1 files changed, 77 insertions, 0 deletions
diff --git a/backport-CVE-2022-38349.patch b/backport-CVE-2022-38349.patch
new file mode 100644
index 0000000..5ba9d9a
--- /dev/null
+++ b/backport-CVE-2022-38349.patch
@@ -0,0 +1,77 @@
+From 4564a002bcb6094cc460bc0d5ddff9423fe6dd28 Mon Sep 17 00:00:00 2001
+From: crt <chluo@cse.cuhk.edu.hk>
+Date: Sat, 13 Aug 2022 16:53:11 +0000
+Subject: [PATCH] pdfunite: Fix crash on broken files
+
+---
+ poppler/PDFDoc.cc |  6 +++++-
+ poppler/PDFDoc.h  |  2 +-
+ utils/pdfunite.cc | 11 ++++++++---
+ 3 files changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
+index fcc17a4..7beabe1 100644
+--- a/poppler/PDFDoc.cc
++++ b/poppler/PDFDoc.cc
+@@ -1795,12 +1795,15 @@ bool PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
+   return true;
+ }
+ 
+-void PDFDoc::replacePageDict(int pageNo, int rotate,
++bool PDFDoc::replacePageDict(int pageNo, int rotate,
+                              const PDFRectangle *mediaBox,
+                              const PDFRectangle *cropBox)
+ {
+   Ref *refPage = getCatalog()->getPageRef(pageNo);
+   Object page = getXRef()->fetch(*refPage);
++  if (!page.isDict()) {
++      return false;
++  }
+   Dict *pageDict = page.getDict();
+   pageDict->remove("MediaBoxssdf");
+   pageDict->remove("MediaBox");
+@@ -1830,6 +1833,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate,
+   pageDict->add("TrimBox", std::move(trimBoxObject));
+   pageDict->add("Rotate", Object(rotate));
+   getXRef()->setModifiedObject(&page, *refPage);
++  return true;
+ }
+ 
+ bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
+diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
+index b504004..1295d8a 100644
+--- a/poppler/PDFDoc.h
++++ b/poppler/PDFDoc.h
+@@ -332,7 +332,7 @@ public:
+   void *getGUIData() { return guiData; }
+ 
+   // rewrite pageDict with MediaBox, CropBox and new page CTM
+-  void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
++  bool replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
+   bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
+   bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
+   void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
+diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
+index 9735096..60cd227 100644
+--- a/utils/pdfunite.cc
++++ b/utils/pdfunite.cc
+@@ -299,9 +299,14 @@ int main (int argc, char *argv[])
+       const PDFRectangle *cropBox = nullptr;
+       if (docs[i]->getCatalog()->getPage(j)->isCropped())
+         cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
+-      docs[i]->replacePageDict(j,
+-	    docs[i]->getCatalog()->getPage(j)->getRotate(),
+-	    docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
++      if (!docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox)) {
++          fclose(f);
++          delete yRef;
++          delete countRef;
++          delete outStr;
++          error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
++          return -1;
++      }
+       Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
+       Object page = docs[i]->getXRef()->fetch(*refPage);
+       Dict *pageDict = page.getDict();
+-- 
+2.33.0