- ntg-pdftex - NTG Mailing Lists

Re: [NTG-pdftex] Xpdf 3.02 security hole (fwd)
by Thanh Han The 13 Jul '07

13 Jul '07

----- Forwarded message from Ludwig Nussel <ludwig.nussel(a)suse.de> ----- > From: Ludwig Nussel <ludwig.nussel(a)suse.de> > Date: Fri, 13 Jul 2007 14:24:06 +0200 > To: "Derek B. Noonburg" <derekn(a)foolabs.com> > Cc: than(a)redhat.com, var(a)sgi.com, mike(a)easysw.com, secalert(a)redhat.com, > security(a)gentoo.org, security(a)kde.org, hanthethanh(a)gmail.com, > Fabrice.Popineau(a)supelec.fr, security(a)suse.de > Subject: Re: Xpdf 3.02 security hole > > Josh Bressers wrote: > > > A security hole in Xpdf 3.02 has been reported. I'm attaching the patch > > > file. I'm currently expecting this to be disclosed early next week. > > > > > > > Hi Derek, > > > > Please use CVE-2007-3387 for this flaw. Am I right in assuming that the > > flaw here is an integer overflow? > > IMO the crucial part is the changed check for nComps > gfxColorMaxComps as > nComps is used later as upper bound for an offset into > Guchar upLeftBuf[gfxColorMaxComps * 2 + 1]; > The patch removes the check width >= INT_MAX / nComps / nBits though which > should be kept nevertheless IMO: > > --- xpdf-3.02.orig/xpdf/Stream.cc > +++ xpdf-3.02/xpdf/Stream.cc > @@ -410,15 +410,15 @@ StreamPredictor::StreamPredictor(Stream > ok = gFalse; > > nVals = width * nComps; > - if (width <= 0 || nComps <= 0 || nBits <= 0 || > - nComps >= INT_MAX / nBits || > - width >= INT_MAX / nComps / nBits || > - nVals * nBits + 7 < 0) { > - return; > - } > pixBytes = (nComps * nBits + 7) >> 3; > rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; > - if (rowBytes <= 0) { > + if (width <= 0 || nComps <= 0 || nBits <= 0 || > + nComps > gfxColorMaxComps || > + width >= INT_MAX / nComps / nBits || > + nBits > 16 || > + nVals <= 0 || > + nVals * nBits + 7 <= 0 || > + rowBytes <= 0) { > return; > } > predLine = (Guchar *)gmalloc(rowBytes); > > cu > Ludwig > > -- > (o_ Ludwig Nussel > //\ > V_/_ http://www.suse.de/ > SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) > ----- End forwarded message -----

1 0

Xpdf 3.02 security hole (fwd)
by Thanh Han The 13 Jul '07

13 Jul '07

----- Forwarded message from "Derek B. Noonburg" <derekn(a)foolabs.com> ----- > From: "Derek B. Noonburg" <derekn(a)foolabs.com> > Date: Thu, 12 Jul 2007 16:19:10 -0700 (PDT) > To: than(a)redhat.com, var(a)sgi.com, mike(a)easysw.com, secalert(a)redhat.com, > security(a)gentoo.org, security(a)kde.org, ludwig.nussel(a)suse.de, > hanthethanh(a)gmail.com, Fabrice.Popineau(a)supelec.fr > cc: derekn(a)foolabs.com > Subject: Xpdf 3.02 security hole > > A security hole in Xpdf 3.02 has been reported. I'm attaching the patch > file. I'm currently expecting this to be disclosed early next week. > > - Derek > *** xpdf-3.02-orig/xpdf/Stream.cc Tue Feb 27 14:05:52 2007 > --- xpdf-3.02/xpdf/Stream.cc Thu Jul 12 15:55:49 2007 > *************** > *** 410,424 **** > ok = gFalse; > > nVals = width * nComps; > - if (width <= 0 || nComps <= 0 || nBits <= 0 || > - nComps >= INT_MAX / nBits || > - width >= INT_MAX / nComps / nBits || > - nVals * nBits + 7 < 0) { > - return; > - } > pixBytes = (nComps * nBits + 7) >> 3; > rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; > ! if (rowBytes <= 0) { > return; > } > predLine = (Guchar *)gmalloc(rowBytes); > --- 410,423 ---- > ok = gFalse; > > nVals = width * nComps; > pixBytes = (nComps * nBits + 7) >> 3; > rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; > ! if (width <= 0 || nComps <= 0 || nBits <= 0 || > ! nComps > gfxColorMaxComps || > ! nBits > 16 || > ! nVals <= 0 || > ! nVals * nBits + 7 <= 0 || > ! rowBytes <= 0) { > return; > } > predLine = (Guchar *)gmalloc(rowBytes); ----- End forwarded message -----

1 0

1.40.4 incoming
by Martin Schröder 10 Jul '07

10 Jul '07

Hi, I want to leave for TUG2007 with a released 1.40.4. The svn has in branches/stable the current version of 1.40.4. Please test and tell me what I've forgotten. :-) Best Martin

3 5

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 10 Jul '07

10 Jul '07

> 2007/7/10, Taco Hoekwater <taco(a)elvenkind.com>: > > I vote for Phil's approach. I suspect most of the people that do > > not know how to generate an EOF in the console will not understand > > the key press reference either. > > > > Besides, tricks like dummy strings tend to lead to bugs in the years > > to come. (said as the person who just spend a whole day figuring out > > that the weird "file_name_size=maxint" statement in tex.ch is part > > of a trick to simplify openclose.c as it forces the "namelength" var > > to be of the correct allocation size). > > Agreed. KISS :-) luaTeX does not use tex.ch. For Taco's convenience, I've tried to make a patch: Best regards, Akira --- luatex.ch.orig Mon Jul 09 20:34:16 2007 +++ luatex.ch Tue Jul 10 23:13:12 2007 @@ -1404,12 +1404,20 @@ @y var k:0..buf_size; {index into |buffer|} @!saved_cur_name:str_number; {to catch empty terminal input} +@!saved_cur_ext:str_number; {to catch empty terminal input} +@!saved_cur_area:str_number; {to catch empty terminal input} @z @x if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; +print_ln; print("(Enter the null string to re-try, or <eof> to exit"); +if (e<>"") then + begin + print(" Default file extension is `"); print(e); print("'"); + end; +print(")"); print_ln; @z @x @@ -1417,9 +1425,17 @@ if cur_ext="" then cur_ext:=e; @y saved_cur_name:=cur_name; +saved_cur_ext:=cur_ext; +saved_cur_area:=cur_area; clear_terminal; prompt_input(": "); @<Scan file name in the buffer@>; -if cur_ext="" then cur_ext:=e; -if length(cur_name)=0 then cur_name:=saved_cur_name; +if (length(cur_name)=0) and (cur_ext="") and (cur_area="") then + begin + cur_name:=saved_cur_name; + cur_ext:=saved_cur_ext; + cur_area:=saved_cur_area; + end +else + if cur_ext="" then cur_ext:=e; @z @x

1 0

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 10 Jul '07

10 Jul '07

> > Uh, isn't EOF operating-system dependent? Like C-z on Microsoft > > Systems? > > I'll apply the following ctrld-ctrlz.ch for Windows: > > @x > print_ln; print("(Retry if file name is empty or CTRL-D to exit."); > @y > print_ln; print("(Retry if file name is empty or CTRL-Z + Enter to exit."); > @z In this case, we may not be able to use the common pool files. Is EOF by Philip Taylor better? Best regards, Akira

6 7

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 09 Jul '07

09 Jul '07

Hi David, > > --- tex.ch.orig Mon Jul 09 19:43:46 2007 > > +++ tex.ch Mon Jul 09 22:56:15 2007 > > @@ -2218,7 +2218,7 @@ > > if e=".tex" then show_context; > > @y > > if (e=".tex") or (e="") then show_context; > > -print_ln; print("(Retry if file name is empty."); > > +print_ln; print("(Retry if file name is empty or CTRL-D to exit."); > > if (e<>"") then > > begin > > print(" Default file extension is `"); print(e); print("'"); > > Uh, isn't EOF operating-system dependent? Like C-z on Microsoft > Systems? I'll apply the following ctrld-ctrlz.ch for Windows: @x print_ln; print("(Retry if file name is empty or CTRL-D to exit."); @y print_ln; print("(Retry if file name is empty or CTRL-Z + Enter to exit."); @z Thanks, Akira

1 0

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 09 Jul '07

09 Jul '07

Hi Martin, > > The latest version of 746 (retry), changed by Heiko himself, is the > > following. > > I've applied it. Thanks very much. However you have applied the original one. Heiko had updated, according to the opinion by Karl, as follows (patch to the one in the pdftex svn): Best regards, Akira --- tex.ch.orig Mon Jul 09 19:43:46 2007 +++ tex.ch Mon Jul 09 22:56:15 2007 @@ -2218,7 +2218,7 @@ if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; -print_ln; print("(Retry if file name is empty."); +print_ln; print("(Retry if file name is empty or CTRL-D to exit."); if (e<>"") then begin print(" Default file extension is `"); print(e); print("'");

4 3

Re: [NTG-pdftex] 1.40.4 incoming
by Akira Kakuto 09 Jul '07

09 Jul '07

Hi Martin, > - 746 PromptFileName The latest version of 746 (retry), changed by Heiko himself, is the following. This problem is related to all Web2C, so I've attached the corresponding changes for Aleph and Omega. Please check in these changes also to the head of TeXLive repository if these are ok. Best regards, Akira *** tex.ch.org 2006-12-19 02:35:49.000000000 +0100 --- tex.ch 2007-03-07 17:08:49.000000000 +0100 *************** *** 2210,2221 **** --- 2210,2229 ---- @y var k:0..buf_size; {index into |buffer|} @!saved_cur_name:str_number; {to catch empty terminal input} + @!saved_cur_ext:str_number; {to catch empty terminal input} + @!saved_cur_area:str_number; {to catch empty terminal input} @z @x [29.530] l.10252 - prompt_file_name: No default extension is TeX input file. if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; + print_ln; print("(Retry if file name is empty or CTRL-D to exit."); + if (e<>"") then + begin + print(" Default file extension is `"); print(e); print("'"); + end; + print(")"); print_ln; @z @x [29.530] l.10258 - prompt_file_name: prevent empty filenames. *************** *** 2223,2231 **** if cur_ext="" then cur_ext:=e; @y saved_cur_name:=cur_name; clear_terminal; prompt_input(": "); @<Scan file name in the buffer@>; ! if cur_ext="" then cur_ext:=e; ! if length(cur_name)=0 then cur_name:=saved_cur_name; @z @x [29.532] l.10263 - avoid conflict, `logname' in <unistd.h> on some systems. --- 2231,2247 ---- if cur_ext="" then cur_ext:=e; @y saved_cur_name:=cur_name; + saved_cur_ext:=cur_ext; + saved_cur_area:=cur_area; clear_terminal; prompt_input(": "); @<Scan file name in the buffer@>; ! if (length(cur_name)=0) and (cur_ext="") and (cur_area="") then ! begin ! cur_name:=saved_cur_name; ! cur_ext:=saved_cur_ext; ! cur_area:=saved_cur_area; ! end ! else ! if cur_ext="" then cur_ext:=e; @z @x [29.532] l.10263 - avoid conflict, `logname' in <unistd.h> on some systems. diff -u alephdir-orig/com16bit-rc2.ch alephdir/com16bit-rc2.ch --- alephdir-orig/com16bit-rc2.ch Tue Dec 19 10:35:50 2006 +++ alephdir/com16bit-rc2.ch Sat Mar 17 20:41:09 2007 @@ -1349,12 +1349,20 @@ @y var k:0..buf_size; {index into |buffer|} @!saved_cur_name:str_number; {to catch empty terminal input} +@!saved_cur_ext:str_number; {to catch empty terminal input} +@!saved_cur_area:str_number; {to catch empty terminal input} @z @x [29.530] l.10252 - prompt_file_name: No default extension is TeX input file. if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; +print_ln; print("(Retry if file name is empty or CTRL-D to exit."); +if (e<>"") then + begin + print(" Default file extension is `"); print(e); print("'"); + end; +print(")"); print_ln; @z @x [29.530] l.10258 - prompt_file_name: prevent empty filenames. @@ -1362,9 +1370,17 @@ if cur_ext="" then cur_ext:=e; @y saved_cur_name:=cur_name; +saved_cur_ext:=cur_ext; +saved_cur_area:=cur_area; clear_terminal; prompt_input(": "); @<Scan file name in the buffer@>; -if cur_ext="" then cur_ext:=e; -if length(cur_name)=0 then cur_name:=saved_cur_name; +if (length(cur_name)=0) and (cur_ext="") and (cur_area="") then + begin + cur_name:=saved_cur_name; + cur_ext:=saved_cur_ext; + cur_area:=saved_cur_area; + end +else + if cur_ext="" then cur_ext:=e; @z @x [29.532] l.10263 - avoid conflict, `logname' in <unistd.h> on some systems. diff -u omegadir-orig/com16bit.ch omegadir/com16bit.ch --- omegadir-orig/com16bit.ch Tue Dec 19 10:35:50 2006 +++ omegadir/com16bit.ch Sat Mar 17 20:44:41 2007 @@ -1348,12 +1348,20 @@ @y var k:0..buf_size; {index into |buffer|} @!saved_cur_name:str_number; {to catch empty terminal input} +@!saved_cur_ext:str_number; {to catch empty terminal input} +@!saved_cur_area:str_number; {to catch empty terminal input} @z @x [29.530] l.10252 - prompt_file_name: No default extension is TeX input file. if e=".tex" then show_context; @y if (e=".tex") or (e="") then show_context; +print_ln; print("(Retry if file name is empty or CTRL-D to exit."); +if (e<>"") then + begin + print(" Default file extension is `"); print(e); print("'"); + end; +print(")"); print_ln; @z @x [29.530] l.10258 - prompt_file_name: prevent empty filenames. @@ -1361,9 +1369,17 @@ if cur_ext="" then cur_ext:=e; @y saved_cur_name:=cur_name; +saved_cur_ext:=cur_ext; +saved_cur_area:=cur_area; clear_terminal; prompt_input(": "); @<Scan file name in the buffer@>; -if cur_ext="" then cur_ext:=e; -if length(cur_name)=0 then cur_name:=saved_cur_name; +if (length(cur_name)=0) and (cur_ext="") and (cur_area="") then + begin + cur_name:=saved_cur_name; + cur_ext:=saved_cur_ext; + cur_area:=saved_cur_area; + end +else + if cur_ext="" then cur_ext:=e; @z @x [29.532] l.10263 - avoid conflict, `logname' in <unistd.h> on some systems.

4 6

[ pdftex-Patches-746 ] Patch PromptFileName
by noreply＠sarovar.org 09 Jul '07

09 Jul '07

Patches item #746, was opened at 2007-03-07 17:41 You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=495&aid=746&group_id=106 Category: User interaction Group: v1.40.0 >Status: Closed >Resolution: Accepted Priority: 5 Submitted By: Heiko Oberdiek (oberdiek) Assigned to: Martin Schröder (oneiros) Summary: Patch PromptFileName Initial Comment: Subject: Patch PromptFileName Date: 2007/03/07 Author: Heiko Oberdiek The patches are based on pdfTeX 1.40.3 There is some discussion in the tex-live list: List: tex-live(a)tug.org Date: March 2007 Subject: Bug in TexLive 2005 and 2007? Non-writable aux-file If TeX asks for a file name, what action should be taken, if the user doesn't provide a file name? The current behaviour has changed from Web2C 7.5.2 to 7.5.6 and is quite impredictible: * Append some default extension if file extension is not given. * Use previous file name part, if this part is empty. Sometimes this behaves as "retry action" by chance, sometimes a source file gets overwritten. Two patches are provided that implement alternative actions: * Retry.diff If the user doesn't specify a file name, then the whole previous file name is used including the area and extension parts. * Abort.diff If the user doesn't specify a file name, then the job is aborted. Unhappily Ctrl-C (or Ctrl-D) have only a retarded effect after the file name is used again (and eventually causing harm). This is a clean way to end the job even if there isn't a valid file name to provide. Both files patches web2c/texk/tex.ch. Of course they cannot be used at the same time. And both patches also show the default name extension, when the user is prompted for a file name. Have fun, Heiko <oberdiek(a)uni-freiburg.de> ---------------------------------------------------------------------- >Comment By: Martin Schröder (oneiros) Date: 2007-07-09 12:23 Message: Logged In: YES user_id=421 Retry.diff will be included in the next version (1.40.4/1.50.0). ---------------------------------------------------------------------- Comment By: Martin Schröder (oneiros) Date: 2007-03-10 23:57 Message: Logged In: YES user_id=421 Both patches are interesting, but we should wait for further discussion on tex-implementors etc. ---------------------------------------------------------------------- You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=495&aid=746&group_id=106

1 0

Re: [NTG-pdftex] 1.40.4 incoming
by Thanh Han The 09 Jul '07

09 Jul '07

On Sun, Jul 08, 2007 at 10:52:24PM +0200, Thanh Han The wrote: > On 07.07.2007 15:14, Martin Schr�der wrote: > >Please test and tell me what I've forgotten. :-) > > what about patch #813? It's rather straightforward and > handy. and also #812, if there is no further objection. Thanh

3 5