From: Ken Sharp <ken.sharp@artifex.com>
Date: Thu, 23 Aug 2018 13:12:48 +0000 (+0100)
Subject: Fix Bug 699660 "shading_param incomplete type checking"

Fix Bug 699660 "shading_param incomplete type checking"

Its possible to pass a t_struct parameter to .shfill which is not a
shading function built by .buildshading. This could then lead to memory
corruption or a segmentation fault by treating the object passed in
as if it were a shading.

Its non-trivial to check the t_struct, because this function can take
7 different kinds of structures as a parameter. Checking these is
possible, of course, but would add a performance penalty.

However, we can note that we never call .shfill without first calling
.buildshading, and we never call .buildshading without immediately
calling .shfill. So we can treat these as an atomic operation. The
.buildshading function takes all its parameters as PostScript objects
and validates them, so that should be safe.

This allows us to 'hide' the .shfill operator preventing the possibility
of passing an invalid parameter.

https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0b6cd1918e1ec4ffd087400a754a845180a4522b

From: Ken Sharp <ken.sharp@artifex.com>
Date: Fri, 24 Aug 2018 11:44:26 +0000 (+0100)
Subject: Hide the .shfill operator

Hide the .shfill operator

Commit 0b6cd1918e1ec4ffd087400a754a845180a4522b was supposed to make
the .shfill operator unobtainable, but I accidentally left a comment
in the line doing so.

Fix it here, without this the operator can still be exploited.

https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6
---

diff -up a/Resource/Init/gs_init.ps.cve-2018-15909 b/Resource/Init/gs_init.ps
--- a/Resource/Init/gs_init.ps.cve-2018-15909	2018-11-15 12:01:44.102863484 +0100
+++ b/Resource/Init/gs_init.ps	2018-11-15 12:03:16.564421701 +0100
@@ -2136,8 +2136,8 @@ SAFER { .setsafe } if
 /.getiodevice /.getdevparms /.putdevparams /.bbox_transform /.matchmedia /.matchpagesize /.defaultpapersize
 /.oserrno /.setoserrno /.oserrorstring /.getCPSImode
 /.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep
-/.buildshading1 /.buildshadin2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern
-/.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
+/.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern
+/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring
 /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
 /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
 /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
diff -up a/Resource/Init/gs_ll3.ps.cve-2018-15909 b/Resource/Init/gs_ll3.ps
--- a/Resource/Init/gs_ll3.ps.cve-2018-15909	2018-11-15 12:03:38.878073758 +0100
+++ b/Resource/Init/gs_ll3.ps	2018-11-15 12:04:56.895857191 +0100
@@ -406,6 +406,11 @@ systemdict /.reuseparamdict mark
     /shfill .systemvar /undefined signalerror
   } ifelse
 } bind def
+
+/.buildshading_and_shfill {
+  .buildshading .shfill
+} bind def
+
 systemdict /.reuseparamdict undef
 
 /.buildpattern2 {	% <template> <matrix> .buildpattern2
@@ -430,7 +435,7 @@ systemdict /.reuseparamdict undef
         % Currently, .shfill requires that the color space
         % in the pattern be the current color space.
         % Disable overprintmode for shfill
-  { dup gsave 0 .setoverprintmode .buildshading .shfill } stopped
+  { dup gsave 0 .setoverprintmode .buildshading_and_shfill } stopped
   grestore {
     /$error .systemvar /errorinfo 2 copy known {
       pop pop
diff -up a/Resource/Init/pdf_draw.ps.cve-2018-15909 b/Resource/Init/pdf_draw.ps
--- a/Resource/Init/pdf_draw.ps.cve-2018-15909	2018-11-15 12:05:34.592269375 +0100
+++ b/Resource/Init/pdf_draw.ps	2018-11-15 12:06:54.143028905 +0100
@@ -1131,7 +1131,7 @@ drawopdict begin
             exch
             pop
           } {
-           .buildshading
+           .buildshading_and_shfill
           } ifelse
           .shfill 
         } stopped {