diff --git a/SOURCES/evince-3.28.2-TIFFReadRGBAImageOriented.patch b/SOURCES/evince-3.28.2-TIFFReadRGBAImageOriented.patch new file mode 100644 index 0000000..856ab19 --- /dev/null +++ b/SOURCES/evince-3.28.2-TIFFReadRGBAImageOriented.patch @@ -0,0 +1,72 @@ +From 3e38d5ad724a042eebadcba8c2d57b0f48b7a8c7 Mon Sep 17 00:00:00 2001 +From: Jason Crain +Date: Mon, 15 Apr 2019 23:06:36 -0600 +Subject: [PATCH] tiff: Handle failure from TIFFReadRGBAImageOriented + +The TIFFReadRGBAImageOriented function returns zero if it was unable to +read the image. Return NULL in this case instead of displaying +uninitialized memory. + +Fixes #1129 +--- + backend/tiff/tiff-document.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/backend/tiff/tiff-document.c b/backend/tiff/tiff-document.c +index 7715031b..38bb3bd8 100644 +--- a/backend/tiff/tiff-document.c ++++ b/backend/tiff/tiff-document.c +@@ -292,18 +292,22 @@ tiff_document_render (EvDocument *document, + g_warning("Failed to allocate memory for rendering."); + return NULL; + } +- ++ ++ if (!TIFFReadRGBAImageOriented (tiff_document->tiff, ++ width, height, ++ (uint32 *)pixels, ++ orientation, 0)) { ++ g_warning ("Failed to read TIFF image."); ++ g_free (pixels); ++ return NULL; ++ } ++ + surface = cairo_image_surface_create_for_data (pixels, + CAIRO_FORMAT_RGB24, + width, height, + rowstride); + cairo_surface_set_user_data (surface, &key, + pixels, (cairo_destroy_func_t)g_free); +- +- TIFFReadRGBAImageOriented (tiff_document->tiff, +- width, height, +- (uint32 *)pixels, +- orientation, 0); + pop_handlers (); + + /* Convert the format returned by libtiff to +@@ -384,13 +388,17 @@ tiff_document_get_thumbnail (EvDocument *document, + if (!pixels) + return NULL; + ++ if (!TIFFReadRGBAImageOriented (tiff_document->tiff, ++ width, height, ++ (uint32 *)pixels, ++ ORIENTATION_TOPLEFT, 0)) { ++ g_free (pixels); ++ return NULL; ++ } ++ + pixbuf = gdk_pixbuf_new_from_data (pixels, GDK_COLORSPACE_RGB, TRUE, 8, + width, height, rowstride, + (GdkPixbufDestroyNotify) g_free, NULL); +- TIFFReadRGBAImageOriented (tiff_document->tiff, +- width, height, +- (uint32 *)pixels, +- ORIENTATION_TOPLEFT, 0); + pop_handlers (); + + ev_render_context_compute_scaled_size (rc, width, height * (x_res / y_res), +-- +2.21.0 + diff --git a/SPECS/evince.spec b/SPECS/evince.spec index a83b938..5e64935 100644 --- a/SPECS/evince.spec +++ b/SPECS/evince.spec @@ -5,7 +5,7 @@ Name: evince Version: 3.28.2 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Document viewer License: GPLv2+ and GPLv3+ and LGPLv2+ and MIT and Afmparse @@ -26,6 +26,8 @@ Patch9: evince-3.28.2-signed-size.patch Patch10: evince-3.28.2-application-id.patch # https://bugzilla.redhat.com/show_bug.cgi?id=1541358 Patch11: evince-3.28.2-print-scaling.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=1716295 +Patch12: evince-3.28.2-TIFFReadRGBAImageOriented.patch BuildRequires: pkgconfig(adwaita-icon-theme) BuildRequires: pkgconfig(gio-unix-2.0) >= %{glib2_version} @@ -276,6 +278,10 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas >&/dev/null ||: %{_libdir}/mozilla/plugins/libevbrowserplugin.so %changelog +* Tue Aug 13 2019 Marek Kasik - 3.28.2-9 +- Handle failure from TIFFReadRGBAImageOriented +- Resolves: #1717352 + * Thu May 9 2019 Marek Kasik - 3.28.2-8 - Do not free EvDocumentInfo in ev_window_save_print_settings(), - it is freed in EvDocument's destructor