Blame SOURCES/poppler-0.22.5-CVE-2013-4474.patch

9e9667
From 61f79b8447c3ac8ab5a26e79e0c28053ffdccf75 Mon Sep 17 00:00:00 2001
9e9667
From: Albert Astals Cid <aacid@kde.org>
9e9667
Date: Wed, 23 Oct 2013 22:54:56 +0000
9e9667
Subject: Allow only one %d in the filename
9e9667
9e9667
Fixes crashes if you had %s and similar in the filename
9e9667
9e9667
Inspired from patch by Pedro Ribeiro <pedrib@gmail.com>
9e9667
9e9667
Bug #69434
9e9667
---
9e9667
diff --git a/utils/pdfseparate.cc b/utils/pdfseparate.cc
9e9667
index 1d4901b..6424d20 100644
9e9667
--- a/utils/pdfseparate.cc
9e9667
+++ b/utils/pdfseparate.cc
9e9667
@@ -20,6 +20,7 @@
9e9667
 #include "PDFDoc.h"
9e9667
 #include "ErrorCodes.h"
9e9667
 #include "GlobalParams.h"
9e9667
+#include <ctype.h>
9e9667
 
9e9667
 static int firstPage = 0;
9e9667
 static int lastPage = 0;
9e9667
@@ -63,9 +64,37 @@ bool extractPages (const char *srcFileName, const char *destFileName) {
9e9667
   if (firstPage == 0)
9e9667
     firstPage = 1;
9e9667
   if (firstPage != lastPage && strstr(destFileName, "%d") == NULL) {
9e9667
-    error(errSyntaxError, -1, "'{0:s}' must contain '%%d' if more than one page should be extracted", destFileName);
9e9667
+    error(errSyntaxError, -1, "'{0:s}' must contain '%d' if more than one page should be extracted", destFileName);
9e9667
     return false;
9e9667
   }
9e9667
+  
9e9667
+  // destFileName can have multiple %% and one %d
9e9667
+  // We use auxDestFileName to replace all the valid % appearances
9e9667
+  // by 'A' (random char that is not %), if at the end of replacing
9e9667
+  // any of the valid appearances there is still any % around, the
9e9667
+  // pattern is wrong
9e9667
+  char *auxDestFileName = strdup(destFileName);
9e9667
+  // %% can appear as many times as you want
9e9667
+  char *p = strstr(auxDestFileName, "%%");
9e9667
+  while (p != NULL) {
9e9667
+    *p = 'A';
9e9667
+    *(p + 1) = 'A';
9e9667
+    p = strstr(p, "%%"); 
9e9667
+  }
9e9667
+  // %d can appear only one time
9e9667
+  p = strstr(auxDestFileName, "%d");
9e9667
+  if (p != NULL) {
9e9667
+    *p = 'A';
9e9667
+  }
9e9667
+  // at this point any other % is wrong
9e9667
+  p = strstr(auxDestFileName, "%");
9e9667
+  if (p != NULL) {
9e9667
+    error(errSyntaxError, -1, "'{0:s}' can only contain one '%d' pattern", destFileName);
9e9667
+    free(auxDestFileName);
9e9667
+    return false;
9e9667
+  }
9e9667
+  free(auxDestFileName);
9e9667
+  
9e9667
   for (int pageNo = firstPage; pageNo <= lastPage; pageNo++) {
9e9667
     snprintf (pathName, sizeof (pathName) - 1, destFileName, pageNo);
9e9667
     GooString *gpageName = new GooString (pathName);
9e9667
--
9e9667
cgit v0.9.0.2-2-gbebe