6afc4c0c22
Fixes a bunch of CVEs (but not all of them apparently). Changes: https://forum.xpdfreader.com/viewtopic.php?t=43343 ``` 4.05 (2024-feb-08) ------------------ Added the '-overwrite' option to pdftohtml. Added the 'ignoreWrongSizeToUnicode' xpdfrc setting. Added the loadSession and saveSession commands, and the 'Load last session' menu item. Added code to automatically save and restore the xpdf session under control of a session manager. This has not been thoroughly tested yet. Added the zoomScaleFactor xpdfrc setting. Added the zoomValues xpdfrc setting. Added a 'smart case' option for search in xpdf. Added the '-custom' flag to pdfinfo. Added a color/gray/mono switch to the 'save image' dialog. Added the separateRotatedText xpdfrc setting. Added the '-meta' flag to pdftohtml. Added the allowLinksToChangeZoom xpdfrc setting. Added the 'uses JavaScript' output to pdfinfo. Implemented pattern stroking of text. Also fixed the various combinations of filling/stroking with color/pattern + clipping, some of which weren't being handled correctly. Pdftops now (re)compresses any uncompressed or RLE-compressed images. On an out-of-memory error, the command line tools now exit with an "out of memory" message, rather than an exception message. Add code to pdfimages to extract images from tiling patterns. Pdftops can now embed external 8-bit OpenType CFF fonts. Fixed a corner case in the text extractor related to characters drawn at extremely large coordinates. [Thanks to elvadisas for the bug report.] Fixed an integer overflow in the transparency group code. [Thanks to elvadisas for the bug report.] Modify Annots::Annots() to skip annotations that have been turned into AcroFormFields -- invalid Widget-type annots will now be rendered as annots. Added a missing integer overflow check in the JBIG2 decoder. [Thanks to sangjun for the bug report.] Added some sanity checks to the JBIG2 decoder. [Thanks to sangjun and ycdxsb for the bug reports.] Tiling patterns that use non-Normal blend modes can't be cached. Fixed a bitmap size sanity check in the JBIG2 decoder. [Thanks to Han Zheng (NCNIPC of China, Hexhive), for the bug report.] Fixed a missing bounds check in FoFiType1C::convertToOpenType (used in pdftohtml). [Thanks to cyth for the bug report.] Fixed a use-after-free bug in pdftohtml. [Thanks to FeRDNYC for the bug report.] Merged aconf2.h into aconf.h; corrected the cmake config settings for paths; added the BASE14_FONT_DIR config option. [Thanks to FeRDNYC for the suggestions.] Fixed a missing check for a zero-length index in the CFF (Type1C) font parser. [Thanks to Yuhang Huang (NCNIPC of China), Han Zheng (NCNIPC of China, Hexhive), Wanying Cao, Jiayu Zhao (NCNIPC of China) for the bug report.] Add an object loop check to Catalog::countPageTree(). The DCT decoder wasn't checking for an SOF before the first SOS. [Thanks to cyth for the bug report.] The inline image decoder was skipping to end-of-stream in the wrong stream object. [Thanks to cyth for the bug report.] Fixed a bug in the JPEG 2000 decoder when nLayers > 1 and the 'termination on each coding pass' flag is set. Removed the #pragma interface/implementation stuff (which is outdated and useless at this point). Fixed a bug in the ICCBased color space parser that was allowing the number of components to be zero. (CVE-2023-2662) [Thanks to huckleberry for the bug report.] Added checks for PDF object loops in AcroForm::scanField() (CVE-2018-7453, CVE-2018-16369, CVE-2022-36561, CVE-2022-41844), Catalog::readPageLabelTree2() (CVE-2023-2663), and Catalog::readEmbeddedFileTree() (CVE-2023-2664). The zero-width character problem can also happen if the page size is very large -- that needs to be limited too, the same way as character position coordinates. (CVE-2023-3044) [Thanks to jlinliu for the bug report.] Add some missing bounds check code in DCTStream. [Thanks to Jiahao Liu for the bug report.] Fix a deadlock when an object stream's length field is contained in another object stream. (CVE-2023-3436) [Thanks to Jiahao Liu for the bug report.] Correctly handle tiling patterns with negative step values. Ignore overprint in soft masks (to match Adobe's behavior). ```
101 lines
3.3 KiB
Nix
101 lines
3.3 KiB
Nix
{ enableGUI ? true
|
|
, enablePDFtoPPM ? true
|
|
, enablePrinting ? true
|
|
, lib, stdenv, fetchzip, cmake, makeDesktopItem
|
|
, zlib, libpng, cups ? null, freetype ? null
|
|
, qtbase ? null, qtsvg ? null, wrapQtAppsHook
|
|
}:
|
|
|
|
assert enableGUI -> qtbase != null && qtsvg != null && freetype != null;
|
|
assert enablePDFtoPPM -> freetype != null;
|
|
assert enablePrinting -> cups != null;
|
|
|
|
stdenv.mkDerivation rec {
|
|
pname = "xpdf";
|
|
version = "4.05";
|
|
|
|
src = fetchzip {
|
|
urls = [
|
|
"https://dl.xpdfreader.com/xpdf-${version}.tar.gz"
|
|
"https://dl.xpdfreader.com/old/xpdf-${version}.tar.gz"
|
|
];
|
|
hash = "sha256-LBxKSrXTdoulZDjPiyYMaJr63jFHHI+VCgVJx310i/w=";
|
|
};
|
|
|
|
# Fix "No known features for CXX compiler", see
|
|
# https://cmake.org/pipermail/cmake/2016-December/064733.html and the note at
|
|
# https://cmake.org/cmake/help/v3.10/command/cmake_minimum_required.html
|
|
postPatch = lib.optionalString stdenv.isDarwin ''
|
|
substituteInPlace CMakeLists.txt --replace \
|
|
'cmake_minimum_required(VERSION 2.8.12)' 'cmake_minimum_required(VERSION 3.1.0)'
|
|
'';
|
|
|
|
nativeBuildInputs =
|
|
[ cmake ]
|
|
++ lib.optional enableGUI wrapQtAppsHook;
|
|
|
|
cmakeFlags = ["-DSYSTEM_XPDFRC=/etc/xpdfrc" "-DA4_PAPER=ON" "-DOPI_SUPPORT=ON"]
|
|
++ lib.optional (!enablePrinting) "-DXPDFWIDGET_PRINTING=OFF";
|
|
|
|
buildInputs = [ zlib libpng ] ++
|
|
lib.optional enableGUI qtbase ++
|
|
lib.optional enablePrinting cups ++
|
|
lib.optional enablePDFtoPPM freetype;
|
|
|
|
desktopItem = makeDesktopItem {
|
|
name = "xpdf";
|
|
desktopName = "Xpdf";
|
|
comment = "Views Adobe PDF files";
|
|
icon = "xpdf";
|
|
exec = "xpdf %f";
|
|
categories = [ "Office" ];
|
|
};
|
|
|
|
postInstall = lib.optionalString (!stdenv.isDarwin) ''
|
|
install -Dm644 ${desktopItem}/share/applications/xpdf.desktop -t $out/share/applications
|
|
install -Dm644 $src/xpdf-qt/xpdf-icon.svg $out/share/pixmaps/xpdf.svg
|
|
'';
|
|
|
|
meta = with lib; {
|
|
homepage = "https://www.xpdfreader.com";
|
|
description = "Viewer for Portable Document Format (PDF) files";
|
|
longDescription = ''
|
|
XPDF includes multiple tools for viewing and processing PDF files.
|
|
xpdf: PDF viewer (with Graphical Interface)
|
|
pdftotext: converts PDF to text
|
|
pdftops: converts PDF to PostScript
|
|
pdftoppm: converts PDF pages to netpbm (PPM/PGM/PBM) image files
|
|
pdftopng: converts PDF pages to PNG image files
|
|
pdftohtml: converts PDF to HTML
|
|
pdfinfo: extracts PDF metadata
|
|
pdfimages: extracts raw images from PDF files
|
|
pdffonts: lists fonts used in PDF files
|
|
pdfdetach: extracts attached files from PDF files
|
|
'';
|
|
license = with licenses; [ gpl2Only gpl3Only ];
|
|
platforms = platforms.unix;
|
|
maintainers = with maintainers; [ sikmir ];
|
|
knownVulnerabilities = [
|
|
"CVE-2019-9587: loop in PDF objects"
|
|
"CVE-2019-9588: loop in PDF objects"
|
|
"CVE-2019-16088: loop in PDF objects"
|
|
"CVE-2022-38334"
|
|
"CVE-2022-38928"
|
|
"CVE-2022-41842"
|
|
"CVE-2022-41843"
|
|
"CVE-2022-43071"
|
|
"CVE-2022-43295"
|
|
"CVE-2022-45586"
|
|
"CVE-2022-45587"
|
|
"CVE-2023-26930"
|
|
"CVE-2023-26931"
|
|
"CVE-2023-26934"
|
|
"CVE-2023-26935"
|
|
"CVE-2023-26936"
|
|
"CVE-2023-26937"
|
|
"CVE-2023-26938"
|
|
"CVE-2023-27655"
|
|
"CVE-2023-31557"
|
|
];
|
|
};
|
|
}
|