mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 16:24:17 -09:00
3f4e289aab
Fixes the following vulnerability:
- CVE-2026-25556:
MuPDF versions 1.23.0 through 1.27.0 contain a double-free
vulnerability in fz_fill_pixmap_from_display_list() when an exception
occurs during display list rendering. The function accepts a caller-
owned fz_pixmap pointer but incorrectly drops the pixmap in its error
handling path before rethrowing the exception. Callers (including the
barcode decoding path in fz_decode_barcode_from_display_list) also
drop the same pixmap in cleanup, resulting in a double-free that can
corrupt the heap and crash the process. This issue affects
applications that enable and use MuPDF barcode decoding and can be
triggered by processing crafted input that causes a rendering-time
error while decoding barcodes.
For more information, see
- https://www.cve.org/CVERecord?id=CVE-2026-25556
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
78 lines
2.0 KiB
Makefile
78 lines
2.0 KiB
Makefile
################################################################################
|
|
#
|
|
# mudpf
|
|
#
|
|
################################################################################
|
|
|
|
# python-pymupdf's version be compatible with mupdf's version
|
|
MUPDF_VERSION = 1.23.9
|
|
MUPDF_SOURCE = mupdf-$(MUPDF_VERSION)-source.tar.lz
|
|
MUPDF_SITE = https://mupdf.com/downloads/archive
|
|
MUPDF_LICENSE = AGPL-3.0+
|
|
MUPDF_LICENSE_FILES = COPYING
|
|
MUPDF_CPE_ID_VENDOR = artifex
|
|
MUPDF_INSTALL_STAGING = YES
|
|
MUPDF_DEPENDENCIES = \
|
|
freetype \
|
|
gumbo-parser \
|
|
harfbuzz \
|
|
host-pkgconf \
|
|
jbig2dec jpeg \
|
|
lcms2 openjpeg \
|
|
zlib
|
|
|
|
# Fix is in libfreeglut, but CVE applied to mupdf 1.23.9.
|
|
# Buildroot libfreeglut is >3.4.0 then is not affected.
|
|
MUPDF_IGNORE_CVES = \
|
|
CVE-2024-24258 \
|
|
CVE-2024-24259
|
|
|
|
# 0001-Fix-incorrect-error-case-free-of-pixmap.patch
|
|
MUPDF_IGNORE_CVES += CVE-2026-25556
|
|
|
|
# mupdf doesn't use CFLAGS and LIBS but XCFLAGS and XLIBS instead.
|
|
# with USE_SYSTEM_LIBS it will try to use system libraries instead of the bundled ones.
|
|
MUPDF_MAKE_ENV = $(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) \
|
|
XCFLAGS="$(TARGET_CFLAGS)" \
|
|
XLIBS="$(TARGET_LDFLAGS)" \
|
|
USE_SYSTEM_LIBS=yes
|
|
|
|
MUPDF_MAKE_OPTS = \
|
|
HAVE_OBJCOPY=no \
|
|
prefix="/usr"
|
|
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
MUPDF_MAKE_OPTS += shared=no
|
|
else
|
|
MUPDF_MAKE_OPTS += shared=yes
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBX11)$(BR2_PACKAGE_XLIB_LIBXEXT),yy)
|
|
MUPDF_MAKE_OPTS += HAVE_X11=yes
|
|
MUPDF_DEPENDENCIES += xlib_libX11 xlib_libXext
|
|
else
|
|
MUPDF_MAKE_OPTS += HAVE_X11=no
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBFREEGLUT),y)
|
|
MUPDF_DEPENDENCIES += libfreeglut
|
|
else
|
|
MUPDF_MAKE_OPTS += HAVE_GLUT=no
|
|
endif
|
|
|
|
define MUPDF_BUILD_CMDS
|
|
$(MUPDF_MAKE_ENV) $(MAKE) -C $(@D) $(MUPDF_MAKE_OPTS) all
|
|
endef
|
|
|
|
define MUPDF_INSTALL_STAGING_CMDS
|
|
$(MUPDF_MAKE_ENV) $(MAKE) -C $(@D) $(MUPDF_MAKE_OPTS) \
|
|
DESTDIR="$(STAGING_DIR)" install-libs
|
|
endef
|
|
|
|
define MUPDF_INSTALL_TARGET_CMDS
|
|
$(MUPDF_MAKE_ENV) $(MAKE) -C $(@D) $(MUPDF_MAKE_OPTS) \
|
|
DESTDIR="$(TARGET_DIR)" install-libs install-apps
|
|
endef
|
|
|
|
$(eval $(generic-package))
|