[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs.

From: Mark H Weaver
Subject: Re: [PATCH] gnu: mupdf: Fix some security problems in bundled mujs.
Date: Sun, 15 Jan 2017 03:20:59 -0500
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)

Leo Famulari <address@hidden> writes:

> On Thu, Jan 12, 2017 at 07:59:40PM -0500, Mark H Weaver wrote:
>> Leo Famulari <address@hidden> writes:
>> > If we can't graft it, we should build it on a branch on Hydra.
>> Here's what we can do: in addition to mupdf itself, we can also add a
>> graft for cups-filters (our only package that includes mupdf as an
>> input).  The replacement for cups-filters would change its mupdf input
>> to refer directly to the fixed version of mupdf.
>> What do you think?
> That's a good idea, and I started implementing it, but then I wondered
> how cups-filters was actually using mupdf. The cups-filters package is
> only 3.7 MB, while libmupdf.a is 44 MB.
> It turns out that the built cups-filters doesn't refer to mupdf at all;
> mupdf is not protected from the garbage collector if you install
> cups-filters.

Static linking copies segments of code and data from the *.a into
whatever is being linked (an executable or library).  So, buggy code
might be copied from libmupdf.a into 'cups-filters', with no references
to 'mupdf' remaining.  Also, the fact that cups-filters is smaller than
libmupdf.a doesn't prove that code wasn't copied from libmupdf.a.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]