Blame SOURCES/ghostscript-cve-2018-16511.patch

01c841
From: Chris Liddell <chris.liddell@artifex.com>
01c841
Date: Tue, 21 Aug 2018 19:36:52 +0000 (+0100)
01c841
Subject: Bug 699659: Don't just assume an object is a t_(a)struct
01c841
01c841
Bug 699659: Don't just assume an object is a t_(a)struct
01c841
01c841
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0edd3d6c634a577db261615a9dc2719bca7f6e01
01c841
---
01c841
01c841
diff -up a/psi/ztype.c.cve-2018-16511 b/psi/ztype.c
01c841
--- a/psi/ztype.c.cve-2018-16511	2018-11-14 09:52:09.491518742 +0100
01c841
+++ b/psi/ztype.c	2018-11-14 10:14:02.238279799 +0100
01c841
@@ -76,6 +76,7 @@ ztype(i_ctx_t *i_ctx_p)
01c841
         /* Must be either a stack underflow or a t_[a]struct. */
01c841
         check_op(2);
01c841
         {                       /* Get the type name from the structure. */
01c841
+            if ((r_has_type(&op[-1], t_struct) || r_has_type(&op[-1], t_astruct)) && op[-1].value.pstruct != 0x00) {
01c841
             const char *sname =
01c841
                 gs_struct_type_name_string(gs_object_type(imemory,
01c841
                                                           op[-1].value.pstruct));
01c841
@@ -84,6 +85,8 @@ ztype(i_ctx_t *i_ctx_p)
01c841
 
01c841
             if (code < 0)
01c841
                 return code;
01c841
+            } else
01c841
+                return_error(gs_error_stackunderflow);
01c841
         }
01c841
         r_set_attrs(op - 1, a_executable);
01c841
     } else {