Fix CVE-2017-7976:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7976
https://bugs.ghostscript.com/show_bug.cgi?id=697683

In order to make the bug-fix patch apply, we also include an earlier commit
that it depends on.

Patches copied from upstream source repository:

Earlier commit, creating context for the CVE fix:
https://git.ghostscript.com/?p=jbig2dec.git;a=commit;h=9d2c4f3bdb0bd003deae788e7187c0f86e624544

CVE-2017-7976 bug fix:
https://git.ghostscript.com/?p=jbig2dec.git;a=commit;h=cfa054925de49675ac5445515ebf036fa9379ac6

From 9d2c4f3bdb0bd003deae788e7187c0f86e624544 Mon Sep 17 00:00:00 2001
From: Tor Andersson <tor.andersson@artifex.com>
Date: Wed, 14 Dec 2016 15:56:31 +0100
Subject: [PATCH] Fix warnings: remove unsigned < 0 tests that are always
 false.

---
 jbig2_image.c       | 2 +-
 jbig2_mmr.c         | 2 +-
 jbig2_symbol_dict.c | 9 ++-------
 3 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/jbig2_image.c b/jbig2_image.c
index 94e5a4c..00f966b 100644
--- a/jbig2_image.c
+++ b/jbig2_image.c
@@ -256,7 +256,7 @@ jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src, int x, int
     /* general OR case */
     s = ss;
     d = dd = dst->data + y * dst->stride + leftbyte;
-    if (d < dst->data || leftbyte > dst->stride || h * dst->stride < 0 || d - leftbyte + h * dst->stride > dst->data + dst->height * dst->stride) {
+    if (d < dst->data || leftbyte > dst->stride || d - leftbyte + h * dst->stride > dst->data + dst->height * dst->stride) {
         return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1, "preventing heap overflow in jbig2_image_compose");
     }
     if (leftbyte == rightbyte) {
diff --git a/jbig2_mmr.c b/jbig2_mmr.c
index 390e27c..da54934 100644
--- a/jbig2_mmr.c
+++ b/jbig2_mmr.c
@@ -977,7 +977,7 @@ jbig2_decode_mmr_line(Jbig2MmrCtx *mmr, const byte *ref, byte *dst)
             if (b1 < 2)
                 break;
             if (c) {
-                if (b1 - 2 < a0 || a0 < 0)
+                if (a0 == MINUS1 || b1 - 2 < a0)
                     return -1;
                 jbig2_set_bits(dst, a0, b1 - 2);
             }
diff --git a/jbig2_symbol_dict.c b/jbig2_symbol_dict.c
index 11a2252..4acaba9 100644
--- a/jbig2_symbol_dict.c
+++ b/jbig2_symbol_dict.c
@@ -92,11 +92,6 @@ jbig2_sd_new(Jbig2Ctx *ctx, uint32_t n_symbols)
 {
     Jbig2SymbolDict *new_dict = NULL;
 
-    if (n_symbols < 0) {
-        jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1, "Negative number of symbols in symbol dict: %d", n_symbols);
-        return NULL;
-    }
-
     new_dict = jbig2_new(ctx, Jbig2SymbolDict, 1);
     if (new_dict != NULL) {
         new_dict->glyphs = jbig2_new(ctx, Jbig2Image *, n_symbols);
@@ -613,7 +608,7 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
             uint32_t j;
             int x;
 
-            if (code || (BMSIZE < 0)) {
+            if (code) {
                 jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number, "error decoding size of collective bitmap!");
                 goto cleanup4;
             }
@@ -716,7 +711,7 @@ jbig2_decode_symbol_dict(Jbig2Ctx *ctx,
                 code = jbig2_arith_int_decode(IAEX, as, (int32_t *)&exrunlength);
             /* prevent infinite loop */
             zerolength = exrunlength > 0 ? 0 : zerolength + 1;
-            if (code || (exrunlength > limit - i) || (exrunlength < 0) || (zerolength > 4) || (exflag && (exrunlength + j > params->SDNUMEXSYMS))) {
+            if (code || (exrunlength > limit - i) || (zerolength > 4) || (exflag && (exrunlength + j > params->SDNUMEXSYMS))) {
                 if (code)
                     jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number, "failed to decode exrunlength for exported symbols");
                 else if (exrunlength <= 0)
-- 
2.13.0

From cfa054925de49675ac5445515ebf036fa9379ac6 Mon Sep 17 00:00:00 2001
From: Shailesh Mistry <shailesh.mistry@hotmail.co.uk>
Date: Wed, 10 May 2017 17:50:39 +0100
Subject: [PATCH] Bug 697683: Bounds check before reading from image source
 data.

Add extra check to prevent reading off the end of the image source
data buffer.

Thank you to Dai Ge for finding this issue and suggesting a patch.
---
 jbig2_image.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/jbig2_image.c b/jbig2_image.c
index 661d0a5..ae161b9 100644
--- a/jbig2_image.c
+++ b/jbig2_image.c
@@ -263,7 +263,8 @@ jbig2_image_compose(Jbig2Ctx *ctx, Jbig2Image *dst, Jbig2Image *src, int x, int
     /* general OR case */
     s = ss;
     d = dd = dst->data + y * dst->stride + leftbyte;
-    if (d < dst->data || leftbyte > dst->stride || d - leftbyte + h * dst->stride > dst->data + dst->height * dst->stride) {
+    if (d < dst->data || leftbyte > dst->stride || d - leftbyte + h * dst->stride > dst->data + dst->height * dst->stride ||
+        s - leftbyte + (h - 1) * src->stride + rightbyte > src->data + src->height * src->stride) {
         return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1, "preventing heap overflow in jbig2_image_compose");
     }
     if (leftbyte == rightbyte) {
-- 
2.13.0