public inbox for buildroot@busybox.net
 help / color / mirror / Atom feed
* [Buildroot] [PATCH] package/mupdf: add patch for CVE-2026-25556
@ 2026-02-28 20:15 Thomas Perale via buildroot
  2026-02-28 20:51 ` Julien Olivain via buildroot
  2026-03-06 19:53 ` Thomas Perale via buildroot
  0 siblings, 2 replies; 3+ messages in thread
From: Thomas Perale via buildroot @ 2026-02-28 20:15 UTC (permalink / raw)
  To: buildroot; +Cc: Raphaël Mélotte

Fixes the following vulnerability:

- CVE-2026-25556:
    MuPDF versions 1.23.0 through 1.27.0 contain a double-free
    vulnerability in fz_fill_pixmap_from_display_list() when an exception
    occurs during display list rendering. The function accepts a caller-
    owned fz_pixmap pointer but incorrectly drops the pixmap in its error
    handling path before rethrowing the exception. Callers (including the
    barcode decoding path in fz_decode_barcode_from_display_list) also
    drop the same pixmap in cleanup, resulting in a double-free that can
    corrupt the heap and crash the process. This issue affects
    applications that enable and use MuPDF barcode decoding and can be
    triggered by processing crafted input that causes a rendering-time
    error while decoding barcodes.

For more information, see
  - https://www.cve.org/CVERecord?id=CVE-2026-25556
  - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 ...-incorrect-error-case-free-of-pixmap.patch | 53 +++++++++++++++++++
 package/mupdf/mupdf.mk                        |  3 ++
 2 files changed, 56 insertions(+)
 create mode 100644 package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch

diff --git a/package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch b/package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch
new file mode 100644
index 0000000000..f78c429cef
--- /dev/null
+++ b/package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch
@@ -0,0 +1,53 @@
+From d4743b6092d513321c23c6f7fe5cff87cde043c1 Mon Sep 17 00:00:00 2001
+From: Robin Watts <Robin.Watts@artifex.com>
+Date: Mon, 12 Jan 2026 19:08:56 +0000
+Subject: Bug 709029: Fix incorrect error-case free of pixmap.
+
+Don't free a pixmap we don't own!
+
+CVE: CVE-2026-25556
+Upstream: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ source/fitz/util.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/source/fitz/util.c b/source/fitz/util.c
+index 7710124cc..90226a5c1 100644
+--- a/source/fitz/util.c
++++ b/source/fitz/util.c
+@@ -119,7 +119,15 @@ fz_new_pixmap_from_display_list_with_separations(fz_context *ctx, fz_display_lis
+ 	else
+ 		fz_clear_pixmap_with_value(ctx, pix, 0xFF);
+
+-	return fz_fill_pixmap_from_display_list(ctx, list, ctm, pix);
++	fz_try(ctx)
++		fz_fill_pixmap_from_display_list(ctx, list, ctm, pix);
++	fz_catch(ctx)
++	{
++		fz_drop_pixmap(ctx, pix);
++		fz_rethrow(ctx);
++	}
++
++	return pix;
+ }
+
+ fz_pixmap *
+@@ -136,14 +144,9 @@ fz_fill_pixmap_from_display_list(fz_context *ctx, fz_display_list *list, fz_matr
+ 		fz_close_device(ctx, dev);
+ 	}
+ 	fz_always(ctx)
+-	{
+ 		fz_drop_device(ctx, dev);
+-	}
+ 	fz_catch(ctx)
+-	{
+-		fz_drop_pixmap(ctx, pix);
+ 		fz_rethrow(ctx);
+-	}
+
+ 	return pix;
+ }
+--
+cgit v1.2.3
+
diff --git a/package/mupdf/mupdf.mk b/package/mupdf/mupdf.mk
index fe4f3e6756..c538b9bec8 100644
--- a/package/mupdf/mupdf.mk
+++ b/package/mupdf/mupdf.mk
@@ -27,6 +27,9 @@ MUPDF_IGNORE_CVES = \
 	CVE-2024-24258 \
 	CVE-2024-24259
 
+# 0001-Fix-incorrect-error-case-free-of-pixmap.patch
+MUPDF_IGNORE_CVES += CVE-2026-25556
+
 # mupdf doesn't use CFLAGS and LIBS but XCFLAGS and XLIBS instead.
 # with USE_SYSTEM_LIBS it will try to use system libraries instead of the bundled ones.
 MUPDF_MAKE_ENV = $(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) \
-- 
2.53.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH] package/mupdf: add patch for CVE-2026-25556
  2026-02-28 20:15 [Buildroot] [PATCH] package/mupdf: add patch for CVE-2026-25556 Thomas Perale via buildroot
@ 2026-02-28 20:51 ` Julien Olivain via buildroot
  2026-03-06 19:53 ` Thomas Perale via buildroot
  1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-02-28 20:51 UTC (permalink / raw)
  To: Thomas Perale; +Cc: buildroot, Raphaël Mélotte

On 28/02/2026 21:15, Thomas Perale via buildroot wrote:
> Fixes the following vulnerability:
> 
> - CVE-2026-25556:
>     MuPDF versions 1.23.0 through 1.27.0 contain a double-free
>     vulnerability in fz_fill_pixmap_from_display_list() when an 
> exception
>     occurs during display list rendering. The function accepts a 
> caller-
>     owned fz_pixmap pointer but incorrectly drops the pixmap in its 
> error
>     handling path before rethrowing the exception. Callers (including 
> the
>     barcode decoding path in fz_decode_barcode_from_display_list) also
>     drop the same pixmap in cleanup, resulting in a double-free that 
> can
>     corrupt the heap and crash the process. This issue affects
>     applications that enable and use MuPDF barcode decoding and can be
>     triggered by processing crafted input that causes a rendering-time
>     error while decoding barcodes.
> 
> For more information, see
>   - https://www.cve.org/CVERecord?id=CVE-2026-25556
>   - 
> https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH] package/mupdf: add patch for CVE-2026-25556
  2026-02-28 20:15 [Buildroot] [PATCH] package/mupdf: add patch for CVE-2026-25556 Thomas Perale via buildroot
  2026-02-28 20:51 ` Julien Olivain via buildroot
@ 2026-03-06 19:53 ` Thomas Perale via buildroot
  1 sibling, 0 replies; 3+ messages in thread
From: Thomas Perale via buildroot @ 2026-03-06 19:53 UTC (permalink / raw)
  To: Thomas Perale; +Cc: buildroot

In reply of:
> Fixes the following vulnerability:
> 
> - CVE-2026-25556:
>     MuPDF versions 1.23.0 through 1.27.0 contain a double-free
>     vulnerability in fz_fill_pixmap_from_display_list() when an exception
>     occurs during display list rendering. The function accepts a caller-
>     owned fz_pixmap pointer but incorrectly drops the pixmap in its error
>     handling path before rethrowing the exception. Callers (including the
>     barcode decoding path in fz_decode_barcode_from_display_list) also
>     drop the same pixmap in cleanup, resulting in a double-free that can
>     corrupt the heap and crash the process. This issue affects
>     applications that enable and use MuPDF barcode decoding and can be
>     triggered by processing crafted input that causes a rendering-time
>     error while decoding barcodes.
> 
> For more information, see
>   - https://www.cve.org/CVERecord?id=CVE-2026-25556
>   - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to 2025.02.x & 2025.11.x. Thanks

> ---
>  ...-incorrect-error-case-free-of-pixmap.patch | 53 +++++++++++++++++++
>  package/mupdf/mupdf.mk                        |  3 ++
>  2 files changed, 56 insertions(+)
>  create mode 100644 package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch
> 
> diff --git a/package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch b/package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch
> new file mode 100644
> index 0000000000..f78c429cef
> --- /dev/null
> +++ b/package/mupdf/0001-Fix-incorrect-error-case-free-of-pixmap.patch
> @@ -0,0 +1,53 @@
> +From d4743b6092d513321c23c6f7fe5cff87cde043c1 Mon Sep 17 00:00:00 2001
> +From: Robin Watts <Robin.Watts@artifex.com>
> +Date: Mon, 12 Jan 2026 19:08:56 +0000
> +Subject: Bug 709029: Fix incorrect error-case free of pixmap.
> +
> +Don't free a pixmap we don't own!
> +
> +CVE: CVE-2026-25556
> +Upstream: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1
> +Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> +---
> + source/fitz/util.c | 15 +++++++++------
> + 1 file changed, 9 insertions(+), 6 deletions(-)
> +
> +diff --git a/source/fitz/util.c b/source/fitz/util.c
> +index 7710124cc..90226a5c1 100644
> +--- a/source/fitz/util.c
> ++++ b/source/fitz/util.c
> +@@ -119,7 +119,15 @@ fz_new_pixmap_from_display_list_with_separations(fz_context *ctx, fz_display_lis
> + 	else
> + 		fz_clear_pixmap_with_value(ctx, pix, 0xFF);
> +
> +-	return fz_fill_pixmap_from_display_list(ctx, list, ctm, pix);
> ++	fz_try(ctx)
> ++		fz_fill_pixmap_from_display_list(ctx, list, ctm, pix);
> ++	fz_catch(ctx)
> ++	{
> ++		fz_drop_pixmap(ctx, pix);
> ++		fz_rethrow(ctx);
> ++	}
> ++
> ++	return pix;
> + }
> +
> + fz_pixmap *
> +@@ -136,14 +144,9 @@ fz_fill_pixmap_from_display_list(fz_context *ctx, fz_display_list *list, fz_matr
> + 		fz_close_device(ctx, dev);
> + 	}
> + 	fz_always(ctx)
> +-	{
> + 		fz_drop_device(ctx, dev);
> +-	}
> + 	fz_catch(ctx)
> +-	{
> +-		fz_drop_pixmap(ctx, pix);
> + 		fz_rethrow(ctx);
> +-	}
> +
> + 	return pix;
> + }
> +--
> +cgit v1.2.3
> +
> diff --git a/package/mupdf/mupdf.mk b/package/mupdf/mupdf.mk
> index fe4f3e6756..c538b9bec8 100644
> --- a/package/mupdf/mupdf.mk
> +++ b/package/mupdf/mupdf.mk
> @@ -27,6 +27,9 @@ MUPDF_IGNORE_CVES = \
>  	CVE-2024-24258 \
>  	CVE-2024-24259
>  
> +# 0001-Fix-incorrect-error-case-free-of-pixmap.patch
> +MUPDF_IGNORE_CVES += CVE-2026-25556
> +
>  # mupdf doesn't use CFLAGS and LIBS but XCFLAGS and XLIBS instead.
>  # with USE_SYSTEM_LIBS it will try to use system libraries instead of the bundled ones.
>  MUPDF_MAKE_ENV = $(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) \
> -- 
> 2.53.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-06 19:53 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-28 20:15 [Buildroot] [PATCH] package/mupdf: add patch for CVE-2026-25556 Thomas Perale via buildroot
2026-02-28 20:51 ` Julien Olivain via buildroot
2026-03-06 19:53 ` Thomas Perale via buildroot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox