[pkgsrc/trunk]: pkgsrc/print/mupdf Backport fixes to mupdf-1.10a from upstrea...

[leot <leot%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/3fbc6e648bbe
branches:  trunk
changeset: 357860:3fbc6e648bbe
user:      leot <leot%pkgsrc.org@localhost>
date:      Mon Jan 30 14:06:05 2017 +0000

description:
Backport fixes to mupdf-1.10a from upstream for CVE-2017-562[78]

PKGREVISION++

diffstat:

 print/mupdf/Makefile                               |   4 +-
 print/mupdf/distinfo                               |   4 ++-
 print/mupdf/patches/patch-thirdparty_mujs_jsdate.c |  27 ++++++++++++++++++++++
 print/mupdf/patches/patch-thirdparty_mujs_jsrun.c  |  21 +++++++++++++++++
 4 files changed, 53 insertions(+), 3 deletions(-)

diffs (85 lines):

diff -r 64513215ccf9 -r 3fbc6e648bbe print/mupdf/Makefile
--- a/print/mupdf/Makefile      Mon Jan 30 12:47:50 2017 +0000
+++ b/print/mupdf/Makefile      Mon Jan 30 14:06:05 2017 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.43 2017/01/01 16:05:59 adam Exp $
+# $NetBSD: Makefile,v 1.44 2017/01/30 14:06:05 leot Exp $
 
 DISTNAME=      mupdf-1.10a-source
 PKGNAME=       ${DISTNAME:S/-source//}
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    print
 MASTER_SITES=  http://mupdf.com/downloads/archive/
 
diff -r 64513215ccf9 -r 3fbc6e648bbe print/mupdf/distinfo
--- a/print/mupdf/distinfo      Mon Jan 30 12:47:50 2017 +0000
+++ b/print/mupdf/distinfo      Mon Jan 30 14:06:05 2017 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.29 2016/12/09 08:19:31 leot Exp $
+$NetBSD: distinfo,v 1.30 2017/01/30 14:06:05 leot Exp $
 
 SHA1 (mupdf-1.10a-source.tar.gz) = 1c3a6e1d4406912004b8e2c09435199e6b425191
 RMD160 (mupdf-1.10a-source.tar.gz) = bfb482681c6804db8a0fd9ec46b16ac6f9fffdf2
@@ -10,3 +10,5 @@
 SHA1 (patch-ae) = c6b113818b32cb4470e8549c00a16e0b2f364ede
 SHA1 (patch-source_fitz_load-jpx.c) = fbe6814536d37835a4daa5bb90b1f6cf8698f807
 SHA1 (patch-thirdparty_mujs_Makefile) = f1da7cdf2c9e2e4bbac3e80ef486204a39b27e34
+SHA1 (patch-thirdparty_mujs_jsdate.c) = 020fcb9d1e77bd7ba10943070673d53bbcee573b
+SHA1 (patch-thirdparty_mujs_jsrun.c) = 79f730436b1f67780468c10096d3dbfb5e14d5a5
diff -r 64513215ccf9 -r 3fbc6e648bbe print/mupdf/patches/patch-thirdparty_mujs_jsdate.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/print/mupdf/patches/patch-thirdparty_mujs_jsdate.c        Mon Jan 30 14:06:05 2017 +0000
@@ -0,0 +1,27 @@
+$NetBSD: patch-thirdparty_mujs_jsdate.c,v 1.1 2017/01/30 14:06:05 leot Exp $
+
+Backport a fix from upstream for CVE-2017-5628:
+
+Fix 697496: Check NAN before accessing array in MakeDay().
+
+--- thirdparty/mujs/jsdate.c.orig
++++ thirdparty/mujs/jsdate.c
+@@ -207,12 +207,17 @@ static double MakeDay(double y, double m, double date)
+       };
+ 
+       double yd, md;
++      int im;
+ 
+       y += floor(m / 12);
+       m = pmod(m, 12);
+ 
++      im = (int)m;
++      if (im < 0 || im >= 12)
++              return NAN;
++
+       yd = floor(TimeFromYear(y) / msPerDay);
+-      md = firstDayOfMonth[InLeapYear(y)][(int)m];
++      md = firstDayOfMonth[InLeapYear(y)][im];
+ 
+       return yd + md + date - 1;
+ }
diff -r 64513215ccf9 -r 3fbc6e648bbe print/mupdf/patches/patch-thirdparty_mujs_jsrun.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/print/mupdf/patches/patch-thirdparty_mujs_jsrun.c Mon Jan 30 14:06:05 2017 +0000
@@ -0,0 +1,21 @@
+$NetBSD: patch-thirdparty_mujs_jsrun.c,v 1.1 2017/01/30 14:06:05 leot Exp $
+
+Backport a fix from upstream for CVE-2017-5627:
+
+Fix 697497: Ensure array length is positive.
+
+As a side effect when changing to using regular integers (and avoid the
+nightmare of mixing signed and unsigned) we accidentally allowed negative
+array lengths.
+
+--- thirdparty/mujs/jsrun.c.orig
++++ thirdparty/mujs/jsrun.c
+@@ -544,7 +544,7 @@ static void jsR_setproperty(js_State *J, js_Object *obj, const char *name)
+               if (!strcmp(name, "length")) {
+                       double rawlen = jsV_tonumber(J, value);
+                       int newlen = jsV_numbertointeger(rawlen);
+-                      if (newlen != rawlen)
++                      if (newlen != rawlen || newlen < 0)
+                               js_rangeerror(J, "array length");
+                       jsV_resizearray(J, obj, newlen);
+                       return;