From: Ken Sharp <ken.sharp@artifex.com>
Date: Thu, 8 Nov 2018 14:43:32 +0000 (+0000)
Subject: PS interpreter - check the Implementation of a Pattern before use

PS interpreter - check the Implementation of a Pattern before use

Bug #700141 "Type confusion in setpattern"

As the bug thread says, we were not checking that the Implementation
of a pattern dictionary was a structure type, leading to a crash when
we tried to treat it as one.

Here we make the st_pattern1_instance and st_pattern2_instance
structures public definitions and in zsetcolor we check the object
stored under the Implementation key in the supplied dictionary to see if
its a t_struct or t_astruct type, and if it is that its a
st_pattern1_instance or st_pattern2_instance structure.

If either check fails we throw a typecheck error.

We need to make the st_pattern1_instance and st_pattern2_instance
definitions public as they are defined in the graphics library and we
need to check in the interpreter.

https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=693baf02152119af6e6afd30bb8ec76d14f84bbf
---

diff -up ghostscript-9.07/base/gsptype1.c.cve-2018-19134 ghostscript-9.07/base/gsptype1.c
--- ghostscript-9.07/base/gsptype1.c.cve-2018-19134	2018-12-06 14:24:51.562580221 +0100
+++ ghostscript-9.07/base/gsptype1.c	2018-12-06 14:25:19.570310740 +0100
@@ -50,7 +50,7 @@
 
 /* GC descriptors */
 private_st_pattern1_template();
-private_st_pattern1_instance();
+public_st_pattern1_instance();
 
 /* GC procedures */
 static ENUM_PTRS_BEGIN(pattern1_instance_enum_ptrs) {
diff -up ghostscript-9.07/base/gsptype2.c.cve-2018-19134 ghostscript-9.07/base/gsptype2.c
--- ghostscript-9.07/base/gsptype2.c.cve-2018-19134	2018-12-06 14:25:51.442004068 +0100
+++ ghostscript-9.07/base/gsptype2.c	2018-12-06 14:27:26.160092718 +0100
@@ -33,7 +33,7 @@
 
 /* GC descriptors */
 private_st_pattern2_template();
-private_st_pattern2_instance();
+public_st_pattern2_instance();
 
 /* GC procedures */
 static ENUM_PTRS_BEGIN(pattern2_instance_enum_ptrs) {
@@ -208,7 +208,7 @@ gs_pattern2_set_color(const gs_client_co
     
     num_comps = pgs->device->color_info.num_components;
     for (k = 0; k < num_comps; k++) {
-        pgs->color_component_map.color_map[k] = 
+        pgs->color_component_map.color_map[k] =
             pinst->saved->color_component_map.color_map[k];
     }
     code = pcs->type->set_overprint(pcs, pgs);
diff -up ghostscript-9.07/base/gsptype2.h.cve-2018-19134 ghostscript-9.07/base/gsptype2.h
--- ghostscript-9.07/base/gsptype2.h.cve-2018-19134	2018-12-06 14:28:16.159611632 +0100
+++ ghostscript-9.07/base/gsptype2.h	2018-12-06 14:28:53.499252361 +0100
@@ -57,8 +57,8 @@ typedef struct gs_pattern2_instance_s {
     bool shfill;
 } gs_pattern2_instance_t;
 
-#define private_st_pattern2_instance() /* in gsptype2.c */\
-  gs_private_st_composite(st_pattern2_instance, gs_pattern2_instance_t,\
+#define public_st_pattern2_instance() /* in gsptype2.c */\
+  gs_public_st_composite(st_pattern2_instance, gs_pattern2_instance_t,\
     "gs_pattern2_instance_t", pattern2_instance_enum_ptrs,\
     pattern2_instance_reloc_ptrs)
 
diff -up ghostscript-9.07/base/gxcolor2.h.cve-2018-19134 ghostscript-9.07/base/gxcolor2.h
--- ghostscript-9.07/base/gxcolor2.h.cve-2018-19134	2018-12-06 14:29:16.623029864 +0100
+++ ghostscript-9.07/base/gxcolor2.h	2018-12-06 14:29:49.115717229 +0100
@@ -92,8 +92,8 @@ struct gs_pattern1_instance_s {
     gx_bitmap_id id;		/* key for cached bitmap (= id of mask) */
 };
 
-#define private_st_pattern1_instance() /* in gsptype1.c */\
-  gs_private_st_composite(st_pattern1_instance, gs_pattern1_instance_t,\
+#define public_st_pattern1_instance() /* in gsptype1.c */\
+  gs_public_st_composite(st_pattern1_instance, gs_pattern1_instance_t,\
     "gs_pattern1_instance_t", pattern1_instance_enum_ptrs,\
     pattern1_instance_reloc_ptrs)
 
diff -up ghostscript-9.07/psi/zcolor.c.cve-2018-19134 ghostscript-9.07/psi/zcolor.c
--- ghostscript-9.07/psi/zcolor.c.cve-2018-19134	2018-12-06 14:30:27.229350513 +0100
+++ ghostscript-9.07/psi/zcolor.c	2018-12-06 14:31:52.650528604 +0100
@@ -57,6 +57,8 @@
 
 /* imported from gsht.c */
 extern  void    gx_set_effective_transfer(gs_state *);
+extern_st(st_pattern1_instance);
+extern_st(st_pattern2_instance);
 
 /* Essential forward declarations */
 static int validate_spaces(i_ctx_t *i_ctx_p, ref *arr, int *depth);
@@ -283,6 +285,9 @@ zsetcolor(i_ctx_t * i_ctx_p)
             code = array_get(imemory, pImpl, 0, &pPatInst);
             if (code < 0)
                 return code;
+                if (!r_is_struct(&pPatInst) || (!r_has_stype(&pPatInst, imemory, st_pattern1_instance) && !r_has_stype(&pPatInst, imemory, st_pattern2_instance)))
+                    return_error(gs_error_typecheck);
+
             cc.pattern = r_ptr(&pPatInst, gs_pattern_instance_t);
             n_numeric_comps = ( pattern_instance_uses_base_space(cc.pattern)
                                   ? n_comps - 1