117 lines
4.0 KiB
Diff
117 lines
4.0 KiB
Diff
diff -Nru cups-1.1.23.orig/pdftops/Catalog.cxx cups-1.1.23/pdftops/Catalog.cxx
|
|
--- cups-1.1.23.orig/pdftops/Catalog.cxx 2005-12-14 18:14:18.000000000 +0100
|
|
+++ cups-1.1.23/pdftops/Catalog.cxx 2005-12-14 18:16:26.000000000 +0100
|
|
@@ -64,8 +64,8 @@
|
|
}
|
|
pagesSize = numPages0 = (int)obj.getNum();
|
|
obj.free();
|
|
- if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize ||
|
|
- pagesSize*sizeof(Ref)/sizeof(Ref) != pagesSize) {
|
|
+ if (pagesSize*(int)sizeof(Page *)/sizeof(Page *) != pagesSize ||
|
|
+ pagesSize*(int)sizeof(Ref)/sizeof(Ref) != pagesSize) {
|
|
error(-1, "Invalid 'pagesSize'");
|
|
ok = gFalse;
|
|
return;
|
|
@@ -197,7 +197,8 @@
|
|
}
|
|
if (start >= pagesSize) {
|
|
pagesSize += 32;
|
|
- if (pagesSize*sizeof(Page *)/sizeof(Page *) != pagesSize) {
|
|
+ if (pagesSize*(int)sizeof(Page *)/sizeof(Page *) != pagesSize ||
|
|
+ pagesSize*(int)sizeof(Ref)/sizeof(Ref) != pagesSize) {
|
|
error(-1, "Invalid 'pagesSize' parameter.");
|
|
goto err3;
|
|
}
|
|
diff -Nru cups-1.1.23.orig/pdftops/Decrypt.cxx cups-1.1.23/pdftops/Decrypt.cxx
|
|
--- cups-1.1.23.orig/pdftops/Decrypt.cxx 2005-12-14 18:14:18.000000000 +0100
|
|
+++ cups-1.1.23/pdftops/Decrypt.cxx 2005-12-14 18:16:26.000000000 +0100
|
|
@@ -130,13 +130,19 @@
|
|
Guchar *buf;
|
|
Guchar test[32];
|
|
Guchar fState[256];
|
|
- Guchar tmpKey[16];
|
|
+ Guchar *tmpKey;
|
|
Guchar fx, fy;
|
|
int len, i, j;
|
|
GBool ok;
|
|
|
|
+ // check whether we have non-zero keyLength
|
|
+ if ( !keyLength || keyLength > 16 ) {
|
|
+ return gFalse;
|
|
+ }
|
|
+
|
|
// generate file key
|
|
buf = (Guchar *)gmalloc(68 + fileID->getLength());
|
|
+ tmpKey = (Guchar *)gmalloc(keyLength * sizeof(Guchar));
|
|
if (userPassword) {
|
|
len = userPassword->getLength();
|
|
if (len < 32) {
|
|
@@ -189,6 +195,7 @@
|
|
ok = gFalse;
|
|
}
|
|
|
|
+ gfree(tmpKey);
|
|
gfree(buf);
|
|
return ok;
|
|
}
|
|
diff -Nru cups-1.1.23.orig/pdftops/FontFile.cxx cups-1.1.23/pdftops/FontFile.cxx
|
|
--- cups-1.1.23.orig/pdftops/FontFile.cxx 2005-12-14 18:14:18.000000000 +0100
|
|
+++ cups-1.1.23/pdftops/FontFile.cxx 2005-12-14 18:16:26.000000000 +0100
|
|
@@ -18,6 +18,7 @@
|
|
#include <stdarg.h>
|
|
#include <string.h>
|
|
#include <ctype.h>
|
|
+#include <error.h>
|
|
#include "gmem.h"
|
|
#include "GHash.h"
|
|
#include "Error.h"
|
|
@@ -3572,6 +3573,9 @@
|
|
} else {
|
|
origLocaTable[i].pos = 2 * getUShort(pos + 2*i);
|
|
}
|
|
+
|
|
+ if (origLocaTable[i].pos < 0 || origLocaTable[i].pos > len)
|
|
+ error (1, 0, "bad loca table pos value");
|
|
}
|
|
qsort(origLocaTable, nGlyphs + 1, sizeof(TrueTypeLoca), &cmpTrueTypeLocaPos);
|
|
for (i = 0; i < nGlyphs; ++i) {
|
|
diff -Nru cups-1.1.23.orig/pdftops/XRef.cxx cups-1.1.23/pdftops/XRef.cxx
|
|
--- cups-1.1.23.orig/pdftops/XRef.cxx 2005-12-14 18:14:18.000000000 +0100
|
|
+++ cups-1.1.23/pdftops/XRef.cxx 2005-12-14 18:16:26.000000000 +0100
|
|
@@ -76,7 +76,7 @@
|
|
|
|
// trailer is ok - read the xref table
|
|
} else {
|
|
- if (size*sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
|
|
+ if (size*(int)sizeof(XRefEntry)/sizeof(XRefEntry) != size) {
|
|
error(-1, "Invalid 'size' inside xref table.");
|
|
ok = gFalse;
|
|
errCode = errDamaged;
|
|
@@ -291,7 +291,7 @@
|
|
// table size
|
|
if (first + n > size) {
|
|
newSize = first + n;
|
|
- if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
|
|
+ if (newSize*(int)sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
|
|
error(-1, "Invalid 'newSize'");
|
|
goto err2;
|
|
}
|
|
@@ -445,7 +445,7 @@
|
|
if (!strncmp(p, "obj", 3)) {
|
|
if (num >= size) {
|
|
newSize = (num + 1 + 255) & ~255;
|
|
- if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
|
|
+ if (newSize*(int)sizeof(XRefEntry)/sizeof(XRefEntry) != newSize) {
|
|
error(-1, "Invalid 'obj' parameters.");
|
|
return gFalse;
|
|
}
|
|
@@ -470,7 +470,7 @@
|
|
} else if (!strncmp(p, "endstream", 9)) {
|
|
if (streamEndsLen == streamEndsSize) {
|
|
streamEndsSize += 64;
|
|
- if (streamEndsSize*sizeof(int)/sizeof(int) != streamEndsSize) {
|
|
+ if (streamEndsSize*(int)sizeof(int)/sizeof(int) != streamEndsSize) {
|
|
error(-1, "Invalid 'endstream' parameter.");
|
|
return gFalse;
|
|
}
|