|
 |
bd295e |
From 885444fcbe10dc42787ecb76686c8ee4dd33bf33 Mon Sep 17 00:00:00 2001
|
|
|
bd295e |
From: Ken Sharp <ken.sharp@artifex.com>
|
|
|
bd295e |
Date: Tue, 20 Aug 2019 10:10:28 +0100
|
|
|
bd295e |
Subject: make .forceput inaccessible
|
|
|
bd295e |
|
|
|
bd295e |
Bug #701343, #701344, #701345
|
|
|
bd295e |
|
|
|
bd295e |
More defensive programming. We don't want people to access .forecput
|
|
|
bd295e |
even though it is no longer sufficient to bypass SAFER. The exploit
|
|
|
bd295e |
in #701343 didn't work anyway because of earlier work to stop the error
|
|
|
bd295e |
handler being used, but nevertheless, prevent access to .forceput from
|
|
|
bd295e |
.setuserparams2.
|
|
|
bd295e |
|
|
|
bd295e |
diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
|
|
|
bd295e |
index 4cc7f820f..0fd416465 100644
|
|
|
bd295e |
--- a/Resource/Init/gs_lev2.ps
|
|
|
bd295e |
+++ b/Resource/Init/gs_lev2.ps
|
|
|
bd295e |
@@ -158,7 +158,7 @@ end
|
|
|
bd295e |
{
|
|
|
bd295e |
pop pop
|
|
|
bd295e |
} ifelse
|
|
|
bd295e |
- } forall
|
|
|
bd295e |
+ } executeonly forall
|
|
|
bd295e |
% A context switch might have occurred during the above loop,
|
|
|
bd295e |
% causing the interpreter-level parameters to be reset.
|
|
|
bd295e |
% Set them again to the new values. From here on, we are safe,
|
|
|
bd295e |
@@ -229,9 +229,9 @@ end
|
|
|
bd295e |
{ pop pop
|
|
|
bd295e |
}
|
|
|
bd295e |
ifelse
|
|
|
bd295e |
- }
|
|
|
bd295e |
+ } executeonly
|
|
|
bd295e |
forall pop
|
|
|
bd295e |
-} .bind odef
|
|
|
bd295e |
+} .bind executeonly odef
|
|
|
bd295e |
|
|
|
bd295e |
% Initialize the passwords.
|
|
|
bd295e |
% NOTE: the names StartJobPassword and SystemParamsPassword are known to
|
|
|
bd295e |
diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
|
|
|
bd295e |
index c158a8faf..422e66e1a 100644
|
|
|
bd295e |
--- a/Resource/Init/gs_pdfwr.ps
|
|
|
bd295e |
+++ b/Resource/Init/gs_pdfwr.ps
|
|
|
bd295e |
@@ -658,11 +658,11 @@ currentdict /.pdfmarkparams .undef
|
|
|
bd295e |
systemdict /.pdf_hooked_DSC_Creator //true .forceput
|
|
|
bd295e |
} executeonly if
|
|
|
bd295e |
pop
|
|
|
bd295e |
- } if
|
|
|
bd295e |
+ } executeonly if
|
|
|
bd295e |
} {
|
|
|
bd295e |
pop
|
|
|
bd295e |
} ifelse
|
|
|
bd295e |
- }
|
|
|
bd295e |
+ } executeonly
|
|
|
bd295e |
{
|
|
|
bd295e |
pop
|
|
|
bd295e |
} ifelse
|