From 993c09dd20f3d67938f654e14a92fc5c0ce8d8d0 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Oct 30 2018 05:08:59 +0000 Subject: import ghostscript-9.07-31.el7 --- diff --git a/SOURCES/ghostscript-fix-pxl-devices-printing.patch b/SOURCES/ghostscript-fix-pxl-devices-printing.patch new file mode 100644 index 0000000..3cad626 --- /dev/null +++ b/SOURCES/ghostscript-fix-pxl-devices-printing.patch @@ -0,0 +1,123 @@ +From af6cb84ce3a0b3c26e064dbf0d7514b9260f2ef2 Mon Sep 17 00:00:00 2001 +From: Till Kamppeter +Date: Fri, 23 Sep 2016 17:17:19 -0300 +Subject: [PATCH] pxlcolor/pxlmono output devices: Make MediaPosition, + ManualFeed, and MediaType work + +In the pxlcolor and pxlmono output devices (for PCL-XL printers) the +support for the attributes MediaPosition, ManualFeed, and MediaType +got broken when ESP Ghostscript got merged into GPL Ghostscript (Bug +--- + base/gdevpx.c | 60 +++++++++++++++++++++++++++++++++++++++-------------------- + 1 file changed, 40 insertions(+), 20 deletions(-) + +diff --git a/base/gdevpx.c b/base/gdevpx.c +index 8647332..82a3af1 100644 +--- a/base/gdevpx.c ++++ b/base/gdevpx.c +@@ -1394,12 +1394,6 @@ pclxl_open_device(gx_device * dev) + xdev->media_size = pxeMediaSize_next; /* no size selected */ + memset(&xdev->chars, 0, sizeof(xdev->chars)); + xdev->chars.next_in = xdev->chars.next_out = 2; +- xdev->MediaPosition_set = false; +- xdev->MediaType_set = false; +- xdev->MediaPosition_old = eAutoSelect; +- xdev->MediaPosition = eAutoSelect; +- xdev->MediaType_old[0] = '\0'; +- xdev->MediaType[0] = '\0'; + return 0; + } + +@@ -2185,17 +2179,18 @@ pclxl_get_params(gx_device *dev, /* I - Device info */ + if ((code = param_write_bool(plist, "Duplex", &(xdev->Duplex))) < 0) + return (code); + +- if (xdev->MediaPosition_set) ++ if ((code = param_write_bool(plist, "ManualFeed", ++ &(xdev->ManualFeed))) < 0) ++ return (code); ++ + if ((code = param_write_int(plist, "MediaPosition", + &(xdev->MediaPosition))) < 0) + return (code); + +- if (xdev->MediaType_set) { + if ((code = param_string_from_string(s, xdev->MediaType)) < 0) + return (code); + if ((code = param_write_string(plist, "MediaType", &s)) < 0) + return (code); +- } + + if ((code = param_write_bool(plist, "Tumble", &(xdev->Tumble))) < 0) + return (code); +@@ -2220,6 +2215,10 @@ pclxl_put_params(gx_device *dev, /* I - Device info */ + int intval; /* Integer value */ + bool boolval; /* Boolean value */ + gs_param_string stringval; /* String value */ ++ bool ManualFeed; ++ bool ManualFeed_set = false; ++ int MediaPosition; ++ bool MediaPosition_set = false; + + /* + * Process PCL-XL driver parameters... +@@ -2287,15 +2286,19 @@ pclxl_put_params(gx_device *dev, /* I - Device info */ + if_debug0('|', "round up page count\n"); + xdev->page = (xdev->page+1) & ~1 ; + } +- intoption(MediaPosition, "MediaPosition", int) +- if (code == 0) { +- xdev->MediaPosition_set = true; +- /* round up for duplex */ +- if (xdev->MediaPosition_old != xdev->MediaPosition) { +- if_debug0('|', "round up page count\n"); +- xdev->page = (xdev->page+1) & ~1 ; +- xdev->MediaPosition_old = xdev->MediaPosition; +- } ++ ++ code = param_read_bool(plist, "ManualFeed", &ManualFeed); ++ if (code == 0) ++ ManualFeed_set = true; ++ if (code >= 0) { ++ code = param_read_int(plist, "MediaPosition", &MediaPosition); ++ if (code == 0) ++ MediaPosition_set = true; ++ else if (code < 0) { ++ if (param_read_null(plist, "MediaPosition") == 0) { ++ code = 0; ++ } ++ } + } + stringoption(MediaType, "MediaType") + if (code == 0) { +@@ -2314,8 +2317,25 @@ pclxl_put_params(gx_device *dev, /* I - Device info */ + * Then process standard page device parameters... + */ + +- if ((code = gdev_vector_put_params(dev, plist)) < 0) +- return (code); ++ if (code >= 0) ++ if ((code = gdev_vector_put_params(dev, plist)) < 0) ++ return (code); ++ ++ if (code >= 0) { ++ if (ManualFeed_set) { ++ xdev->ManualFeed = ManualFeed; ++ xdev->ManualFeed_set = true; ++ } ++ if (MediaPosition_set) { ++ xdev->MediaPosition = MediaPosition; ++ xdev->MediaPosition_set = true; ++ if (xdev->MediaPosition_old != xdev->MediaPosition) { ++ if_debug0('|', "round up page count\n"); ++ xdev->page = (xdev->page+1) & ~1 ; ++ xdev->MediaPosition_old = xdev->MediaPosition; ++ } ++ } ++ } + + return (0); + } +-- +2.14.3 + diff --git a/SOURCES/ghostscript-more-than-11-elements-in-array.patch b/SOURCES/ghostscript-more-than-11-elements-in-array.patch new file mode 100644 index 0000000..fea4e88 --- /dev/null +++ b/SOURCES/ghostscript-more-than-11-elements-in-array.patch @@ -0,0 +1,230 @@ +From d2423464852664218310ae7c5610fb0b6da4218b Mon Sep 17 00:00:00 2001 +From: Ken Sharp +Date: Fri, 7 Mar 2014 13:41:01 +0000 +Subject: [PATCH] PS interpreter, vector devices and pdfwrite - remove setdash + limit of 11 + +Bug #693916 "setdash does not accept more than 11 elements in the array argument" + +The PostScript interpreter was already capable of this, it simply required +the limit check to be removed. The vector device needed to allocate and +free an array of floats, rather than maintain a fixed size array. + +pdfwrite was teh most complex as it maintains a stack of gstates, and these +also needed to be modified to allocate and free the dash array. However the +gstate stack wasn't already a garbage collecting structure. Rather than going +to the effort of turning it into one I've opted to allocate the dash pattern +from non-gc memory. + +A few PCL files show differences with pdfwrite, because previously pdfwrite +would throw an error (more than 11 elements in the dash array) and the stroked +lines would degenerate into filled rectangles, whereas now they are drawn as +stroked lines with a correct dash pattern. This is much more efficient. + +The clist remains unmodified, Ray assures me that it will be handled there +without problems. +--- + Resource/Init/gs_init.ps | 1 - + base/gdevpdf.c | 6 ++++++ + base/gdevpdfg.c | 32 +++++++++++++++++++++++++++----- + base/gdevpdfx.h | 3 ++- + base/gdevvec.c | 14 ++++++++++---- + base/gdevvec.h | 13 ++++++------- + 6 files changed, 51 insertions(+), 18 deletions(-) + +diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps +index 0083fa3..b4a6c48 100644 +--- a/Resource/Init/gs_init.ps ++++ b/Resource/Init/gs_init.ps +@@ -518,7 +518,6 @@ userdict /.echo.mode //true put + 0 .argindex type dup /integertype eq exch /realtype eq or not { + /setdash .systemvar /typecheck signalerror + } if +- 1 .argindex length 11 gt { /setdash .systemvar /limitcheck signalerror } if + //setdash + } odef + /setdevice +diff --git a/base/gdevpdf.c b/base/gdevpdf.c +index 8416b51..d740cc1 100644 +--- a/base/gdevpdf.c ++++ b/base/gdevpdf.c +@@ -2873,6 +2873,12 @@ pdf_close(gx_device * dev) + gs_free_object(mem, pdev->Pages, "Free Pages dict"); + pdev->Pages = 0; + ++ { ++ int i; ++ for (i=0;i < pdev->vgstack_depth;i++) ++ gs_free_object(pdev->memory->non_gc_memory, pdev->vgstack[i].dash_pattern, "pdfwrite final free stored dash in gstate"); ++ } ++ + cos_release((cos_object_t *)pdev->NI_stack, "Release Name Index stack"); + gs_free_object(mem, pdev->NI_stack, "Free Name Index stack"); + pdev->NI_stack = 0; +diff --git a/base/gdevpdfg.c b/base/gdevpdfg.c +index 2d4e040..56b24f7 100644 +--- a/base/gdevpdfg.c ++++ b/base/gdevpdfg.c +@@ -71,8 +71,19 @@ pdf_save_viewer_state(gx_device_pdf *pdev, stream *s) + pdev->vgstack[i].saved_stroke_color = pdev->saved_stroke_color; + pdev->vgstack[i].line_params = pdev->state.line_params; + pdev->vgstack[i].line_params.dash.pattern = 0; /* Use pdev->dash_pattern instead. */ +- memcpy(pdev->vgstack[i].dash_pattern, pdev->dash_pattern, +- sizeof(pdev->vgstack[i].dash_pattern)); ++ if (pdev->dash_pattern) { ++ if (pdev->vgstack[i].dash_pattern) ++ gs_free_object(pdev->memory->non_gc_memory, pdev->vgstack[i].dash_pattern, "free gstate copy dash"); ++ pdev->vgstack[i].dash_pattern = (float *)gs_alloc_bytes(pdev->memory->non_gc_memory, pdev->dash_pattern_size * sizeof(float), "gstate copy dash"); ++ memcpy(pdev->vgstack[i].dash_pattern, pdev->dash_pattern, pdev->dash_pattern_size * sizeof(float)); ++ pdev->vgstack[i].dash_pattern_size = pdev->dash_pattern_size; ++ } else { ++ if (pdev->vgstack[i].dash_pattern) { ++ gs_free_object(pdev->memory->non_gc_memory, pdev->vgstack[i].dash_pattern, "free gstate copy dash"); ++ pdev->vgstack[i].dash_pattern = 0; ++ pdev->vgstack[i].dash_pattern_size = 0; ++ } ++ } + pdev->vgstack_depth++; + if (s) + stream_puts(s, "q\n"); +@@ -106,8 +117,18 @@ pdf_load_viewer_state(gx_device_pdf *pdev, pdf_viewer_state *s) + pdev->saved_fill_color = s->saved_fill_color; + pdev->saved_stroke_color = s->saved_stroke_color; + pdev->state.line_params = s->line_params; +- memcpy(pdev->dash_pattern, s->dash_pattern, +- sizeof(s->dash_pattern)); ++ if (s->dash_pattern) { ++ if (pdev->dash_pattern) ++ gs_free_object(pdev->memory->stable_memory, pdev->dash_pattern, "vector free dash pattern"); ++ pdev->dash_pattern = (float *)gs_alloc_bytes(pdev->memory->stable_memory, s->dash_pattern_size * sizeof(float), "vector allocate dash pattern"); ++ pdev->dash_pattern_size = s->dash_pattern_size; ++ } else { ++ if (pdev->dash_pattern) { ++ gs_free_object(pdev->memory->stable_memory, pdev->dash_pattern, "vector free dash pattern"); ++ pdev->dash_pattern = 0; ++ pdev->dash_pattern_size = 0; ++ } ++ } + } + + /* Restore the viewer's graphic state. */ +@@ -178,7 +199,8 @@ pdf_viewer_state_from_imager_state_aux(pdf_viewer_state *pvs, const gs_imager_st + pvs->line_params.dot_length_absolute = pis->line_params.dot_length_absolute; + pvs->line_params.dot_orientation = pis->line_params.dot_orientation; + memset(&pvs->line_params.dash, 0 , sizeof(pvs->line_params.dash)); +- memset(pvs->dash_pattern, 0, sizeof(pvs->dash_pattern)); ++ pvs->dash_pattern = 0; ++ pvs->dash_pattern_size = 0; + } + + /* Copy viewer state from images state. */ +diff --git a/base/gdevpdfx.h b/base/gdevpdfx.h +index bc0545d..69a8257 100644 +--- a/base/gdevpdfx.h ++++ b/base/gdevpdfx.h +@@ -500,7 +500,8 @@ typedef struct pdf_viewer_state_s { + gx_hl_saved_color saved_fill_color; + gx_hl_saved_color saved_stroke_color; + gx_line_params line_params; +- float dash_pattern[max_dash]; ++ float *dash_pattern; ++ uint dash_pattern_size; + gs_id soft_mask_id; + } pdf_viewer_state; + +diff --git a/base/gdevvec.c b/base/gdevvec.c +index ddf787e..ac006f5 100644 +--- a/base/gdevvec.c ++++ b/base/gdevvec.c +@@ -457,24 +457,26 @@ gdev_vector_prepare_stroke(gx_device_vector * vdev, + float dash_offset = pis->line_params.dash.offset * scale; + float half_width = pis->line_params.half_width * scale; + +- if (pattern_size > max_dash) +- return_error(gs_error_limitcheck); + if (dash_offset != vdev->state.line_params.dash.offset || + pattern_size != vdev->state.line_params.dash.pattern_size || + (pattern_size != 0 && + !dash_pattern_eq(vdev->dash_pattern, &pis->line_params.dash, + scale)) + ) { +- float pattern[max_dash]; ++ float *pattern; + int i, code; + ++ pattern = gs_alloc_bytes(vdev->memory->stable_memory, pattern_size * sizeof(float), "vector allocate dash pattern"); + for (i = 0; i < pattern_size; ++i) + pattern[i] = pis->line_params.dash.pattern[i] * scale; + code = (*vdev_proc(vdev, setdash)) + (vdev, pattern, pattern_size, dash_offset); + if (code < 0) + return code; +- memcpy(vdev->dash_pattern, pattern, pattern_size * sizeof(float)); ++ if (vdev->dash_pattern) ++ gs_free_object(vdev->memory->stable_memory, vdev->dash_pattern, "vector free old dash pattern"); ++ vdev->dash_pattern = pattern; ++ vdev->dash_pattern_size = pattern_size; + + vdev->state.line_params.dash.pattern_size = pattern_size; + vdev->state.line_params.dash.offset = dash_offset; +@@ -816,6 +818,10 @@ gdev_vector_close_file(gx_device_vector * vdev) + FILE *f = vdev->file; + int err; + ++ if (vdev->dash_pattern) { ++ gs_free_object(vdev->memory->stable_memory, vdev->dash_pattern, "vector free dash pattern"); ++ vdev->dash_pattern = 0; ++ } + if (vdev->bbox_device) { + rc_decrement(vdev->bbox_device->icc_struct, "vector_close(bbox_device->icc_struct"); + vdev->bbox_device->icc_struct = NULL; +diff --git a/base/gdevvec.h b/base/gdevvec.h +index 1a3eece..385e126 100644 +--- a/base/gdevvec.h ++++ b/base/gdevvec.h +@@ -66,9 +66,6 @@ typedef struct gx_device_vector_s gx_device_vector; + /* Define the maximum size of the output file name. */ + #define fname_size (gp_file_name_sizeof - 1) + +-/* Define the longest dash pattern we can remember. */ +-#define max_dash 11 +- + /* + * Define procedures for writing common output elements. Not all devices + * will support all of these elements. Note that these procedures normally +@@ -168,7 +165,8 @@ int gdev_vector_dorect(gx_device_vector * vdev, fixed x0, fixed y0, + int open_options; /* see below */\ + /* Graphics state */\ + gs_imager_state state;\ +- float dash_pattern[max_dash];\ ++ float *dash_pattern;\ ++ uint dash_pattern_size;\ + bool fill_used_process_color;\ + bool stroke_used_process_color;\ + gx_hl_saved_color saved_fill_color;\ +@@ -194,7 +192,8 @@ int gdev_vector_dorect(gx_device_vector * vdev, fixed x0, fixed y0, + 0, /* strmbuf_size */\ + 0, /* open_options */\ + { 0 }, /* state */\ +- { 0 }, /* dash_pattern */\ ++ 0, /* dash_pattern */\ ++ 0, /* dash pattern size */\ + true, /* fill_used_process_color */\ + true, /* stroke_used_process_color */\ + { 0 }, /* fill_color ****** WRONG ****** */\ +@@ -216,10 +215,10 @@ struct gx_device_vector_s { + /* extern its descriptor for the sake of subclasses. */ + extern_st(st_device_vector); + #define public_st_device_vector() /* in gdevvec.c */\ +- gs_public_st_suffix_add3_final(st_device_vector, gx_device_vector,\ ++ gs_public_st_suffix_add4_final(st_device_vector, gx_device_vector,\ + "gx_device_vector", device_vector_enum_ptrs,\ + device_vector_reloc_ptrs, gx_device_finalize, st_device, strm, strmbuf,\ +- bbox_device) ++ dash_pattern, bbox_device) + #define st_device_vector_max_ptrs (st_device_max_ptrs + 3) + + /* ================ Utility procedures ================ */ +-- +2.14.3 + diff --git a/SPECS/ghostscript.spec b/SPECS/ghostscript.spec index fac7b34..a5ea54c 100644 --- a/SPECS/ghostscript.spec +++ b/SPECS/ghostscript.spec @@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer Name: ghostscript Version: %{gs_ver} -Release: 29%{?dist}.2 +Release: 31%{?dist} # Included CMap data is Redistributable, no modification permitted, # see http://bugzilla.redhat.com/487510 @@ -48,6 +48,8 @@ Patch29: ghostscript-fix-locksafe.patch Patch30: ghostscript-fix-infinite-for-loop.patch Patch33: ghostscript-cope-with-negative-run-length.patch Patch34: ghostscript-raise-VMThreshold-limit.patch +Patch35: ghostscript-fix-pxl-devices-printing.patch +Patch36: ghostscript-more-than-11-elements-in-array.patch # Security patches: # ----------------- @@ -252,7 +254,13 @@ rm -rf expat freetype icclib jasper jpeg lcms lcms2 libpng openjpeg zlib cups/li # Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852): %patch34 -p1 -# CVE-2018-10194 (bug #1629842): +# Fix MediaPosition, ManualFeed and MediaType with pxl devices (bug #1551782): +%patch35 -p1 + +# Allow more than 11 elements in array for setdash (bug #1432209): +%patch36 -p1 + +# CVE-2018-10194 (bug #1569819): %patch37 -p1 # CVE-2018-16509 (bug #1621158): @@ -463,14 +471,14 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/libgs.so %changelog -* Mon Sep 17 2018 David Kaspar [Dee'Kej] - 9.07-29.el7_5.2 -- Fix MediaPosition, ManualFeed and MediaType with pxl devices (bug #1629842) - -* Mon Sep 10 2018 David Kaspar [Dee'Kej] - 9.07-29.el7_5.1 +* Mon Sep 10 2018 David Kaspar [Dee'Kej] - 9.07-31 - Added security fixes for: - - CVE-2018-16509 (bug #1621156) - - CVE-2018-15910 (bug #1621157) - - CVE-2018-16542 (bug #1621380) + - CVE-2018-16509 (bug #1621158) + - CVE-2018-15910 (bug #1621160) + - CVE-2018-16542 (bug #1621382) + +* Tue Apr 17 2018 David Kaspar [Dee'Kej] - 9.07-30 +- Fix MediaPosition, ManualFeed and MediaType with pxl devices (bug #1551782) * Tue Jul 25 2017 David Kaspar [Dee'Kej] - 9.07-29 - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)