File poppler-CVE-2022-37052.patch of Package poppler

Overview Repositories Revisions Requests Users Attributes Meta

File poppler-CVE-2022-37052.patch of Package poppler

Index: poppler-22.01.0/poppler/PDFDoc.cc
===================================================================
--- poppler-22.01.0.orig/poppler/PDFDoc.cc
+++ poppler-22.01.0/poppler/PDFDoc.cc
@@ -942,7 +942,14 @@ int PDFDoc::savePageAs(const GooString *
     Object resourcesObj = pagesDict->lookup("Resources");
     if (resourcesObj.isDict())
         markPageObjects(resourcesObj.getDict(), yRef, countRef, 0, refPage->num, rootNum + 2);
-    markPageObjects(catDict, yRef, countRef, 0, refPage->num, rootNum + 2);
+    if (!markPageObjects(catDict, yRef, countRef, 0, refPage->num, rootNum + 2)) {
+        fclose(f);
+        delete yRef;
+        delete countRef;
+        delete outStr;
+        error(errSyntaxError, -1, "markPageObjects failed");
+        return errDamaged;
+    }
 
     Dict *pageDict = page.getDict();
     if (resourcesObj.isNull() && !pageDict->hasKey("Resources")) {
@@ -1663,7 +1670,7 @@ void PDFDoc::writeHeader(OutStream *outS
     outStr->printf("%%%c%c%c%c\n", 0xE2, 0xE3, 0xCF, 0xD3);
 }
 
-void PDFDoc::markDictionnary(Dict *dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
+bool PDFDoc::markDictionnary(Dict *dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
 {
     bool deleteSet = false;
     if (!alreadyMarkedDicts) {
@@ -1675,7 +1682,7 @@ void PDFDoc::markDictionnary(Dict *dict,
         error(errSyntaxWarning, -1, "PDFDoc::markDictionnary: Found recursive dicts");
         if (deleteSet)
             delete alreadyMarkedDicts;
-        return;
+        return true;
     } else {
         alreadyMarkedDicts->insert(dict);
     }
@@ -1684,7 +1691,10 @@ void PDFDoc::markDictionnary(Dict *dict,
         const char *key = dict->getKey(i);
         if (strcmp(key, "Annots") != 0) {
             Object obj1 = dict->getValNF(i).copy();
-            markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+            const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+            if (unlikely(!success)) {
+                return false;
+            }
         } else {
             Object annotsObj = dict->getValNF(i).copy();
             if (!annotsObj.isNull()) {
@@ -1696,9 +1706,11 @@ void PDFDoc::markDictionnary(Dict *dict,
     if (deleteSet) {
         delete alreadyMarkedDicts;
     }
+
+    return true;
 }
 
-void PDFDoc::markObject(Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
+bool PDFDoc::markObject(Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
 {
     Array *array;
 
@@ -1707,22 +1719,34 @@ void PDFDoc::markObject(Object *obj, XRe
         array = obj->getArray();
         for (int i = 0; i < array->getLength(); i++) {
             Object obj1 = array->getNF(i).copy();
-            markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+            const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+            if (unlikely(!success)) {
+                return false;
+            }
         }
         break;
-    case objDict:
-        markDictionnary(obj->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
-        break;
+    case objDict: {
+        const bool success = markDictionnary(obj->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+        if (unlikely(!success)) {
+            return false;
+        }
+    } break;
     case objStream: {
         Stream *stream = obj->getStream();
-        markDictionnary(stream->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+        const bool success = markDictionnary(stream->getDict(), xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+        if (unlikely(!success)) {
+            return false;
+        }
     } break;
     case objRef: {
         if (obj->getRef().num + (int)numOffset >= xRef->getNumObjects() || xRef->getEntry(obj->getRef().num + numOffset)->type == xrefEntryFree) {
             if (getXRef()->getEntry(obj->getRef().num)->type == xrefEntryFree) {
-                return; // already marked as free => should be replaced
+                return true; // already marked as free => should be replaced
+            }
+            const bool success = xRef->add(obj->getRef().num + numOffset, obj->getRef().gen, 0, true);
+            if (unlikely(!success)) {
+                return false;
             }
-            xRef->add(obj->getRef().num + numOffset, obj->getRef().gen, 0, true);
             if (getXRef()->getEntry(obj->getRef().num)->type == xrefEntryCompressed) {
                 xRef->getEntry(obj->getRef().num + numOffset)->type = xrefEntryCompressed;
             }
@@ -1736,11 +1760,16 @@ void PDFDoc::markObject(Object *obj, XRe
                 break;
         }
         Object obj1 = getXRef()->fetch(obj->getRef());
-        markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum);
+        const bool success = markObject(&obj1, xRef, countRef, numOffset, oldRefNum, newRefNum);
+        if (unlikely(!success)) {
+            return false;
+        }
     } break;
     default:
         break;
     }
+
+    return true;
 }
 
 void PDFDoc::replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox)
@@ -1781,7 +1810,7 @@ void PDFDoc::replacePageDict(int pageNo,
     getXRef()->setModifiedObject(&page, *refPage);
 }
 
-void PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
+bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts)
 {
     pageDict->remove("OpenAction");
     pageDict->remove("Outlines");
@@ -1791,9 +1820,13 @@ void PDFDoc::markPageObjects(Dict *pageD
         const char *key = pageDict->getKey(n);
         Object value = pageDict->getValNF(n).copy();
         if (strcmp(key, "Parent") != 0 && strcmp(key, "Pages") != 0 && strcmp(key, "AcroForm") != 0 && strcmp(key, "Annots") != 0 && strcmp(key, "P") != 0 && strcmp(key, "Root") != 0) {
-            markObject(&value, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+            const bool success = markObject(&value, xRef, countRef, numOffset, oldRefNum, newRefNum, alreadyMarkedDicts);
+            if (unlikely(!success)) {
+                return false;
+            }
         }
     }
+    return true;
 }
 
 bool PDFDoc::markAnnotations(Object *annotsObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict *> *alreadyMarkedDicts)
Index: poppler-22.01.0/poppler/PDFDoc.h
===================================================================
--- poppler-22.01.0.orig/poppler/PDFDoc.h
+++ poppler-22.01.0/poppler/PDFDoc.h
@@ -316,7 +316,7 @@ public:
 
     // rewrite pageDict with MediaBox, CropBox and new page CTM
     void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
-    void markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
+    bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
     bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
     void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
     // write all objects used by pageDict to outStr
@@ -341,8 +341,8 @@ public:
 
 private:
     // insert referenced objects in XRef
-    void markDictionnary(Dict *dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts);
-    void markObject(Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
+    bool markDictionnary(Dict *dict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts);
+    bool markObject(Object *obj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict *> *alreadyMarkedDicts = nullptr);
     static void writeDictionnary(Dict *dict, OutStream *outStr, XRef *xRef, unsigned int numOffset, unsigned char *fileKey, CryptAlgorithm encAlgorithm, int keyLength, Ref ref, std::set<Dict *> *alreadyWrittenDicts);
 
     // Write object header to current file stream and return its offset
Index: poppler-22.01.0/poppler/XRef.cc
===================================================================
--- poppler-22.01.0.orig/poppler/XRef.cc
+++ poppler-22.01.0/poppler/XRef.cc
@@ -1361,12 +1361,18 @@ void XRef::add(Ref ref, Goffset offs, bo
     add(ref.num, ref.gen, offs, used);
 }
 
-void XRef::add(int num, int gen, Goffset offs, bool used)
+bool XRef::add(int num, int gen, Goffset offs, bool used)
 {
     xrefLocker();
     if (num >= size) {
         if (num >= capacity) {
-            entries = (XRefEntry *)greallocn(entries, num + 1, sizeof(XRefEntry));
+            entries = (XRefEntry *)greallocn_checkoverflow(entries, num + 1, sizeof(XRefEntry));
+            if (unlikely(entries == nullptr)) {
+                size = 0;
+                capacity = 0;
+                return false;
+            }
+
             capacity = num + 1;
         }
         for (int i = size; i < num + 1; ++i) {
@@ -1389,6 +1395,7 @@ void XRef::add(int num, int gen, Goffset
         e->type = xrefEntryFree;
         e->offset = 0;
     }
+    return true;
 }
 
 void XRef::setModifiedObject(const Object *o, Ref r)
Index: poppler-22.01.0/poppler/XRef.h
===================================================================
--- poppler-22.01.0.orig/poppler/XRef.h
+++ poppler-22.01.0/poppler/XRef.h
@@ -207,7 +207,7 @@ public:
     void setModifiedObject(const Object *o, Ref r);
     Ref addIndirectObject(const Object &o);
     void removeIndirectObject(Ref r);
-    void add(int num, int gen, Goffset offs, bool used);
+    bool add(int num, int gen, Goffset offs, bool used);
     void add(Ref ref, Goffset offs, bool used);
     // Adds a stream object using AutoFreeMemStream.
     // The function takes ownership over dict and buffer.

Places

File poppler-CVE-2022-37052.patch of Package poppler

Places