[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs.
From: |
Mark H Weaver |
Subject: |
Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs. |
Date: |
Sun, 15 Jan 2017 03:20:59 -0500 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) |
Leo Famulari <address@hidden> writes:
> On Thu, Jan 12, 2017 at 07:59:40PM -0500, Mark H Weaver wrote:
>> Leo Famulari <address@hidden> writes:
>> > If we can't graft it, we should build it on a branch on Hydra.
>>
>> Here's what we can do: in addition to mupdf itself, we can also add a
>> graft for cups-filters (our only package that includes mupdf as an
>> input). The replacement for cups-filters would change its mupdf input
>> to refer directly to the fixed version of mupdf.
>>
>> What do you think?
>
> That's a good idea, and I started implementing it, but then I wondered
> how cups-filters was actually using mupdf. The cups-filters package is
> only 3.7 MB, while libmupdf.a is 44 MB.
>
> It turns out that the built cups-filters doesn't refer to mupdf at all;
> mupdf is not protected from the garbage collector if you install
> cups-filters.
Static linking copies segments of code and data from the *.a into
whatever is being linked (an executable or library). So, buggy code
might be copied from libmupdf.a into 'cups-filters', with no references
to 'mupdf' remaining. Also, the fact that cups-filters is smaller than
libmupdf.a doesn't prove that code wasn't copied from libmupdf.a.
Thanks,
Mark
- [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Marius Bakke, 2017/01/12
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Leo Famulari, 2017/01/12
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Marius Bakke, 2017/01/12
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Leo Famulari, 2017/01/15
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Marius Bakke, 2017/01/15
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Leo Famulari, 2017/01/15
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Marius Bakke, 2017/01/15
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Mark H Weaver, 2017/01/15
- Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs., Leo Famulari, 2017/01/15