mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-13 15:47:23 +00:00
poppler: patch CVE-2026-102620
Also backport commit[1] to allow cherry-pick of the commit fixing the CVE. Details: https://nvd.nist.gov/vuln/detail/cve-2026-102620 [1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
This commit is contained in:
Ankur Tyagi committed
1 parent
435cd16e9b
commit
3e78f34c9b
3 files changed
+181
No files matched your search
@@ -0,0 +1,145 @@
|
||||
From b8ce8bb5df02fd3a70f4b34f3d64c88df7089409 Mon Sep 17 00:00:00 2001
|
||||
From: Albert Astals Cid <aacid@kde.org>
|
||||
Date: Sat, 8 Aug 2026 15:30:32 +0200
|
||||
Subject: [PATCH] FoFiTrueType::cvtSfnts: Move variables closer to where they
|
||||
are used
|
||||
|
||||
(cherry picked from commit 786b06dac87dbe28e85ec7ea3d340810f151c25b)
|
||||
|
||||
CVE: CVE-2026-102620
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b]
|
||||
|
||||
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
||||
---
|
||||
fofi/FoFiTrueType.cc | 42 +++++++++++++++++++-----------------------
|
||||
1 file changed, 19 insertions(+), 23 deletions(-)
|
||||
|
||||
diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
|
||||
index 133fbc45e..e15cfc576 100644
|
||||
--- a/fofi/FoFiTrueType.cc
|
||||
+++ b/fofi/FoFiTrueType.cc
|
||||
@@ -1058,9 +1058,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
TrueTypeTable newTables[nT42Tables];
|
||||
unsigned char tableDir[12 + nT42Tables * 16];
|
||||
bool ok;
|
||||
- unsigned int checksum;
|
||||
- int nNewTables;
|
||||
- int glyfTableLen, length, glyfPos, j, k;
|
||||
std::array<unsigned char, 36> vheaTab = {
|
||||
0, 1, 0, 0, // table version number
|
||||
0, 0, // ascent
|
||||
@@ -1081,8 +1078,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
0, 1 // number of advance heights in vmtx table
|
||||
};
|
||||
std::vector<unsigned char> vmtxTab;
|
||||
- bool needVhea, needVmtx;
|
||||
- int advance;
|
||||
|
||||
*maxUsedGlyph = -1;
|
||||
|
||||
@@ -1116,7 +1111,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
i = seekTable("loca");
|
||||
pos = tables[i].offset;
|
||||
i = seekTable("glyf");
|
||||
- glyfTableLen = tables[i].len;
|
||||
+ const int glyfTableLen = tables[i].len;
|
||||
ok = true;
|
||||
for (i = 0; i <= nGlyphs; ++i) {
|
||||
locaTable[i].idx = i;
|
||||
@@ -1169,16 +1164,16 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
}
|
||||
|
||||
// count the number of tables
|
||||
- nNewTables = 0;
|
||||
+ int nNewTables = 0;
|
||||
for (i = 0; i < nT42Tables; ++i) {
|
||||
if (t42Tables[i].required || seekTable(t42Tables[i].tag) >= 0) {
|
||||
++nNewTables;
|
||||
}
|
||||
}
|
||||
- advance = 0; // make gcc happy
|
||||
+ int advance = 0; // make gcc happy
|
||||
if (needVerticalMetrics) {
|
||||
- needVhea = seekTable("vhea") < 0;
|
||||
- needVmtx = seekTable("vmtx") < 0;
|
||||
+ const bool needVhea = seekTable("vhea") < 0;
|
||||
+ const bool needVmtx = seekTable("vmtx") < 0;
|
||||
if (needVhea || needVmtx) {
|
||||
i = seekTable("head");
|
||||
advance = getU16BE(tables[i].offset + 18, &ok); // units per em
|
||||
@@ -1194,10 +1189,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
// construct the new table headers, including table checksums
|
||||
// (pad each table out to a multiple of 4 bytes)
|
||||
pos = 12 + nNewTables * 16;
|
||||
- k = 0;
|
||||
+ int k = 0;
|
||||
for (i = 0; i < nT42Tables; ++i) {
|
||||
- length = -1;
|
||||
- checksum = 0; // make gcc happy
|
||||
+ int length = -1;
|
||||
+ unsigned int checksum = 0; // make gcc happy
|
||||
if (i == t42HeadTable) {
|
||||
length = 54;
|
||||
checksum = computeTableChecksum(headData);
|
||||
@@ -1207,8 +1202,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
} else if (i == t42GlyfTable) {
|
||||
length = 0;
|
||||
checksum = 0;
|
||||
- glyfPos = tables[seekTable("glyf")].offset;
|
||||
- for (j = 0; j < nGlyphs; ++j) {
|
||||
+ const int glyfPos = tables[seekTable("glyf")].offset;
|
||||
+ for (int j = 0; j < nGlyphs; ++j) {
|
||||
length += locaTable[j].len;
|
||||
if (length & 3) {
|
||||
length += 4 - (length & 3);
|
||||
@@ -1218,7 +1213,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
}
|
||||
}
|
||||
} else {
|
||||
- if ((j = seekTable(t42Tables[i].tag)) >= 0) {
|
||||
+ const int j = seekTable(t42Tables[i].tag);
|
||||
+ if (j >= 0) {
|
||||
length = tables[j].len;
|
||||
if (checkRegion(tables[j].offset, length)) {
|
||||
checksum = computeTableChecksum(std::span(file.data() + tables[j].offset, length));
|
||||
@@ -1298,7 +1294,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
}
|
||||
|
||||
// compute the font checksum and store it in the head table
|
||||
- checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
|
||||
+ unsigned int checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
|
||||
for (i = 0; i < nNewTables; ++i) {
|
||||
checksum += newTables[i].checksum;
|
||||
}
|
||||
@@ -1325,11 +1321,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
if (i == t42HeadTable) {
|
||||
dumpString(headData, outputFunc, outputStream);
|
||||
} else if (i == t42LocaTable) {
|
||||
- length = (nGlyphs + 1) * (locaFmt ? 4 : 2);
|
||||
dumpString(locaData, outputFunc, outputStream);
|
||||
} else if (i == t42GlyfTable) {
|
||||
- glyfPos = tables[seekTable("glyf")].offset;
|
||||
- for (j = 0; j < nGlyphs; ++j) {
|
||||
+ const int glyfPos = tables[seekTable("glyf")].offset;
|
||||
+ for (int j = 0; j < nGlyphs; ++j) {
|
||||
if (locaTable[j].len > 0 && checkRegion(glyfPos + locaTable[j].origOffset, locaTable[j].len)) {
|
||||
dumpString(std::span(file.data() + glyfPos + locaTable[j].origOffset, locaTable[j].len), outputFunc, outputStream);
|
||||
}
|
||||
@@ -1338,13 +1333,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
// length == 0 means the table is missing and the error was
|
||||
// already reported during the construction of the table
|
||||
// headers
|
||||
- if ((length = newTables[i].len) > 0) {
|
||||
- if ((j = seekTable(t42Tables[i].tag)) >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
|
||||
+ const int length = newTables[i].len;
|
||||
+ if (length > 0) {
|
||||
+ const int j = seekTable(t42Tables[i].tag);
|
||||
+ if (j >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
|
||||
dumpString(std::span(file.data() + tables[j].offset, tables[j].len), outputFunc, outputStream);
|
||||
} else if (needVerticalMetrics && i == t42VheaTable) {
|
||||
if (unlikely(static_cast<size_t>(length) > sizeof(vheaTab))) {
|
||||
error(errSyntaxWarning, -1, "length bigger than vheaTab size");
|
||||
- length = sizeof(vheaTab);
|
||||
}
|
||||
dumpString(vheaTab, outputFunc, outputStream);
|
||||
} else if (needVerticalMetrics && i == t42VmtxTable) {
|
||||
@@ -0,0 +1,34 @@
|
||||
From ac82c990768a4cb3dd4fd15edb92af97b4ac6589 Mon Sep 17 00:00:00 2001
|
||||
From: Albert Astals Cid <aacid@kde.org>
|
||||
Date: Sat, 8 Aug 2026 15:47:43 +0200
|
||||
Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts
|
||||
|
||||
Issue #1762
|
||||
|
||||
(cherry picked from commit 245d3c6823377755f2c1d5fdddd010279c6ed94d)
|
||||
|
||||
CVE: CVE-2026-102620
|
||||
Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d]
|
||||
|
||||
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
||||
---
|
||||
fofi/FoFiTrueType.cc | 6 +++++-
|
||||
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
|
||||
index e15cfc576..9e280fe89 100644
|
||||
--- a/fofi/FoFiTrueType.cc
|
||||
+++ b/fofi/FoFiTrueType.cc
|
||||
@@ -1204,7 +1204,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
|
||||
checksum = 0;
|
||||
const int glyfPos = tables[seekTable("glyf")].offset;
|
||||
for (int j = 0; j < nGlyphs; ++j) {
|
||||
- length += locaTable[j].len;
|
||||
+ if (unlikely(checkedAdd(length, locaTable[j].len, &length))) {
|
||||
+ error(errSyntaxError, -1, "Integer overflow in glyph table length calculation");
|
||||
+ ok = false;
|
||||
+ break;
|
||||
+ }
|
||||
if (length & 3) {
|
||||
length += 4 - (length & 3);
|
||||
}
|
||||
@@ -9,6 +9,8 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
|
||||
file://0001-cmake-Do-not-use-isystem.patch \
|
||||
file://0001-workaround-build-racing.patch \
|
||||
file://CVE-2026-102621.patch \
|
||||
file://CVE-2026-102620-1.patch \
|
||||
file://CVE-2026-102620-2.patch \
|
||||
"
|
||||
SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"
|
||||
|
||||
|
||||
Reference in new issue
Block a user