head 1.2; access; symbols pkgsrc-2015Q1:1.1.0.80 pkgsrc-2015Q1-base:1.1 pkgsrc-2014Q4:1.1.0.78 pkgsrc-2014Q4-base:1.1 pkgsrc-2014Q3:1.1.0.76 pkgsrc-2014Q3-base:1.1 pkgsrc-2014Q2:1.1.0.74 pkgsrc-2014Q2-base:1.1 pkgsrc-2014Q1:1.1.0.72 pkgsrc-2014Q1-base:1.1 pkgsrc-2013Q4:1.1.0.70 pkgsrc-2013Q4-base:1.1 pkgsrc-2013Q3:1.1.0.68 pkgsrc-2013Q3-base:1.1 pkgsrc-2013Q2:1.1.0.66 pkgsrc-2013Q2-base:1.1 pkgsrc-2013Q1:1.1.0.64 pkgsrc-2013Q1-base:1.1 pkgsrc-2012Q4:1.1.0.62 pkgsrc-2012Q4-base:1.1 pkgsrc-2012Q3:1.1.0.60 pkgsrc-2012Q3-base:1.1 pkgsrc-2012Q2:1.1.0.58 pkgsrc-2012Q2-base:1.1 pkgsrc-2012Q1:1.1.0.56 pkgsrc-2012Q1-base:1.1 pkgsrc-2011Q4:1.1.0.54 pkgsrc-2011Q4-base:1.1 pkgsrc-2011Q3:1.1.0.52 pkgsrc-2011Q3-base:1.1 pkgsrc-2011Q2:1.1.0.50 pkgsrc-2011Q2-base:1.1 pkgsrc-2011Q1:1.1.0.48 pkgsrc-2011Q1-base:1.1 pkgsrc-2010Q4:1.1.0.46 pkgsrc-2010Q4-base:1.1 pkgsrc-2010Q3:1.1.0.44 pkgsrc-2010Q3-base:1.1 pkgsrc-2010Q2:1.1.0.42 pkgsrc-2010Q2-base:1.1 pkgsrc-2010Q1:1.1.0.40 pkgsrc-2010Q1-base:1.1 pkgsrc-2009Q4:1.1.0.38 pkgsrc-2009Q4-base:1.1 pkgsrc-2009Q3:1.1.0.36 pkgsrc-2009Q3-base:1.1 pkgsrc-2009Q2:1.1.0.34 pkgsrc-2009Q2-base:1.1 pkgsrc-2009Q1:1.1.0.32 pkgsrc-2009Q1-base:1.1 pkgsrc-2008Q4:1.1.0.30 pkgsrc-2008Q4-base:1.1 pkgsrc-2008Q3:1.1.0.28 pkgsrc-2008Q3-base:1.1 cube-native-xorg:1.1.0.26 cube-native-xorg-base:1.1 pkgsrc-2008Q2:1.1.0.24 pkgsrc-2008Q2-base:1.1 cwrapper:1.1.0.22 pkgsrc-2008Q1:1.1.0.20 pkgsrc-2008Q1-base:1.1 pkgsrc-2007Q4:1.1.0.18 pkgsrc-2007Q4-base:1.1 pkgsrc-2007Q3:1.1.0.16 pkgsrc-2007Q3-base:1.1 pkgsrc-2007Q2:1.1.0.14 pkgsrc-2007Q2-base:1.1 pkgsrc-2007Q1:1.1.0.12 pkgsrc-2007Q1-base:1.1 pkgsrc-2006Q4:1.1.0.10 pkgsrc-2006Q4-base:1.1 pkgsrc-2006Q3:1.1.0.8 pkgsrc-2006Q3-base:1.1 pkgsrc-2006Q2:1.1.0.6 pkgsrc-2006Q2-base:1.1 pkgsrc-2006Q1:1.1.0.4 pkgsrc-2006Q1-base:1.1 pkgsrc-2005Q4:1.1.0.2; locks; strict; comment @# @; 1.2 date 2015.04.30.10.43.54; author markd; state dead; branches; next 1.1; commitid Qi19hTbn97F9pBjy; 1.1 date 2006.01.24.21.51.36; author tron; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2006.01.24.21.51.36; author salo; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2006.01.25.12.45.20; author salo; state Exp; branches; next ; desc @@ 1.2 log @Convert to meta package. The only remaining files in the PLIST were symlinks in bin for commands that didn't actually work. Plus some related documentation. @ text @$NetBSD: patch-ag,v 1.1 2006/01/24 21:51:36 tron Exp $ --- libs/xpdf/xpdf/JPXStream.cc.orig 2004-01-22 01:26:45.000000000 +0000 +++ libs/xpdf/xpdf/JPXStream.cc 2006-01-24 18:32:17.000000000 +0000 @@@@ -7,6 +7,7 @@@@ //======================================================================== #include +#include #ifdef USE_GCC_PRAGMAS #pragma implementation @@@@ -666,7 +667,7 @@@@ int segType; GBool haveSIZ, haveCOD, haveQCD, haveSOT; Guint precinctSize, style; - Guint segLen, capabilities, comp, i, j, r; + Guint segLen, capabilities, nTiles, comp, i, j, r; //----- main header haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; @@@@ -701,8 +702,14 @@@@ / img.xTileSize; img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) / img.yTileSize; - img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles * - sizeof(JPXTile)); + // check for overflow before allocating memory + if (img.nXTiles <= 0 || img.nYTiles <= 0 || + img.nXTiles >= INT_MAX/img.nYTiles) { + error(getPos(), "Bad tile count in JPX SIZ marker segment"); + return gFalse; + } + nTiles = img.nXTiles * img.nYTiles; + img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile)); for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps * sizeof(JPXTileComp)); @ 1.1 log @Incorporate fixes for vulnerabilities reported in SA17916 and SA18329, bump package revision. @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @file patch-ag was added on branch pkgsrc-2005Q4 on 2006-01-24 21:51:36 +0000 @ text @d1 38 @ 1.1.2.2 log @Pullup ticket 1059 - requested by Matthias Scheler security fixes for teTeX3-bin Updated via patch provided by the submitter. Module Name: pkgsrc Committed By: tron Date: Tue Jan 24 21:51:36 UTC 2006 Modified Files: pkgsrc/print/teTeX3-bin: Makefile distinfo Added Files: pkgsrc/print/teTeX3-bin/patches: patch-ag patch-ah patch-ai patch-al Log Message: Incorporate fixes for vulnerabilities reported in SA17916 and SA18329, bump package revision. @ text @a0 38 $NetBSD: patch-ag,v 1.1.2.1 2006/01/25 12:45:20 salo Exp $ --- libs/xpdf/xpdf/JPXStream.cc.orig 2004-01-22 01:26:45.000000000 +0000 +++ libs/xpdf/xpdf/JPXStream.cc 2006-01-24 18:32:17.000000000 +0000 @@@@ -7,6 +7,7 @@@@ //======================================================================== #include +#include #ifdef USE_GCC_PRAGMAS #pragma implementation @@@@ -666,7 +667,7 @@@@ int segType; GBool haveSIZ, haveCOD, haveQCD, haveSOT; Guint precinctSize, style; - Guint segLen, capabilities, comp, i, j, r; + Guint segLen, capabilities, nTiles, comp, i, j, r; //----- main header haveSIZ = haveCOD = haveQCD = haveSOT = gFalse; @@@@ -701,8 +702,14 @@@@ / img.xTileSize; img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1) / img.yTileSize; - img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles * - sizeof(JPXTile)); + // check for overflow before allocating memory + if (img.nXTiles <= 0 || img.nYTiles <= 0 || + img.nXTiles >= INT_MAX/img.nYTiles) { + error(getPos(), "Bad tile count in JPX SIZ marker segment"); + return gFalse; + } + nTiles = img.nXTiles * img.nYTiles; + img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile)); for (i = 0; i < img.nXTiles * img.nYTiles; ++i) { img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps * sizeof(JPXTileComp)); @