|
 |
01c841 |
From: Ken Sharp <ken.sharp@artifex.com>
|
|
|
01c841 |
Date: Thu, 23 Aug 2018 13:12:48 +0000 (+0100)
|
|
|
01c841 |
Subject: Fix Bug 699660 "shading_param incomplete type checking"
|
|
|
01c841 |
|
|
|
01c841 |
Fix Bug 699660 "shading_param incomplete type checking"
|
|
|
01c841 |
|
|
|
01c841 |
Its possible to pass a t_struct parameter to .shfill which is not a
|
|
|
01c841 |
shading function built by .buildshading. This could then lead to memory
|
|
|
01c841 |
corruption or a segmentation fault by treating the object passed in
|
|
|
01c841 |
as if it were a shading.
|
|
|
01c841 |
|
|
|
01c841 |
Its non-trivial to check the t_struct, because this function can take
|
|
|
01c841 |
7 different kinds of structures as a parameter. Checking these is
|
|
|
01c841 |
possible, of course, but would add a performance penalty.
|
|
|
01c841 |
|
|
|
01c841 |
However, we can note that we never call .shfill without first calling
|
|
|
01c841 |
.buildshading, and we never call .buildshading without immediately
|
|
|
01c841 |
calling .shfill. So we can treat these as an atomic operation. The
|
|
|
01c841 |
.buildshading function takes all its parameters as PostScript objects
|
|
|
01c841 |
and validates them, so that should be safe.
|
|
|
01c841 |
|
|
|
01c841 |
This allows us to 'hide' the .shfill operator preventing the possibility
|
|
|
01c841 |
of passing an invalid parameter.
|
|
|
01c841 |
|
|
|
01c841 |
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0b6cd1918e1ec4ffd087400a754a845180a4522b
|
|
|
01c841 |
|
|
|
01c841 |
From: Ken Sharp <ken.sharp@artifex.com>
|
|
|
01c841 |
Date: Fri, 24 Aug 2018 11:44:26 +0000 (+0100)
|
|
|
01c841 |
Subject: Hide the .shfill operator
|
|
|
01c841 |
|
|
|
01c841 |
Hide the .shfill operator
|
|
|
01c841 |
|
|
|
01c841 |
Commit 0b6cd1918e1ec4ffd087400a754a845180a4522b was supposed to make
|
|
|
01c841 |
the .shfill operator unobtainable, but I accidentally left a comment
|
|
|
01c841 |
in the line doing so.
|
|
|
01c841 |
|
|
|
01c841 |
Fix it here, without this the operator can still be exploited.
|
|
|
01c841 |
|
|
|
01c841 |
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6
|
|
|
01c841 |
---
|
|
|
01c841 |
|
|
|
01c841 |
diff -up a/Resource/Init/gs_init.ps.cve-2018-15909 b/Resource/Init/gs_init.ps
|
|
|
01c841 |
--- a/Resource/Init/gs_init.ps.cve-2018-15909 2018-11-15 12:01:44.102863484 +0100
|
|
|
01c841 |
+++ b/Resource/Init/gs_init.ps 2018-11-15 12:03:16.564421701 +0100
|
|
|
01c841 |
@@ -2136,8 +2136,8 @@ SAFER { .setsafe } if
|
|
|
01c841 |
/.getiodevice /.getdevparms /.putdevparams /.bbox_transform /.matchmedia /.matchpagesize /.defaultpapersize
|
|
|
01c841 |
/.oserrno /.setoserrno /.oserrorstring /.getCPSImode
|
|
|
01c841 |
/.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep
|
|
|
01c841 |
-/.buildshading1 /.buildshadin2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern
|
|
|
01c841 |
-/.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
|
|
|
01c841 |
+/.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern
|
|
|
01c841 |
+/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
|
|
|
01c841 |
/.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
|
|
|
01c841 |
/.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
|
|
|
01c841 |
/.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
|
|
|
01c841 |
diff -up a/Resource/Init/gs_ll3.ps.cve-2018-15909 b/Resource/Init/gs_ll3.ps
|
|
|
01c841 |
--- a/Resource/Init/gs_ll3.ps.cve-2018-15909 2018-11-15 12:03:38.878073758 +0100
|
|
|
01c841 |
+++ b/Resource/Init/gs_ll3.ps 2018-11-15 12:04:56.895857191 +0100
|
|
|
01c841 |
@@ -406,6 +406,11 @@ systemdict /.reuseparamdict mark
|
|
|
01c841 |
/shfill .systemvar /undefined signalerror
|
|
|
01c841 |
} ifelse
|
|
|
01c841 |
} bind def
|
|
|
01c841 |
+
|
|
|
01c841 |
+/.buildshading_and_shfill {
|
|
|
01c841 |
+ .buildshading .shfill
|
|
|
01c841 |
+} bind def
|
|
|
01c841 |
+
|
|
|
01c841 |
systemdict /.reuseparamdict undef
|
|
|
01c841 |
|
|
|
01c841 |
/.buildpattern2 { % <template> <matrix> .buildpattern2
|
|
|
01c841 |
@@ -430,7 +435,7 @@ systemdict /.reuseparamdict undef
|
|
|
01c841 |
% Currently, .shfill requires that the color space
|
|
|
01c841 |
% in the pattern be the current color space.
|
|
|
01c841 |
% Disable overprintmode for shfill
|
|
|
01c841 |
- { dup gsave 0 .setoverprintmode .buildshading .shfill } stopped
|
|
|
01c841 |
+ { dup gsave 0 .setoverprintmode .buildshading_and_shfill } stopped
|
|
|
01c841 |
grestore {
|
|
|
01c841 |
/$error .systemvar /errorinfo 2 copy known {
|
|
|
01c841 |
pop pop
|
|
|
01c841 |
diff -up a/Resource/Init/pdf_draw.ps.cve-2018-15909 b/Resource/Init/pdf_draw.ps
|
|
|
01c841 |
--- a/Resource/Init/pdf_draw.ps.cve-2018-15909 2018-11-15 12:05:34.592269375 +0100
|
|
|
01c841 |
+++ b/Resource/Init/pdf_draw.ps 2018-11-15 12:06:54.143028905 +0100
|
|
|
01c841 |
@@ -1131,7 +1131,7 @@ drawopdict begin
|
|
|
01c841 |
exch
|
|
|
01c841 |
pop
|
|
|
01c841 |
} {
|
|
|
01c841 |
- .buildshading
|
|
|
01c841 |
+ .buildshading_and_shfill
|
|
|
01c841 |
} ifelse
|
|
|
01c841 |
.shfill
|
|
|
01c841 |
} stopped {
|