- ntg-pdftex - NTG Mailing Lists

[ pdftex-Bugs-733 ] CVE-2007-0104
by noreply＠sarovar.org 16 Feb '07

16 Feb '07

Bugs item #733, was opened at 2007-02-16 15:37 You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=733&group_id=106 Category: xpdf Group: v1.40.0 >Status: Closed >Resolution: Fixed Priority: 3 Submitted By: Martin Schröder (oneiros) Assigned to: Martin Schröder (oneiros) Summary: CVE-2007-0104 Initial Comment: Another bug in xpdf was found: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0104 http://projects.info-pull.com/moab/MOAB-06-01-2007.html As pdftex uses xpdf, this can be used to crash pdftex. A patch for this is attached and will be included in the next release. ---------------------------------------------------------------------- You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=733&group_id=106

1 0

[ pdftex-Bugs-733 ] CVE-2007-0104
by noreply＠sarovar.org 16 Feb '07

16 Feb '07

Bugs item #733, was opened at 2007-02-16 15:37 You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=733&group_id=106 Category: xpdf Group: v1.40.0 Status: Open Resolution: None Priority: 3 Submitted By: Martin Schröder (oneiros) Assigned to: Martin Schröder (oneiros) Summary: CVE-2007-0104 Initial Comment: Another bug in xpdf was found: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0104 http://projects.info-pull.com/moab/MOAB-06-01-2007.html As pdftex uses xpdf, this can be used to crash pdftex. A patch for this is attached and will be included in the next release. ---------------------------------------------------------------------- You can respond by visiting: http://sarovar.org/tracker/?func=detail&atid=493&aid=733&group_id=106

1 0

runptex API
by Thanh Han The 13 Feb '07

13 Feb '07

Hi, I have put the documented API of runptex, a wrapper to run pdftex, to http://runptex.sarovar.org/ Comments welcome very much. Source codes, installation and usage guide will be added soon. Thanh

1 0

Re: [NTG-pdftex] another problem -- of pdftex or gs?
by Thanh Han The 11 Feb '07

11 Feb '07

On Sat, Feb 10, 2007 at 10:52:09PM +0100, Thanh Han The wrote: > yes I also got very varying results from gs, depending on > version, configuration and also the output device. > However, I know of another way to check whether a ps file is > valid. sorry, typo. I *don't* know of another way to check ps files. Thanh

1 0

Re: [NTG-pdftex] another problem -- of pdftex or gs?
by Thanh Han The 10 Feb '07

10 Feb '07

Hi Reinhard, On Sat, Feb 10, 2007 at 09:58:12PM +0100, Reinhard Kotucha wrote: > I'm not sure that there is something wrong with the ps file and I'm > not able to reproduce this with gs-8.01. However, there are problems > with other versions. Some versions hang, so I had to limit CPU time > in order to ba able to check with all versions I have installed. > > [...] > > Curiously you get different results depending on -dNOPAUSE and > -dDEBUG. I tried with gs-7.22. > > [...] > > I suppose that gs is so buggy that it doesn't make sense to use it as > a validator. > > Maybe you get another result too if you add -dDEBUG too. > > In my opinion gs is too unstable to rely on it. yes I also got very varying results from gs, depending on version, configuration and also the output device. However, I know of another way to check whether a ps file is valid. The ps file I uploaded is probably too complex to analyze what is wrong with it. However I think the problem is that the ps doesn't contain all the needed fonts -- type3 fonts from the pdf are missing if they are used in XObject forms only. I recompiled the pdf with all fonts embedded as type1 or truetype, and then the ps is ok. > There are two ways to extract and examine Type1 fonts: > > 1. My Perl script xtractfonts extracts Type1 fonts from pdf files > (using pdftops at the moment but should work with acroread also) > and disassembles them using t1diasm. Adding Eddie's t1lint can be > done easily. > > 2. pdftosrc can be used to extract objects from a pdf file and Hartmut > successfully retrieved some fonts and disassembled them using the > t1utils. > > I suppose that pdftosrc can be used to extract other things too and > external programs can be used for validation. yes probably it's a good idea to extract all fonts from a pdf and check whether they are ok. I suppose this should not be hard to do using xpdf sources. > Thanh, I find http://www.sendspace.com extremely annoying. > > Unless you forgot your passwd you can copy files to > thanh(a)ms25.ath.cx/public_html and ask people to download them from > http://ms25.ath.cx/~thanh . ah, thanks for reminding me that. I will take use of it next time. Regards, Thanh

1 0

another problem -- of pdftex or gs?
by Thanh Han The 10 Feb '07

10 Feb '07

Hi, the following file caused gs to segfault: http://www.sendspace.com/file/ol6tlx The command I used is: ,-------- | gs -dNOPAUSE -sDEVICE=nullpage -sOutputFile=/dev/null -dBATCH survey-vn.ps `-------- and gs -v gave: ,-------- | GPL Ghostscript 8.01 (2004-01-30) | Copyright (C) 2004 artofcode LLC, Benicia, CA. All rights reserved. `-------- The ps file was converted by pdftops from survey-vn.pdf, the vietnamese translation of the free math font survey by Stephen G. Hartke, compiled by pdftex. The pdf itself and the ps converted by acroread didn't cause the problem with the above command. Another thing to notice is that the problem doesn't occur with other devices, for example gv showed the file quite normally, and the device ppm also works fine. Maybe some PS guru here (eg Reinhard) can figure out what is wrong with the ps file? Thanh

3 2

building a set of test files
by Thanh Han The 10 Feb '07

10 Feb '07

Hi, I am setting up a set of test files to check if there is some problem with pdftex. Those test files should be run after each change made to pdftex, hopefully to detect some errors before they slip to end users. Each file from the set is tested as follows: - recompile the test file - check whether the pdf is ok, using as many as possible available tools. At the moment the tools being used are listed in the script checkpdf I posted, plus pdftool from fitz. The output of such a check would look like: ,-------- | Checking microtype.pdf using pdfvalidator... | PDF library evaluation version, created Dec 2006 | Checking microtype.pdf using Multivalent Validate tool... | Checking microtype.pdf using Ghostscript... | Checking microtype.pdf using pdftoppm (xpdf)... | Checking microtype.pdf using pdftool (fitz)... | Printing microtype.pdf to microtype.ps using Acrobat Reader... | Checking microtype.ps using Ghostscript... | Printing microtype.pdf to microtype.ps using pdftops (xpdf)... | Checking microtype.ps using Ghostscript... | done. `-------- [Next version of xpdf will allow checking pdf using xpdf in "batch mode", ie without user interaction. This should catch more errors than pdftoppm] - then the pdf file is compared against another (verified) pdf to see if there are any differences. The comparison is done by: - using pdftoppm to print all pages from both pdf to images and compare the image (using diff) - if the images in the above step differ, use the 'compare' tool from ImageMagick to compare the images. If the difference is "big enough", the pages will be considered as "different". - at the moment the set consists of the following files: ,-------- | encguide - the latex encoding guide | microtype - the microtype manual | MnSymbol - the MnSymbol manual | mscore-sample - sample of mscore (TrueType) fonts | survey - the free math font survey | survey-vn - Vietnamese version of the survey `-------- Your comments are welcome. Thanh PS: while testing those files, I found one issue with pdf inclusion: if the included pdf contains any type3 font, the result will fail to print to PS by acroread (type3 fonts in XOject forms are not exported to PS). Maybe we need to write some warning if a type3 font is found during pdf inclusion.

1 0

Re: [NTG-pdftex] problem of acrobat reader 4.0 or pdftex?
by Thanh Han The 09 Feb '07

09 Feb '07

maybe it's related to this (copied from pdftex sources in older versions): ,-------- | @!pdf_first_space_corr: integer; {amount of first word spacing while drawing a string; | for some reason it is not taken into account of the length of the string, so we | have to save it in order to adjust spacing when string drawing is finished} `-------- I have verified this as follows: uncompressed microtype.pdf, used a text editor to find where the line 3.1 Micro-Typographic Options . . . . . . . . . . . . . . . . . . . . . . 6 is drawn. It looks as follows: ,-------- | /F95 9.9626 Tf 14.944 -13.993 Td [(3.1)-910(Micro-)37(T)93(ypographic)-278(Options)]TJ | 0 g 0 G | [-970(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)- 500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)-500(.)]TJ | 0 g 0 G | [-1740(6)]TJ `-------- According to the above note, the first space is not taken into account of the string length, so I tried to add it (ie -970) to the space after the current TJ operator (ie to -1740 in the following TJ, so now it became -2710). After this the digit 6 ended up aligned as expected (but now it looks bad in xpdf). Thanh On Thu, Feb 08, 2007 at 11:16:02PM +0100, Hartmut Henkel wrote: > On Thu, 8 Feb 2007, w.m.l(a)gmx.net wrote: > > > On 07.02.2007 10:45, Thanh Han The wrote: > > > while viewing the microtype manual (from texlive2007) using > > > acr4.0 on linux, I found some oddities as shown here: > > > > Same under Windows, Acrobat Reader 4.05. Additionally, the page numbers > > on the right-hand side in the TOC are completely mis-aligned. > > > > It appears fine when created with (miktex's) pdftex 1.30. > > this still uses \pdfliteral {} without "direct", so you find (lengthy) > coordinate transforms like this around color change commands in the PDF: > > 1 0 0 1 498.65 487.517 cm > 0 g 0 G > 1 0 0 1 -338.982 -13.027 cm > 0.02 0.04 0.48 rg 0.02 0.04 0.48 RG > 1 0 0 1 -159.668 -474.49 cm > > With pdftex-1.40 now hyperref seems to use the more compact \pdfliteral > direct {} version. > > > With 1.40, it looks OK if I set hyperref's colorlinks option to false > > (ie., have the links surrounded by boxes instead of coloured). > > then the color change commands between the []TJ sections go away. It > appears that acro4.0 doesn't like legal PDF like this: > > 0 g 0 G > /F51 8.9664 Tf 22.908 -11.955 Td [([)]TJ > 0.02 0.04 0.48 rg 0.02 0.04 0.48 RG > [(Protrusion)]TJ > 0 g 0 G > [-343(\025)-342(49])-370([)]TJ > 0.02 0.04 0.48 rg 0.02 0.04 0.48 RG % <--- acro4.0 bug with these lines > [(Expansion)]TJ > 0 g 0 G > [-343(\025)-342(56])-371([)]TJ > 0.02 0.04 0.48 rg 0.02 0.04 0.48 RG > [(In)29(terw)28(ord)-342(Spacing)-343(\050Glue\051)]TJ > > Regards, Hartmut > _______________________________________________ > ntg-pdftex mailing list > ntg-pdftex(a)ntg.nl > http://www.ntg.nl/mailman/listinfo/ntg-pdftex

1 0

problem of acrobat reader 4.0 or pdftex?
by Thanh Han The 08 Feb '07

08 Feb '07

Hi, while viewing the microtype manual (from texlive2007) using acr4.0 on linux, I found some oddities as shown here: http://www.sendspace.com/file/25thl2 But the problem doesn't occur with acr7.0, xpdf or gv. So it's likely a bug of acr4 on linux? Thanh

4 4

Re: [NTG-pdftex] tools to check whether a pdf is invalid
by Thanh Han The 08 Feb '07

08 Feb '07

On Thu, Feb 08, 2007 at 02:41:47PM +0100, Martin Schroeder wrote: > 2007/2/8, Thanh Han The <hanthethanh(a)gmail.com>: > > if someone knows of another tool which can be added, please > > share your experience. Or if someone is interested in the > > script, I will post it here. > > Have a look at Fitz/Apparition at http://ccxvii.net/apparition/ thanks for the tip -- it seems to be somehow related to gs? How to you use this tool to check pdf? I took a quick look and use 'pdftool draw -r 72' as the command for checking. > And poppler also has the xpdf tools, probably with an improved pdf parser. > > And yes, I'm interested in the script. :-) I attached the script as a zip file. If it doesn't get to the ml, I will resend via private mail. Thanh

1 0