transfig/CVE-2025-46400-2.patch
starlet-dx 817bc7b6e3 Fix CVE-2025-46397,CVE-2025-46398,CVE-2025-46399 and CVE-2025-46400
(cherry picked from commit 4b566e23152cd652f6ff32a9c55d5adc2cf366b9)
2025-04-29 14:07:48 +08:00

111 lines
3.4 KiB
Diff

Origin:
https://sourceforge.net/p/mcj/tickets/187/
https://sourceforge.net/p/mcj/fig2dev/ci/c4465e0d9af89d9738aad31c2d0873ac1fa03c96/
--- a/fig2dev/dev/genpict2e.c
+++ b/fig2dev/dev/genpict2e.c
@@ -3,7 +3,7 @@
* Copyright (c) 1991 by Micah Beck
* Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
* Parts Copyright (c) 1989-2015 by Brian V. Smith
- * Parts Copyright (c) 2015-2025 by Thomas Loimer
+ * Parts Copyright (c) 2015-2023 by Thomas Loimer
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -19,7 +19,7 @@
/*
* genpict2e.c: convert fig to pict2e macro language for LaTeX
*
- * Author: Thomas Loimer, 2014-2025
+ * Author: Thomas Loimer, 2014-2023
* Based on the latex picture driver, genlatex.c
*
*/
@@ -2277,13 +2277,8 @@
l->join_style = MITERJOIN;
p = l->points;
- for (i = 0; i < 8 && p != NULL; ++i)
- p = p->next;
- /* If the radius is about 1, the spline may consist of
- a few points only. */
- if (i < 7)
+ if (p == NULL)
return;
- p = l->points;
/*
* Walk along the spline, until the arc angle is covered.
@@ -2433,7 +2428,7 @@
rad = 0.5*(sqrt((double)d1x*d1x + (double)d1y*d1y)
+ sqrt((double)d2x*d2x + (double)d2y*d2y));
rad = round(rad*10.0) / 10.0;
- /* how precise must the angle be given?
+ /* how precise must the angle be given?
1/rad is the view angle of one pixel */
da = 180.0 / M_PI / rad;
preca = 0;
--- a/fig2dev/object.h
+++ b/fig2dev/object.h
@@ -92,11 +92,14 @@
struct f_ellipse *next;
} F_ellipse;
+#define RADIUS2_MIN 9
#define INVALID_ELLIPSE(e) \
e->type < T_ELLIPSE_BY_RAD || e->type > T_CIRCLE_BY_DIA || \
COMMON_PROPERTIES(e) || (e->direction != 1 && e->direction != 0) || \
e->radiuses.x == 0 || e->radiuses.y == 0 || \
+ e->radiuses.x + e->radiuses.y < RADIUS2_MIN || \
e->angle < -7. || e->angle > 7.
+ /* radiuses are set to positive in read.c */
typedef struct f_arc {
int type;
@@ -135,7 +138,10 @@
(a->direction != 0 && a->direction != 1) || \
COINCIDENT(a->point[0], a->point[1]) || \
COINCIDENT(a->point[0], a->point[2]) || \
- COINCIDENT(a->point[1], a->point[2])
+ COINCIDENT(a->point[1], a->point[2]) || \
+ (a->point[0].x - a->center.x) * (a->point[0].x - a->center.x) + \
+ (a->point[0].y - a->center.y) * (a->point[0].y - a->center.y) < \
+ RADIUS2_MIN
typedef struct f_line {
int type;
--- a/fig2dev/read1_3.c
+++ b/fig2dev/read1_3.c
@@ -3,7 +3,7 @@
* Copyright (c) 1991 by Micah Beck
* Parts Copyright (c) 1985-1988 by Supoj Sutanthavibul
* Parts Copyright (c) 1989-2015 by Brian V. Smith
- * Parts Copyright (c) 2015-2022 by Thomas Loimer
+ * Parts Copyright (c) 2015-2025 by Thomas Loimer
*
* Any party obtaining a copy of these files is granted, free of charge, a
* full and unrestricted irrevocable, world-wide, paid up, royalty-free,
@@ -156,8 +156,10 @@
a->pen_color = a->fill_color = BLACK_COLOR;
a->depth = 0;
a->pen = 0;
+ a->fill_style = 0;
a->for_arrow = NULL;
a->back_arrow = NULL;
+ a->cap_style = 0;
a->comments = NULL;
a->next = NULL;
n = fscanf(fp,
@@ -328,6 +330,10 @@
e->type = T_CIRCLE_BY_RAD;
else
e->type = T_CIRCLE_BY_DIA;
+ if (e->radiuses.x < 0)
+ e->radiuses.x *= -1;
+ if (e->radiuses.y < 0)
+ e->radiuses.y *= -1;
if (INVALID_ELLIPSE(e)) {
put_msg(Err_invalid, "ellipse");
free(e);