diff options
Diffstat (limited to 'backport-CVE-2024-56378.patch')
| -rw-r--r-- | backport-CVE-2024-56378.patch | 103 |
1 files changed, 52 insertions, 51 deletions
diff --git a/backport-CVE-2024-56378.patch b/backport-CVE-2024-56378.patch index eee9eaa..7519346 100644 --- a/backport-CVE-2024-56378.patch +++ b/backport-CVE-2024-56378.patch @@ -12,61 +12,62 @@ diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc index f482a123f..b2f96e149 100644 --- a/poppler/JBIG2Stream.cc +++ b/poppler/JBIG2Stream.cc -@@ -857,7 +857,7 @@ +@@ -762,7 +762,7 @@ void JBIG2Bitmap::duplicateRow(int yDest, int ySrc) - void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, - unsigned int combOp) { -- int x0, x1, y0, y1, xx, yy; -+ int x0, x1, y0, y1, xx, yy, yyy; - unsigned char *srcPtr, *destPtr; - unsigned int src0, src1, src, dest, s1, s2, m1, m2, m3; - bool oneByte; -@@ -902,13 +902,16 @@ - oneByte = x0 == ((x1 - 1) & ~7); + void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, unsigned int combOp) + { +- int x0, x1, y0, y1, xx, yy; ++ int x0, x1, y0, y1, xx, yy, yyy; + unsigned char *srcPtr, *destPtr; + unsigned int src0, src1, src, dest, s1, s2, m1, m2, m3; + bool oneByte; +@@ -809,14 +809,17 @@ void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, unsigned int combOp + oneByte = x0 == ((x1 - 1) & ~7); - for (yy = y0; yy < y1; ++yy) { -- if (unlikely((y + yy >= h) || (y + yy < 0))) -+ if (unlikely(checkedAdd(y, yy, &yyy))) { -+ continue; -+ } -+ if (unlikely((yyy >= h) || (yyy < 0))) - continue; + for (yy = y0; yy < y1; ++yy) { +- if (unlikely((y + yy >= h) || (y + yy < 0))) { ++ if (unlikely(checkedAdd(y, yy, &yyy))) { ++ continue; ++ } ++ if (unlikely((yyy >= h) || (yyy < 0))) { + continue; + } - // one byte per line -- need to mask both left and right side - if (oneByte) { - if (x >= 0) { -- destPtr = data + (y + yy) * line + (x >> 3); -+ destPtr = data + yyy * line + (x >> 3); - srcPtr = bitmap->data + yy * bitmap->line; - dest = *destPtr; - src1 = *srcPtr; -@@ -931,7 +934,7 @@ - } - *destPtr = dest; - } else { -- destPtr = data + (y + yy) * line; -+ destPtr = data + yyy * line; - srcPtr = bitmap->data + yy * bitmap->line + (-x >> 3); - dest = *destPtr; - src1 = *srcPtr; -@@ -961,7 +964,7 @@ + // one byte per line -- need to mask both left and right side + if (oneByte) { + if (x >= 0) { +- destPtr = data + (y + yy) * line + (x >> 3); ++ destPtr = data + yyy * line + (x >> 3); + srcPtr = bitmap->data + yy * bitmap->line; + dest = *destPtr; + src1 = *srcPtr; +@@ -839,7 +842,7 @@ void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, unsigned int combOp + } + *destPtr = dest; + } else { +- destPtr = data + (y + yy) * line; ++ destPtr = data + yyy * line; + srcPtr = bitmap->data + yy * bitmap->line + (-x >> 3); + dest = *destPtr; + src1 = *srcPtr; +@@ -869,7 +872,7 @@ void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, unsigned int combOp - // left-most byte - if (x >= 0) { -- destPtr = data + (y + yy) * line + (x >> 3); -+ destPtr = data + yyy * line + (x >> 3); - srcPtr = bitmap->data + yy * bitmap->line; - src1 = *srcPtr++; - dest = *destPtr; -@@ -985,7 +988,7 @@ - *destPtr++ = dest; - xx = x0 + 8; - } else { -- destPtr = data + (y + yy) * line; -+ destPtr = data + yyy * line; - srcPtr = bitmap->data + yy * bitmap->line + (-x >> 3); - src1 = *srcPtr++; - xx = x0; + // left-most byte + if (x >= 0) { +- destPtr = data + (y + yy) * line + (x >> 3); ++ destPtr = data + yyy * line + (x >> 3); + srcPtr = bitmap->data + yy * bitmap->line; + src1 = *srcPtr++; + dest = *destPtr; +@@ -893,7 +896,7 @@ void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, unsigned int combOp + *destPtr++ = dest; + xx = x0 + 8; + } else { +- destPtr = data + (y + yy) * line; ++ destPtr = data + yyy * line; + srcPtr = bitmap->data + yy * bitmap->line + (-x >> 3); + src1 = *srcPtr++; + xx = x0; -- GitLab |