Blame SOURCES/ghostscript-cve-2018-19477.patch

38aaa9
From 606a22e77e7f081781e99e44644cd0119f559e03 Mon Sep 17 00:00:00 2001
38aaa9
From: Ken Sharp <ken.sharp@artifex.com>
38aaa9
Date: Wed, 14 Nov 2018 09:27:00 +0000
38aaa9
Subject: [PATCH] Bug #700168 - add a type check
38aaa9
38aaa9
Bug #700168 "Type confusion in JBIG2Decode"
38aaa9
38aaa9
The code was assuming that .jbig2globalctx was a structure allocated
38aaa9
by the graphics library, without checking.
38aaa9
38aaa9
Add a check to see that it is a structure and that its the correct
38aaa9
type of structure.
38aaa9
---
38aaa9
 psi/zfjbig2.c | 2 ++
38aaa9
 1 file changed, 2 insertions(+)
38aaa9
38aaa9
diff --git a/psi/zfjbig2.c b/psi/zfjbig2.c
38aaa9
index a3d13a2..07b470f 100644
38aaa9
--- a/psi/zfjbig2.c
38aaa9
+++ b/psi/zfjbig2.c
38aaa9
@@ -72,6 +72,8 @@ z_jbig2decode(i_ctx_t * i_ctx_p)
38aaa9
     if (r_has_type(op, t_dictionary)) {
38aaa9
         check_dict_read(*op);
38aaa9
         if ( dict_find_string(op, ".jbig2globalctx", &sop) > 0) {
38aaa9
+            if (!r_is_struct(sop) || !r_has_stype(sop, imemory, st_jbig2_global_data_t))
38aaa9
+                return_error(gs_error_typecheck);
38aaa9
             gref = r_ptr(sop, s_jbig2_global_data_t);
38aaa9
             s_jbig2decode_set_global_data((stream_state*)&state, gref);
38aaa9
         }
38aaa9
-- 
38aaa9
2.17.2
38aaa9