@ -2952,6 +2954,10 @@ - height = read16(); - width = read16(); - numComps = str->getChar(); -+ if (numComps <= 0 || numComps > 4) { -+ error(getPos(), "Bad number of components in DCT stream", prec); -+ return gFalse; -+ } - if (prec != 8) { - error(getPos(), "Bad DCT precision %d", prec); - return gFalse; -@@ -2974,6 +2979,11 @@ - - length = read16() - 2; - scanInfo.numComps = str->getChar(); -+ if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) { -+ scanInfo.numComps = 0; -+ error(getPos(), "Bad number of components in DCT stream"); -+ return gFalse; -+ } - --length; - if (length != 2 * scanInfo.numComps + 3) { - error(getPos(), "Bad DCT scan info block"); -@@ -3058,12 +3068,12 @@ - while (length > 0) { - index = str->getChar(); - --length; -- if ((index & 0x0f) >= 4) { -+ if ((index & 0x10) >= 4 || (index & 0x10) < 0) { - error(getPos(), "Bad DCT Huffman table"); - return gFalse; - } - if (index & 0x10) { -- index &= 0x0f; -+ index &= 0x03; - if (index >= numACHuffTables) - numACHuffTables = index+1; - tbl = &acHuffTables[index]; -@@ -3181,9 +3191,11 @@ - do { - do { - c = str->getChar(); -+ if (c == EOF) return EOF; - } while (c != 0xff && c != EOF); - do { - c = str->getChar(); -+ if (c == EOF) return EOF; - } while (c == 0xff); - } while (c == 0x00); - return c; ---- tetex-src-3.0/libs/xpdf/xpdf/JBIG2Stream.cc.old 2006-01-22 17:08:49.000000000 +0100 -+++ tetex-src-3.0/libs/xpdf/xpdf/JBIG2Stream.cc 2006-01-22 17:15:41.000000000 +0100 -@@ -7,6 +7,7 @@ - //======================================================================== - - #include -+#include - - #ifdef USE_GCC_PRAGMAS - #pragma implementation -@@ -681,6 +682,11 @@ - w = wA; - h = hA; - line = (wA + 7) >> 3; -+ if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) { -+ error(-1, "invalid width/height"); -+ data = NULL; -+ return; -+ } - // need to allocate one extra guard byte for use in combine() - data = (Guchar *)gmalloc(h * line + 1); - data[h * line] = 0; -@@ -692,6 +698,11 @@ - w = bitmap->w; - h = bitmap->h; - line = bitmap->line; -+ if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) { -+ error(-1, "invalid width/height"); -+ data = NULL; -+ return; -+ } - // need to allocate one extra guard byte for use in combine() - data = (Guchar *)gmalloc(h * line + 1); - memcpy(data, bitmap->data, h * line); -@@ -720,7 +731,10 @@ - } - - void JBIG2Bitmap::expand(int newH, Guint pixel) { -- if (newH <= h) { -+ if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) { -+ error(-1, "invalid width/height"); -+ gfree(data); -+ data = NULL; - return; - } - // need to allocate one extra guard byte for use in combine() -@@ -2936,6 +2950,11 @@ - JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2; - int x, y, pix; - -+ if (w < 0 || h <= 0 || w >= INT_MAX / h) { -+ error(-1, "invalid width/height"); -+ return NULL; -+ } -+ - bitmap = new JBIG2Bitmap(0, w, h); - bitmap->clearToZero(); -