Blame SOURCES/poppler-0.22.5-CVE-2013-4474.patch

7677ed
From 61f79b8447c3ac8ab5a26e79e0c28053ffdccf75 Mon Sep 17 00:00:00 2001
7677ed
From: Albert Astals Cid <aacid@kde.org>
7677ed
Date: Wed, 23 Oct 2013 22:54:56 +0000
7677ed
Subject: Allow only one %d in the filename
7677ed
7677ed
Fixes crashes if you had %s and similar in the filename
7677ed
7677ed
Inspired from patch by Pedro Ribeiro <pedrib@gmail.com>
7677ed
7677ed
Bug #69434
7677ed
---
7677ed
diff --git a/utils/pdfseparate.cc b/utils/pdfseparate.cc
7677ed
index 1d4901b..6424d20 100644
7677ed
--- a/utils/pdfseparate.cc
7677ed
+++ b/utils/pdfseparate.cc
7677ed
@@ -20,6 +20,7 @@
7677ed
 #include "PDFDoc.h"
7677ed
 #include "ErrorCodes.h"
7677ed
 #include "GlobalParams.h"
7677ed
+#include <ctype.h>
7677ed
 
7677ed
 static int firstPage = 0;
7677ed
 static int lastPage = 0;
7677ed
@@ -63,9 +64,37 @@ bool extractPages (const char *srcFileName, const char *destFileName) {
7677ed
   if (firstPage == 0)
7677ed
     firstPage = 1;
7677ed
   if (firstPage != lastPage && strstr(destFileName, "%d") == NULL) {
7677ed
-    error(errSyntaxError, -1, "'{0:s}' must contain '%%d' if more than one page should be extracted", destFileName);
7677ed
+    error(errSyntaxError, -1, "'{0:s}' must contain '%d' if more than one page should be extracted", destFileName);
7677ed
     return false;
7677ed
   }
7677ed
+  
7677ed
+  // destFileName can have multiple %% and one %d
7677ed
+  // We use auxDestFileName to replace all the valid % appearances
7677ed
+  // by 'A' (random char that is not %), if at the end of replacing
7677ed
+  // any of the valid appearances there is still any % around, the
7677ed
+  // pattern is wrong
7677ed
+  char *auxDestFileName = strdup(destFileName);
7677ed
+  // %% can appear as many times as you want
7677ed
+  char *p = strstr(auxDestFileName, "%%");
7677ed
+  while (p != NULL) {
7677ed
+    *p = 'A';
7677ed
+    *(p + 1) = 'A';
7677ed
+    p = strstr(p, "%%"); 
7677ed
+  }
7677ed
+  // %d can appear only one time
7677ed
+  p = strstr(auxDestFileName, "%d");
7677ed
+  if (p != NULL) {
7677ed
+    *p = 'A';
7677ed
+  }
7677ed
+  // at this point any other % is wrong
7677ed
+  p = strstr(auxDestFileName, "%");
7677ed
+  if (p != NULL) {
7677ed
+    error(errSyntaxError, -1, "'{0:s}' can only contain one '%d' pattern", destFileName);
7677ed
+    free(auxDestFileName);
7677ed
+    return false;
7677ed
+  }
7677ed
+  free(auxDestFileName);
7677ed
+  
7677ed
   for (int pageNo = firstPage; pageNo <= lastPage; pageNo++) {
7677ed
     snprintf (pathName, sizeof (pathName) - 1, destFileName, pageNo);
7677ed
     GooString *gpageName = new GooString (pathName);
7677ed
--
7677ed
cgit v0.9.0.2-2-gbebe