Blame SOURCES/ghostscript-cve-2018-15910.patch

b21b1b
From ebcbe0d685911ffc95f3584f6fcbf1f695959757 Mon Sep 17 00:00:00 2001
b21b1b
From: Chris Liddell <chris.liddell@artifex.com>
b21b1b
Date: Tue, 21 Aug 2018 16:42:45 +0100
b21b1b
Subject: [PATCH] Bug 699656: Handle LockDistillerParams not being a boolean
b21b1b
b21b1b
This caused a function call commented as "Can't fail" to fail, and resulted
b21b1b
in memory correuption and a segfault.
b21b1b
---
b21b1b
 base/gdevpdfp.c | 2 +-
b21b1b
 psi/iparam.c    | 7 ++++---
b21b1b
 2 files changed, 5 insertions(+), 4 deletions(-)
b21b1b
b21b1b
diff --git a/base/gdevpdfp.c b/base/gdevpdfp.c
b21b1b
index 7e12fe1..d0f0992 100644
b21b1b
--- a/base/gdevpdfp.c
b21b1b
+++ b/base/gdevpdfp.c
b21b1b
@@ -320,7 +320,7 @@ gdev_pdf_put_params_impl(gx_device * dev, const gx_device_pdf * save_dev, gs_par
b21b1b
      * LockDistillerParams is read again, and reset if necessary, in
b21b1b
      * psdf_put_params.
b21b1b
      */
b21b1b
-    ecode = code = param_read_bool(plist, "LockDistillerParams", &locked);
b21b1b
+    ecode = code = param_read_bool(plist, (param_name = "LockDistillerParams"), &locked);
b21b1b
     if (ecode < 0)
b21b1b
         param_signal_error(plist, param_name, ecode);
b21b1b
 
b21b1b
diff --git a/psi/iparam.c b/psi/iparam.c
b21b1b
index 559b9b8..6f35745 100644
b21b1b
--- a/psi/iparam.c
b21b1b
+++ b/psi/iparam.c
b21b1b
@@ -821,10 +821,11 @@ static int
b21b1b
 ref_param_read_signal_error(gs_param_list * plist, gs_param_name pkey, int code)
b21b1b
 {
b21b1b
     iparam_list *const iplist = (iparam_list *) plist;
b21b1b
-    iparam_loc loc;
b21b1b
+    iparam_loc loc = {0};
b21b1b
 
b21b1b
-    ref_param_read(iplist, pkey, &loc, -1);	/* can't fail */
b21b1b
-    *loc.presult = code;
b21b1b
+    ref_param_read(iplist, pkey, &loc, -1);
b21b1b
+    if (loc.presult)
b21b1b
+        *loc.presult = code;
b21b1b
     switch (ref_param_read_get_policy(plist, pkey)) {
b21b1b
         case gs_param_policy_ignore:
b21b1b
             return 0;
b21b1b
-- 
b21b1b
2.14.4
b21b1b