Blame SOURCES/ghostscript-cve-2019-14811-14812-14813.patch

6bfa55
From 885444fcbe10dc42787ecb76686c8ee4dd33bf33 Mon Sep 17 00:00:00 2001
6bfa55
From: Ken Sharp <ken.sharp@artifex.com>
6bfa55
Date: Tue, 20 Aug 2019 10:10:28 +0100
6bfa55
Subject: make .forceput inaccessible
6bfa55
6bfa55
Bug #701343, #701344, #701345
6bfa55
6bfa55
More defensive programming. We don't want people to access .forecput
6bfa55
even though it is no longer sufficient to bypass SAFER. The exploit
6bfa55
in #701343 didn't work anyway because of earlier work to stop the error
6bfa55
handler being used, but nevertheless, prevent access to .forceput from
6bfa55
.setuserparams2.
6bfa55
6bfa55
diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
6bfa55
index 4cc7f820f..0fd416465 100644
6bfa55
--- a/Resource/Init/gs_lev2.ps
6bfa55
+++ b/Resource/Init/gs_lev2.ps
6bfa55
@@ -158,7 +158,7 @@ end
6bfa55
     {
6bfa55
       pop pop
6bfa55
     } ifelse
6bfa55
-  } forall
6bfa55
+  } executeonly forall
6bfa55
         % A context switch might have occurred during the above loop,
6bfa55
         % causing the interpreter-level parameters to be reset.
6bfa55
         % Set them again to the new values.  From here on, we are safe,
6bfa55
@@ -229,9 +229,9 @@ end
6bfa55
        { pop pop
6bfa55
        }
6bfa55
       ifelse
6bfa55
-    }
6bfa55
+    } executeonly
6bfa55
    forall pop
6bfa55
-} .bind odef
6bfa55
+} .bind executeonly odef
6bfa55
 
6bfa55
 % Initialize the passwords.
6bfa55
 % NOTE: the names StartJobPassword and SystemParamsPassword are known to
6bfa55
diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
6bfa55
index c158a8faf..422e66e1a 100644
6bfa55
--- a/Resource/Init/gs_pdfwr.ps
6bfa55
+++ b/Resource/Init/gs_pdfwr.ps
6bfa55
@@ -658,11 +658,11 @@ currentdict /.pdfmarkparams .undef
6bfa55
           systemdict /.pdf_hooked_DSC_Creator //true .forceput
6bfa55
         } executeonly if
6bfa55
         pop
6bfa55
-      } if
6bfa55
+      } executeonly if
6bfa55
     } {
6bfa55
       pop
6bfa55
     } ifelse
6bfa55
-  }
6bfa55
+  } executeonly
6bfa55
   {
6bfa55
     pop
6bfa55
   } ifelse