From 63c4be08eb289f0d1c901dc8abc22bf417176bdf Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Fri, 11 Jul 2025 06:37:56 +0100 Subject: [PATCH] djvulibre: 3.5.28 -> 3.5.29 Changes: https://sourceforge.net/p/djvu/djvulibre-git/ci/master/tree/NEWS --- ...-32491+CVE-2021-32492+CVE-2021-32493.patch | 105 ------------------ .../dj/djvulibre/c++17-register-class.patch | 21 ---- pkgs/by-name/dj/djvulibre/package.nix | 12 +- 3 files changed, 2 insertions(+), 136 deletions(-) delete mode 100644 pkgs/by-name/dj/djvulibre/CVE-2021-3500+CVE-2021-32490+CVE-2021-32491+CVE-2021-32492+CVE-2021-32493.patch delete mode 100644 pkgs/by-name/dj/djvulibre/c++17-register-class.patch diff --git a/pkgs/by-name/dj/djvulibre/CVE-2021-3500+CVE-2021-32490+CVE-2021-32491+CVE-2021-32492+CVE-2021-32493.patch b/pkgs/by-name/dj/djvulibre/CVE-2021-3500+CVE-2021-32490+CVE-2021-32491+CVE-2021-32492+CVE-2021-32493.patch deleted file mode 100644 index e305c5618d19..000000000000 --- a/pkgs/by-name/dj/djvulibre/CVE-2021-3500+CVE-2021-32490+CVE-2021-32491+CVE-2021-32492+CVE-2021-32493.patch +++ /dev/null @@ -1,105 +0,0 @@ -From cd8b5c97b27a5c1dc83046498b6ca49ad20aa9b6 Mon Sep 17 00:00:00 2001 -From: Leon Bottou -Date: Tue, 11 May 2021 14:44:09 -0400 -Subject: [PATCH] Reviewed Fedora patches and adopted some of them (or variants - thereof) - - - Patch0: djvulibre-3.5.22-cdefs.patch (forward ported) -Does not make imuch sense. GSmartPointer.h already includes "stddef.h" - - Patch6: djvulibre-3.5.27-export-file.patch (forward ported) -Incorrect: inkscape command is --export-png, not --export-filename. - - Patch8: djvulibre-3.5.27-check-image-size.patch (forward ported) -Correct: adopted a variant of this - - Patch9: djvulibre-3.5.27-integer-overflow.patch (forward ported) -Correct: adopted a variant of this - - Patch10: djvulibre-3.5.27-check-input-pool.patch (forward ported) -Adopted: input validation never hurts - - Patch11: djvulibre-3.5.27-djvuport-stack-overflow.patch (forward ported) -Dubious: Instead I changed djvufile to prevent a file from including itself -which is the only way I can imagine to create an file creation loop. - - Patch12: djvulibre-3.5.27-unsigned-short-overflow.patch (forward ported) -Adopted: but without including limits.h ---- - libdjvu/DataPool.cpp | 3 ++- - libdjvu/DjVuFile.cpp | 2 ++ - libdjvu/GBitmap.cpp | 2 ++ - libdjvu/IW44Image.cpp | 4 ++++ - tools/ddjvu.cpp | 7 +++++-- - 5 files changed, 15 insertions(+), 3 deletions(-) - -diff --git a/libdjvu/DataPool.cpp b/libdjvu/DataPool.cpp -index 5fcbedf..b58fc45 100644 ---- a/libdjvu/DataPool.cpp -+++ b/libdjvu/DataPool.cpp -@@ -790,7 +790,8 @@ DataPool::create(const GP & pool, int start, int length) - { - DEBUG_MSG("DataPool::DataPool: pool=" << (void *)((DataPool *)pool) << " start=" << start << " length= " << length << "\n"); - DEBUG_MAKE_INDENT(3); -- -+ if (!pool) -+ G_THROW( ERR_MSG("DataPool.zero_DataPool") ); - DataPool *xpool=new DataPool(); - GP retval=xpool; - xpool->init(); -diff --git a/libdjvu/DjVuFile.cpp b/libdjvu/DjVuFile.cpp -index 143346b..2587491 100644 ---- a/libdjvu/DjVuFile.cpp -+++ b/libdjvu/DjVuFile.cpp -@@ -576,6 +576,8 @@ DjVuFile::process_incl_chunk(ByteStream & str, int file_num) - GURL incl_url=pcaster->id_to_url(this, incl_str); - if (incl_url.is_empty()) // Fallback. Should never be used. - incl_url=GURL::UTF8(incl_str,url.base()); -+ if (incl_url == url) // Infinite loop avoidance -+ G_THROW( ERR_MSG("DjVuFile.malformed") ); - - // Now see if there is already a file with this *name* created - { -diff --git a/libdjvu/GBitmap.cpp b/libdjvu/GBitmap.cpp -index c2fdbe4..8ad64b2 100644 ---- a/libdjvu/GBitmap.cpp -+++ b/libdjvu/GBitmap.cpp -@@ -1284,6 +1284,8 @@ GBitmap::decode(unsigned char *runs) - // initialize pixel array - if (nrows==0 || ncolumns==0) - G_THROW( ERR_MSG("GBitmap.not_init") ); -+ if (ncolumns + border != (unsigned short)(ncolumns+border)) -+ G_THROW("GBitmap: image size exceeds maximum (corrupted file?)"); - bytes_per_row = ncolumns + border; - if (runs==0) - G_THROW( ERR_MSG("GBitmap.null_arg") ); -diff --git a/libdjvu/IW44Image.cpp b/libdjvu/IW44Image.cpp -index e8d4b44..4a1797e 100644 ---- a/libdjvu/IW44Image.cpp -+++ b/libdjvu/IW44Image.cpp -@@ -676,9 +676,13 @@ IW44Image::Map::image(signed char *img8, int rowsize, int pixsep, int fast) - // Allocate reconstruction buffer - short *data16; - size_t sz = bw * bh; -+ if (sz == 0) -+ G_THROW("IW44Image: image size is zero (corrupted file?)"); - if (sz / (size_t)bw != (size_t)bh) // multiplication overflow - G_THROW("IW44Image: image size exceeds maximum (corrupted file?)"); - GPBuffer gdata16(data16,sz); -+ if (data16 == 0) -+ G_THROW("IW44Image: unable to allocate image buffer"); - // Copy coefficients - int i; - short *p = data16; -diff --git a/tools/ddjvu.cpp b/tools/ddjvu.cpp -index 7109952..e7b489b 100644 ---- a/tools/ddjvu.cpp -+++ b/tools/ddjvu.cpp -@@ -393,8 +393,11 @@ render(ddjvu_page_t *page, int pageno) - } else if (style == DDJVU_FORMAT_GREY8) - rowsize = rrect.w; - else -- rowsize = rrect.w * 3; -- if (! (image = (char*)malloc(rowsize * rrect.h))) -+ rowsize = rrect.w * 3; -+ size_t bufsize = (size_t)rowsize * rrect.h; -+ if (bufsize / rowsize != rrect.h) -+ die(i18n("Integer overflow when allocating image buffer for page %d"), pageno); -+ if (! (image = (char*)malloc(bufsize))) - die(i18n("Cannot allocate image buffer for page %d"), pageno); - - /* Render */ \ No newline at end of file diff --git a/pkgs/by-name/dj/djvulibre/c++17-register-class.patch b/pkgs/by-name/dj/djvulibre/c++17-register-class.patch deleted file mode 100644 index 88251b34f773..000000000000 --- a/pkgs/by-name/dj/djvulibre/c++17-register-class.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -ur a/libdjvu/GBitmap.h b/libdjvu/GBitmap.h ---- a/libdjvu/GBitmap.h 2020-11-20 09:57:32.000000000 -0700 -+++ b/libdjvu/GBitmap.h 2023-07-07 07:07:45.519912414 -0600 -@@ -620,7 +620,7 @@ - inline int - GBitmap::read_run(unsigned char *&data) - { -- register int z=*data++; -+ int z=*data++; - return (z>=RUNOVERFLOWVALUE)? - ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z; - } -@@ -628,7 +628,7 @@ - inline int - GBitmap::read_run(const unsigned char *&data) - { -- register int z=*data++; -+ int z=*data++; - return (z>=RUNOVERFLOWVALUE)? - ((z&~RUNOVERFLOWVALUE)<<8)|(*data++):z; - } diff --git a/pkgs/by-name/dj/djvulibre/package.nix b/pkgs/by-name/dj/djvulibre/package.nix index ba1b0361f53f..ecf5185939dc 100644 --- a/pkgs/by-name/dj/djvulibre/package.nix +++ b/pkgs/by-name/dj/djvulibre/package.nix @@ -11,11 +11,11 @@ stdenv.mkDerivation rec { pname = "djvulibre"; - version = "3.5.28"; + version = "3.5.29"; src = fetchurl { url = "mirror://sourceforge/djvu/${pname}-${version}.tar.gz"; - sha256 = "1p1fiygq9ny8aimwc4vxwjc6k9ykgdsq1sq06slfbzalfvm0kl7w"; + hash = "sha256-07SwOuK9yoUWo2726ye3d/BSjJ7aJnRdmWKCSj/f7M8="; }; outputs = [ @@ -40,14 +40,6 @@ stdenv.mkDerivation rec { enableParallelBuilding = true; - patches = [ - # Remove uses of the `register` storage class specifier, which was removed in C++17. - # Fixes compilation with clang 16, which defaults to C++17. - ./c++17-register-class.patch - - ./CVE-2021-3500+CVE-2021-32490+CVE-2021-32491+CVE-2021-32492+CVE-2021-32493.patch - ]; - meta = with lib; { description = "Big set of CLI tools to make/modify/optimize/show/export DJVU files"; homepage = "https://djvu.sourceforge.net";