gnu: mupdf: Fix CVE-2018-{6544,1000051}.

* gnu/packages/patches/mupdf-CVE-2018-1000051.patch,
gnu/packages/patches/mupdf-CVE-2018-6544.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/pdf.scm (mupdf)[source]: Use them.

1 files changed, 88 insertions, 0 deletions

diff --git a/gnu/packages/patches/mupdf-CVE-2018-1000051.patch b/gnu/packages/patches/mupdf-CVE-2018-1000051.patch
new file mode 100644
index 0000000000..bb78c46f80
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2018-1000051.patch
@@ -0,0 +1,88 @@
+Fix CVE-2018-1000051:
+
+https://bugs.ghostscript.com/show_bug.cgi?id=698873
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000051
+
+Patch copied from upstream source repository:
+
+https://git.ghostscript.com/?p=mupdf.git;a=commit;h=321ba1de287016b0036bf4a56ce774ad11763384
+
+From 321ba1de287016b0036bf4a56ce774ad11763384 Mon Sep 17 00:00:00 2001
+From: Sebastian Rasmussen <sebras@gmail.com>
+Date: Tue, 19 Dec 2017 23:47:47 +0100
+Subject: [PATCH] Bug 698825: Do not drop borrowed colorspaces.
+
+Previously the borrowed colorspace was dropped when updating annotation
+appearances, leading to use after free warnings from valgrind/ASAN.
+---
+ source/pdf/pdf-appearance.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/source/pdf/pdf-appearance.c b/source/pdf/pdf-appearance.c
+index 70f684f4..d7a1dddd 100644
+--- a/source/pdf/pdf-appearance.c
++++ b/source/pdf/pdf-appearance.c
+@@ -2170,7 +2170,6 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p
+ 	fz_device *dev = NULL;
+ 	font_info font_rec;
+ 	fz_text *text = NULL;
+-	fz_colorspace *cs = NULL;
+ 	fz_matrix page_ctm;
+ 
+ 	pdf_page_transform(ctx, annot->page, NULL, &page_ctm);
+@@ -2184,11 +2183,11 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p
+ 	fz_var(dlist);
+ 	fz_var(dev);
+ 	fz_var(text);
+-	fz_var(cs);
+ 	fz_try(ctx)
+ 	{
+ 		char *contents = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, PDF_NAME_Contents));
+ 		char *da = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, PDF_NAME_DA));
++		fz_colorspace *cs;
+ 		fz_point pos;
+ 		fz_rect rect;
+ 
+@@ -2223,7 +2222,6 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p
+ 		fz_drop_display_list(ctx, dlist);
+ 		font_info_fin(ctx, &font_rec);
+ 		fz_drop_text(ctx, text);
+-		fz_drop_colorspace(ctx, cs);
+ 	}
+ 	fz_catch(ctx)
+ 	{
+@@ -2359,7 +2357,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 	fz_device *dev = NULL;
+ 	font_info font_rec;
+ 	fz_text *text = NULL;
+-	fz_colorspace *cs = NULL;
+ 	fz_path *path = NULL;
+ 	fz_buffer *fzbuf = NULL;
+ 	fz_matrix page_ctm;
+@@ -2375,7 +2372,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 	fz_var(dlist);
+ 	fz_var(dev);
+ 	fz_var(text);
+-	fz_var(cs);
+ 	fz_var(fzbuf);
+ 	fz_try(ctx)
+ 	{
+@@ -2384,6 +2380,7 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 		fz_rect logo_bounds;
+ 		fz_matrix logo_tm;
+ 		fz_rect rect;
++		fz_colorspace *cs = fz_device_rgb(ctx); /* Borrowed reference */
+ 
+ 		pdf_to_rect(ctx, pdf_dict_get(ctx, annot->obj, PDF_NAME_Rect), &annot_rect);
+ 		rect = annot_rect;
+@@ -2396,7 +2393,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 		fz_bound_path(ctx, path, NULL, &fz_identity, &logo_bounds);
+ 		center_rect_within_rect(&logo_bounds, &rect, &logo_tm);
+ 		fz_concat(&logo_tm, &logo_tm, &page_ctm);
+-		cs = fz_device_rgb(ctx); /* Borrowed reference */
+ 		fz_fill_path(ctx, dev, path, 0, &logo_tm, cs, logo_color, 1.0f, NULL);
+ 
+ 		get_font_info(ctx, doc, dr, da, &font_rec);
+-- 
+2.16.3
+