Debian Patches

Status for djvulibre/3.5.30.1-1

Patch Description Author Forwarded Bugs Origin Last update
0002-djvulibre-fedora-Patch6-djvulibre-3.5.27-export-file.patch djvulibre-fedora Patch6 djvulibre-3.5.27-export-file.patch "Barak A. Pearlmutter" <barak+git@pearlmutter.net> no 2021-05-10
0007-check-thread-creation.patch Fail instead of hanging when a thread cannot be created
DjVuFile::start_decode() and DjVuDocument::start_init() ignored the
return value of GThread::create(). When pthread_create() fails, e.g.,
because a low "ulimit -v" leaves no room for the thread stack, the
file stays flagged DECODING (or the document init STARTED but never
FINISHED) and anyone waiting on it, such as a page waiting on a
shared JB2 dictionary from an included file, blocks forever.

Check the return value and throw, so the existing error paths mark the
file or document as failed.		 "Barak A. Pearlmutter" <bap@debian.org> no debian 2026-10-26
0008-NEWS-typo-remove-xmp.patch Fix typo in NEWS: remove-smp -> remove-xmp "Barak A. Pearlmutter" <bap@debian.org> no debian 2026-10-26
0009-limit-INCL-nesting-depth.patch Limit INCL nesting depth to stop stack overflow on INCL cycles
DjVuDocument::url_to_file() registers a new DjVuFile under its name
only after DjVuFile::create() returns, but when the data is already
present create() synchronously processes the file's INCL chunks. A
cycle of INCL chunks (b includes c includes b) thus creates fresh
files forever and the recursion overflows the stack.

Upstream commit cd8b5c9 rejects a file including itself, which covers
only cycles of length one. The Fedora patch previously carried here
(djvulibre-3.5.27-djvuport-stack-overflow.patch, for CVE-2021-3500)
remembers only the single most recent id, so it misses any cycle of
length two or more, and it keeps that id in the process-wide
DjVuPortcaster without locking.

Instead bound the per-thread INCL nesting depth. Legitimate documents
nest INCL chunks only a couple of levels deep.		 "Barak A. Pearlmutter" <bap@debian.org> no 2026-10-26
debian-changes Autogenerated patch header for a single-debian-patch file. The delta against upstream is either kept as a single patch, or maintained
in some VCS, and exported as a single patch instead of more manageable
atomic patches.		 not-needed

All known versions for source package 'djvulibre'

Links