helium-3rd-party/meta-openembedded
1
0
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-08-11 12:08:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

poppler: Fix CVE-2025-43718

Browse Source 
Upstream patch: f54b815672

Reference: https://ubuntu.com/security/CVE-2025-43718

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
This commit is contained in:
Vijay Anusuri 2025-10-10 09:56:36 +05:30 committed by Anuj Mittal
parent 0d59e9acda
commit fe8e7d62aa
No known key found for this signature in database
GPG Key ID: B749E1556041E1B2
2 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
meta-oe/recipes-support/poppler/poppler/CVE-2025-43718.patch Normal file
View File

@ -0,0 +1,31 @@
From f54b815672117c250420787c8c006de98e8c7408 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Wed, 26 Mar 2025 11:26:32 +0100
Subject: [PATCH] Make sure regex doesn't stack overflow by limiting it
Happens with very long pdfsubver strings when compiled with
-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto
Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408]
CVE: CVE-2025-43718
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
poppler/PDFDoc.cc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index a7c2e24..a779def 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -482,7 +482,7 @@ static PDFSubtypePart pdfPartFromString(PDFSubtype subtype, const std::string &p
static PDFSubtypeConformance pdfConformanceFromString(const std::string &pdfsubver)
{
- const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]+)");
+ const std::regex regex("PDF/(?:A|X|VT|E|UA)-[[:digit:]]([[:alpha:]]{1,3})");
std::smatch match;
PDFSubtypeConformance pdfConf = subtypeConfNone;
--
2.25.1

1
meta-oe/recipes-support/poppler/poppler_23.04.0.bb
View File

@ -19,6 +19,7 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
file://CVE-2025-52886-0001.patch \
file://CVE-2025-52886-0002.patch \
file://CVE-2025-50420.patch \
file://CVE-2025-43718.patch \
"
SRC_URI[sha256sum] = "b6d893dc7dcd4138b9e9df59a13c59695e50e80dc5c2cacee0674670693951a1"