helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-05-22 01:22:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

poppler: fix CVE-2024-6239

Browse Source 
A flaw was found in the Poppler's Pdfinfo utility. This issue
occurs when using -dests parameter with pdfinfo utility. By
using certain malformed input files, an attacker could cause
the utility to crash, leading to a denial of service.

CVE-2024-6239-0001 is the dependent commit and CVE-2024-6239-0002
is the actual CVE fix.

fix indent issue in poppler_22.04.0.bb file.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-6239

Upstream patches:
0554731052
fc1c711cb5

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This commit is contained in:
Yogita Urade 2025-01-09 12:25:26 +00:00 committed by Armin Kuster
parent 9d2f35c8ce
commit e9e496dc64
3 changed files with 1370 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1255
meta-oe/recipes-support/poppler/poppler/CVE-2024-6239-0001.patch Normal file
View File

File diff suppressed because it is too large Load Diff

112
meta-oe/recipes-support/poppler/poppler/CVE-2024-6239-0002.patch Normal file
View File

@ -0,0 +1,112 @@
From 0554731052d1a97745cb179ab0d45620589dd9c4 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Fri, 7 Jun 2024 00:54:55 +0200
Subject: [PATCH] pdfinfo: Fix crash in broken documents when using -dests
CVE: CVE-2024-6239
Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/0554731052d1a97745cb179ab0d45620589dd9c4]
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
utils/pdfinfo.cc | 35 +++++++++++++++--------------------
1 file changed, 15 insertions(+), 20 deletions(-)
diff --git a/utils/pdfinfo.cc b/utils/pdfinfo.cc
index a446c3c..4b9166f 100644
--- a/utils/pdfinfo.cc
+++ b/utils/pdfinfo.cc
@@ -15,7 +15,7 @@
// under GPL version 2 or later
//
// Copyright (C) 2006 Dom Lachowicz <cinamod@hotmail.com>
-// Copyright (C) 2007-2010, 2012, 2016-2022 Albert Astals Cid <aacid@kde.org>
+// Copyright (C) 2007-2010, 2012, 2016-2022, 2024 Albert Astals Cid <aacid@kde.org>
// Copyright (C) 2010 Hib Eris <hib@hiberis.nl>
// Copyright (C) 2011 Vittal Aithal <vittal.aithal@cognidox.com>
// Copyright (C) 2012, 2013, 2016-2018, 2021 Adrian Johnson <ajohnson@redneon.com>
@@ -112,16 +112,21 @@ static const ArgDesc argDesc[] = { { "-f", argInt, &firstPage, 0, "first page to
{ "-?", argFlag, &printHelp, 0, "print usage information" },
{} };
-static void printTextString(const GooString *s, const UnicodeMap *uMap)
+static void printStdTextString(const std::string &s, const UnicodeMap *uMap)
{
char buf[8];
- std::vector<Unicode> u = TextStringToUCS4(s->toStr());
+ const std::vector<Unicode> u = TextStringToUCS4(s);
for (const auto &c : u) {
int n = uMap->mapUnicode(c, buf, sizeof(buf));
fwrite(buf, 1, n, stdout);
}
}
+static void printTextString(const GooString *s, const UnicodeMap *uMap)
+{
+ printStdTextString(s->toStr(), uMap);
+}
+
static void printUCS4String(const Unicode *u, int len, const UnicodeMap *uMap)
{
char buf[8];
@@ -293,11 +298,6 @@ static void printStruct(const StructElement *element, unsigned indent)
}
}
-struct GooStringCompare
-{
- bool operator()(GooString *lhs, GooString *rhs) const { return lhs->cmp(const_cast<GooString *>(rhs)) < 0; }
-};
-
static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
{
GooString s;
@@ -368,29 +368,25 @@ static void printLinkDest(const std::unique_ptr<LinkDest> &dest)
static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
{
- std::map<Ref, std::map<GooString *, std::unique_ptr<LinkDest>, GooStringCompare>> map;
+ std::map<Ref, std::map<std::string, std::unique_ptr<LinkDest>>> map;
int numDests = doc->getCatalog()->numDestNameTree();
for (int i = 0; i < numDests; i++) {
- GooString *name = new GooString(doc->getCatalog()->getDestNameTreeName(i));
+ const GooString *name = doc->getCatalog()->getDestNameTreeName(i);
std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestNameTreeDest(i);
- if (dest && dest->isPageRef()) {
+ if (name && dest && dest->isPageRef()) {
Ref pageRef = dest->getPageRef();
- map[pageRef].insert(std::make_pair(name, std::move(dest)));
- } else {
- delete name;
+ map[pageRef].insert(std::make_pair(name->toStr(), std::move(dest)));
}
}
numDests = doc->getCatalog()->numDests();
for (int i = 0; i < numDests; i++) {
- GooString *name = new GooString(doc->getCatalog()->getDestsName(i));
+ const char *name = doc->getCatalog()->getDestsName(i);
std::unique_ptr<LinkDest> dest = doc->getCatalog()->getDestsDest(i);
- if (dest && dest->isPageRef()) {
+ if (name && dest && dest->isPageRef()) {
Ref pageRef = dest->getPageRef();
map[pageRef].insert(std::make_pair(name, std::move(dest)));
- } else {
- delete name;
}
}
@@ -404,9 +400,8 @@ static void printDestinations(PDFDoc *doc, const UnicodeMap *uMap)
printf("%4d ", i);
printLinkDest(it.second);
printf(" \"");
- printTextString(it.first, uMap);
+ printStdTextString(it.first, uMap);
printf("\"\n");
- delete it.first;
}
}
}
--
2.40.0

4
meta-oe/recipes-support/poppler/poppler_22.04.0.bb
View File

@ -7,7 +7,9 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
file://0001-Do-not-overwrite-all-our-build-flags.patch \
file://basename-include.patch \
file://0001-JBIG2Stream-Fix-crash-on-broken-file.patch \
file://CVE-2023-34872.patch \
file://CVE-2023-34872.patch \
file://CVE-2024-6239-0001.patch \
file://CVE-2024-6239-0002.patch \
"
SRC_URI[sha256sum] = "813fb4b90e7bda63df53205c548602bae728887a60f4048aae4dbd9b1927deff"