Compare commits
10 Commits
966ab620e0
...
201b510e14
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
201b510e14 | ||
|
|
ee579efc5a | ||
|
|
d4674768f9 | ||
|
|
e46fc6b04c | ||
|
|
1bc97ca271 | ||
|
|
e4600decff | ||
|
|
fffc75cda3 | ||
|
|
d8518c8cb6 | ||
|
|
eb4652193d | ||
|
|
7c5eb3f040 |
@ -1,50 +0,0 @@
|
||||
From 1c5220a55e0df63c122ad172debd86763512f09d Mon Sep 17 00:00:00 2001
|
||||
Subject: [PATCH] Fix CVE-2018-12123
|
||||
---
|
||||
.../java/org/apache/pdfbox/pdfparser/COSParser.java | 12 +++++++++---
|
||||
1 file changed, 9 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/pdfbox/src/main/java/org/apache/pdfbox/pdfparser/COSParser.java b/pdfbox/src/main/java/org/apache/pdfbox/pdfparser/COSParser.java
|
||||
index 524f2f5..751f4f1 100644
|
||||
--- a/pdfbox/src/main/java/org/apache/pdfbox/pdfparser/COSParser.java
|
||||
+++ b/pdfbox/src/main/java/org/apache/pdfbox/pdfparser/COSParser.java
|
||||
@@ -2239,12 +2239,12 @@ public class COSParser extends BaseParser
|
||||
COSBase pages = root.getDictionaryObject(COSName.PAGES);
|
||||
if (pages instanceof COSDictionary)
|
||||
{
|
||||
- checkPagesDictionary((COSDictionary) pages);
|
||||
+ checkPagesDictionary((COSDictionary) pages, new HashSet<COSObject>());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
- private int checkPagesDictionary(COSDictionary pagesDict)
|
||||
+ private int checkPagesDictionary(COSDictionary pagesDict, Set<COSObject> set)
|
||||
{
|
||||
// check for kids
|
||||
COSBase kids = pagesDict.getDictionaryObject(COSName.KIDS);
|
||||
@@ -2256,6 +2256,11 @@ public class COSParser extends BaseParser
|
||||
for (COSBase kid : kidsList)
|
||||
{
|
||||
COSObject kidObject = (COSObject) kid;
|
||||
+ if (set.contains(kidObject))
|
||||
+ {
|
||||
+ kidsArray.remove(kid);
|
||||
+ continue;
|
||||
+ }
|
||||
COSBase kidBaseobject = kidObject.getObject();
|
||||
// object wasn't dereferenced -> remove it
|
||||
if (kidBaseobject.equals(COSNull.NULL))
|
||||
@@ -2270,7 +2275,8 @@ public class COSParser extends BaseParser
|
||||
if (COSName.PAGES.equals(type))
|
||||
{
|
||||
// process nested pages dictionaries
|
||||
- numberOfPages += checkPagesDictionary(kidDictionary);
|
||||
+ set.add(kidObject);
|
||||
+ numberOfPages += checkPagesDictionary(kidDictionary, set);
|
||||
}
|
||||
else if (COSName.PAGE.equals(type))
|
||||
{
|
||||
--
|
||||
2.23.0
|
||||
|
||||
@ -1,41 +0,0 @@
|
||||
From 96708d737a9eaa5f950ca9aead18bf93a728d754 Mon Sep 17 00:00:00 2001
|
||||
Subject: [PATCH] Fix CVE-2018-8036
|
||||
---
|
||||
.../main/java/org/apache/fontbox/afm/AFMParser.java | 12 ++++++++----
|
||||
1 file changed, 8 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java b/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java
|
||||
index 2ac3dbe..320df7b 100644
|
||||
--- a/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java
|
||||
+++ b/fontbox/src/main/java/org/apache/fontbox/afm/AFMParser.java
|
||||
@@ -951,9 +951,11 @@ public class AFMParser
|
||||
buf.append( (char)nextByte );
|
||||
|
||||
//now read the data
|
||||
- while( !isEOL(nextByte = input.read()) )
|
||||
+ nextByte = input.read();
|
||||
+ while (nextByte != -1 && !isEOL(nextByte))
|
||||
{
|
||||
- buf.append( (char)nextByte );
|
||||
+ buf.append((char)nextByte);
|
||||
+ nextByte = input.read();
|
||||
}
|
||||
return buf.toString();
|
||||
}
|
||||
@@ -978,9 +980,11 @@ public class AFMParser
|
||||
buf.append( (char)nextByte );
|
||||
|
||||
//now read the data
|
||||
- while( !isWhitespace(nextByte = input.read()) )
|
||||
+ nextByte = input.read();
|
||||
+ while(nextByte != -1 && !isWhitespace(nextByte))
|
||||
{
|
||||
- buf.append( (char)nextByte );
|
||||
+ buf.append((char)nextByte);
|
||||
+ nextByte = input.read();
|
||||
}
|
||||
return buf.toString();
|
||||
}
|
||||
--
|
||||
2.23.0
|
||||
|
||||
Binary file not shown.
47
pdfbox.spec
47
pdfbox.spec
@ -1,18 +1,16 @@
|
||||
Name: pdfbox
|
||||
Version: 2.0.9
|
||||
Release: 7
|
||||
Version: 2.0.24
|
||||
Release: 3
|
||||
Summary: A Java PDF Library
|
||||
License: ASL 2.0
|
||||
URL: http://pdfbox.apache.org/
|
||||
Source0: http://archive.apache.org/dist/pdfbox/%{version}/pdfbox-%{version}-src.zip
|
||||
Patch6000: CVE-2018-8036.patch
|
||||
Patch6001: CVE-2018-11797.patch
|
||||
Source0: http://www.apache.org/dyn/closer.lua/pdfbox/%{version}/pdfbox-%{version}-src.zip
|
||||
BuildRequires: maven-local mvn(commons-io:commons-io)
|
||||
BuildRequires: mvn(commons-logging:commons-logging) mvn(junit:junit)
|
||||
BuildRequires: mvn(log4j:log4j:1.2.17) mvn(org.apache.ant:ant) mvn(org.apache:apache:pom:)
|
||||
BuildRequires: mvn(org.apache.ant:ant) mvn(org.apache:apache:pom:)
|
||||
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) mvn(org.bouncycastle:bcmail-jdk15on)
|
||||
BuildRequires: mvn(org.bouncycastle:bcprov-jdk15on) dejavu-sans-mono-fonts google-noto-emoji-fonts
|
||||
BuildRequires: liberation-sans-fonts icc-profiles-openicc fontconfig
|
||||
BuildRequires: liberation-sans-fonts icc-profiles-openicc fontconfig mockito
|
||||
Requires: liberation-sans-fonts
|
||||
|
||||
BuildArch: noarch
|
||||
@ -93,7 +91,6 @@ contents. It is mainly used by subproject preflight of Apache PDFBox.
|
||||
%pom_remove_plugin -r :maven-source-plugin
|
||||
%pom_remove_plugin -r :maven-javadoc-plugin
|
||||
%pom_remove_plugin -r :maven-checkstyle-plugin
|
||||
%pom_remove_plugin -r :maven-download-plugin
|
||||
%pom_remove_plugin -r :download-maven-plugin
|
||||
|
||||
%pom_remove_dep -r com.github.jai-imageio:
|
||||
@ -108,8 +105,19 @@ do
|
||||
done
|
||||
sed -i -e 's/TestTextStripper/BidiTest/' pdfbox/src/test/java/org/apache/pdfbox/text/BidiTest.java
|
||||
|
||||
rm pdfbox/src/test/java/org/apache/pdfbox/multipdf/MergeAcroFormsTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/multipdf/MergeAnnotationsTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/font/PDFontTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/PDAcroFormFlattenTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/PDAcroFormFromAnnotsTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/PDAcroFormGenerateAppearancesTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/PDAcroFormTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/PDFieldTreeTest.java \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/TestRadioButtons.java
|
||||
sed -i -e '/\(OptionsAndNamesNotNumbers\|RadioButtonWithOptions\)/i\@org.junit.Ignore' \
|
||||
pdfbox/src/test/java/org/apache/pdfbox/pdmodel/interactive/form/PDButtonTest.java
|
||||
|
||||
|
||||
%mvn_file :pdfbox pdfbox
|
||||
%mvn_file :pdfbox pdfbox
|
||||
%mvn_file :pdfbox-debugger pdfbox-debugger
|
||||
%mvn_file :pdfbox-examples pdfbox-examples
|
||||
@ -119,11 +127,14 @@ sed -i -e 's/TestTextStripper/BidiTest/' pdfbox/src/test/java/org/apache/pdfbox/
|
||||
%mvn_file :fontbox fontbox
|
||||
|
||||
%build
|
||||
%mvn_build -s -- -DskipITs -Dlucene.version=4 -Dmaven.test.failure.ignore=true
|
||||
%mvn_build -s --skipTests -- -DskipITs -Dlucene.version=4 -Dmaven.test.failure.ignore=true
|
||||
|
||||
%install
|
||||
%mvn_install
|
||||
|
||||
%check
|
||||
xmvn test --batch-mode --offline -Dmaven.test.failure.ignore=true verify
|
||||
|
||||
%files -f .mfiles-pdfbox
|
||||
%doc README.md RELEASE-NOTES.txt
|
||||
|
||||
@ -150,6 +161,22 @@ sed -i -e 's/TestTextStripper/BidiTest/' pdfbox/src/test/java/org/apache/pdfbox/
|
||||
%license LICENSE.txt NOTICE.txt
|
||||
|
||||
%changelog
|
||||
* Fri Nov 25 2022 yaoxin <yaoxin30@h-partners.com> - 2.0.24-3
|
||||
- Fix build error
|
||||
|
||||
* Fri Jul 09 2021 lingsheng <lingsheng@huawei.com> - 2.0.24-2
|
||||
- Remove tests which require net connectivity to avoid build stuck
|
||||
- Move tests to check stage
|
||||
|
||||
* Tue Jun 29 2021 houyingchao <houyingchao@huawei.com> - 2.0.24-1
|
||||
- Upgrade to 2.0.24
|
||||
|
||||
* Thu Apr 01 2021 maminjie <maminjie1@huawei.com> - 2.0.23-1
|
||||
- Upgrade to 2.0.23
|
||||
|
||||
* Tue Jan 26 2021 lingsheng <lingsheng@huawei.com> - 2.0.9-8
|
||||
- Remove tests which require net connectivity
|
||||
|
||||
* Sat Sep 19 2020 zhanghua <zhanghua40@huawei.com> - 2.0.9-7
|
||||
- Fix CVE-2018-8036, CVE-2018-11797
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user