From ed4834e25815a546a87a304317a5d344d534b96d Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Aug 06 2019 10:01:19 +0000 Subject: import ghostscript-9.25-2.el7 --- diff --git a/.ghostscript.metadata b/.ghostscript.metadata index f3d9248..83136ea 100644 --- a/.ghostscript.metadata +++ b/.ghostscript.metadata @@ -1 +1,2 @@ -93f816b55c716987f45cf68c85b9923ceafe7bbb SOURCES/ghostscript-9.07-cleaned.tar.bz2 +9d8ddff3382113bf4a1640368350e05652c93613 SOURCES/ghostscript-9.25.tar.xz +11d691c763ebe23f84035fa2bf00139d892b896c SOURCES/ghostscript-cups-9.07.tar.xz diff --git a/.gitignore b/.gitignore index 3f45a5a..f2a8cd0 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -SOURCES/ghostscript-9.07-cleaned.tar.bz2 +SOURCES/ghostscript-9.25.tar.xz +SOURCES/ghostscript-cups-9.07.tar.xz diff --git a/SOURCES/CIDFnmap b/SOURCES/CIDFnmap deleted file mode 100644 index 2f3d7b7..0000000 --- a/SOURCES/CIDFnmap +++ /dev/null @@ -1,9 +0,0 @@ -%! -% following lines are for CJK fonts. -(CIDFnmap.ja) .runlibfileifexists -(CIDFnmap.ko) .runlibfileifexists -(CIDFnmap.zh_CN) .runlibfileifexists -(CIDFnmap.zh_TW) .runlibfileifexists -% must be at the bottom of line to allow people overriding everything. -(CIDFnmap.local) .runlibfileifexists - diff --git a/SOURCES/cidfmap b/SOURCES/cidfmap deleted file mode 100644 index 18c1786..0000000 --- a/SOURCES/cidfmap +++ /dev/null @@ -1,10 +0,0 @@ -%! -% Don't change following line. We should ensure that the original one is surely loaded. -(cidfmap.GS) .runlibfile -% following lines are for CJK fonts. -(cidfmap.ja) .runlibfileifexists -(cidfmap.ko) .runlibfileifexists -(cidfmap.zh_CN) .runlibfileifexists -(cidfmap.zh_TW) .runlibfileifexists -% must be at the bottom of line to allow people overriding everything. -(cidfmap.local) .runlibfileifexists diff --git a/SOURCES/generate-tarball.sh b/SOURCES/generate-tarball.sh deleted file mode 100755 index 61f3f62..0000000 --- a/SOURCES/generate-tarball.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh - -VERSION=$1 - -rm -rf ghostscript-$VERSION -tar jxvf ghostscript-$VERSION.tar.bz2 -rm -r ghostscript-$VERSION/jpegxr -tar jcvf ghostscript-$VERSION-cleaned.tar.bz2 ghostscript-$VERSION diff --git a/SOURCES/ghostscript-9.23-100-run-dvipdf-securely.patch b/SOURCES/ghostscript-9.23-100-run-dvipdf-securely.patch new file mode 100644 index 0000000..80b0b7d --- /dev/null +++ b/SOURCES/ghostscript-9.23-100-run-dvipdf-securely.patch @@ -0,0 +1,22 @@ +From 91c9c6d17d445781ee572c281b8b9d75d96f9df8 Mon Sep 17 00:00:00 2001 +From: "David Kaspar [Dee'Kej]" +Date: Fri, 7 Oct 2016 13:57:01 +0200 +Subject: [PATCH] Make sure 'dvipdf' is being run securely + +--- + lib/dvipdf | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/dvipdf b/lib/dvipdf +index 802aeab..c92dfb0 100755 +--- a/lib/dvipdf ++++ b/lib/dvipdf +@@ -43,4 +43,4 @@ fi + + # We have to include the options twice because -I only takes effect if it + # appears before other options. +-exec dvips -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite - ++exec dvips -R -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite - +-- +2.14.3 + diff --git a/SOURCES/ghostscript-9.25-101-reenable-cups-filters.patch b/SOURCES/ghostscript-9.25-101-reenable-cups-filters.patch new file mode 100644 index 0000000..b9c5c1e --- /dev/null +++ b/SOURCES/ghostscript-9.25-101-reenable-cups-filters.patch @@ -0,0 +1,54 @@ +From 9a6564bc1a2f2eeaf9faffd4d3b0a5a562855123 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Tue, 9 Oct 2018 15:42:09 +0200 +Subject: [PATCH] Fix to re-enable CUPS filters creation (needed for + ghostscript-cups) + +--- + Makefile.in | 2 ++ + configure.ac | 9 +++++++++ + 2 files changed, 11 insertions(+) + +diff --git a/Makefile.in b/Makefile.in +index d6f114a..bdf0ae7 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -351,6 +351,8 @@ CUPSSERVERROOT=@CUPSSERVERROOT@ + CUPSDATA=@CUPSDATA@ + CUPSPDFTORASTER=@CUPSPDFTORASTER@ + ++CUPSINSTTARGET=@CUPSINSTALL@ ++ + SHARE_LCUPS=@SHARELCUPS@ + LCUPS_NAME=cups + LCUPSSRCDIR=@CUPS_DIR@ +diff --git a/configure.ac b/configure.ac +index 8ecaccc..d063c1f 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1400,6 +1400,10 @@ AC_ARG_WITH([local-cups], AC_HELP_STRING([--with-local-cups], + [Force using the GS supplied cups code - only useful for debugging]), + [with_local_cups=yes], [with_local_cups=no]) + ++AC_ARG_WITH([install-cups], AC_HELP_STRING([--with-install-cups], ++ [Install the cups conversion tools]), ++ [CUPSINSTALL=install-cups], [CUPSINSTALL=]) ++ + AC_ARG_WITH([cups-serverbin], AC_HELP_STRING([--with-cups-serverbin], + [override the "cups-config --serverbin" path]), CUPS_SERVERBIN="$withval", CUPS_SERVERBIN="") + +@@ -3029,6 +3033,11 @@ if test x"$THEMAKEFILE" != x"$MAKEFILE" && test x"$CCAUX" = x"$CC"; then + CONFIG_FILES_LIST="$CONFIG_FILES_LIST" + fi + ++if ( test -d cups ); then ++AC_OUTPUT(cups/gstopxl) ++chmod +x cups/gstopxl ++fi ++ + if test "x$AFS" = "x1"; then + AC_MSG_WARN([Using "native" font scaler which is now deprecated (rather than freetype),]) + AC_MSG_WARN([Support for this will be removed in a future release]) +-- +2.14.4 + diff --git a/SOURCES/ghostscript-Fontmap.local.patch b/SOURCES/ghostscript-Fontmap.local.patch deleted file mode 100644 index 3d1fee2..0000000 --- a/SOURCES/ghostscript-Fontmap.local.patch +++ /dev/null @@ -1,9 +0,0 @@ -diff -up ghostscript-8.71/Resource/Init/Fontmap.Fontmap.local ghostscript-8.71/Resource/Init/Fontmap ---- ghostscript-8.71/Resource/Init/Fontmap.Fontmap.local 2008-08-08 05:22:38.000000000 +0100 -+++ ghostscript-8.71/Resource/Init/Fontmap 2010-09-03 11:53:47.273865979 +0100 -@@ -2,3 +2,5 @@ - % See Fontmap.GS for the syntax of real Fontmap files. - %% Replace 1 (Fontmap.GS) - (Fontmap.GS) .runlibfile -+% must be at the bottom of line to allow people overriding everything. -+(Fontmap.local) .runlibfileifexists diff --git a/SOURCES/ghostscript-check-icc-profile-errors.patch b/SOURCES/ghostscript-check-icc-profile-errors.patch deleted file mode 100644 index e4f54ee..0000000 --- a/SOURCES/ghostscript-check-icc-profile-errors.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 8d65c0854c049e4c0c8e08006b595ad40a59e696 Mon Sep 17 00:00:00 2001 -From: Robin Watts -Date: Thu, 28 Mar 2013 21:12:18 +0000 -Subject: [PATCH] Another memory squeeze fix. - -Avoid SEGV in gsicc_alloc_link_entry and callers. ---- - base/gsicc_cache.c | 17 +++++++++++------ - base/gsicc_manage.c | 6 ++++-- - base/gsicc_nocm.c | 3 +++ - base/gsicc_replacecm.c | 3 +++ - 4 files changed, 21 insertions(+), 8 deletions(-) - -diff --git a/base/gsicc_cache.c b/base/gsicc_cache.c -index 616db4c..65b2dd0 100644 ---- a/base/gsicc_cache.c -+++ b/base/gsicc_cache.c -@@ -659,12 +659,14 @@ gsicc_alloc_link_entry(gsicc_link_cache_t *icc_link_cache, - /* insert an empty link that we will reserve so we */ - /* can unlock while building the link contents */ - (*ret_link) = gsicc_alloc_link(cache_mem->stable_memory, hash); -- (*ret_link)->icc_link_cache = icc_link_cache; -- (*ret_link)->next = icc_link_cache->head; -- icc_link_cache->head = *ret_link; -- icc_link_cache->num_links++; -- /* now that we own this link we can release -- the lock since it is not valid */ -+ if (*ret_link) { -+ (*ret_link)->icc_link_cache = icc_link_cache; -+ (*ret_link)->next = icc_link_cache->head; -+ icc_link_cache->head = *ret_link; -+ icc_link_cache->num_links++; -+ /* now that we own this link we can release -+ the lock since it is not valid */ -+ } - gx_monitor_leave(icc_link_cache->lock); - return false; - } -@@ -794,6 +796,9 @@ gsicc_get_link_profile(const gs_imager_state *pis, gx_device *dev, - if (gsicc_alloc_link_entry(icc_link_cache, &link, hash, include_softproof, - include_devicelink)) - return link; -+ if (link == NULL) -+ return NULL; -+ - /* Now compute the link contents */ - cms_input_profile = gs_input_profile->profile_handle; - if (cms_input_profile == NULL) { -diff --git a/base/gsicc_manage.c b/base/gsicc_manage.c -index e0e7d93..210be59 100644 ---- a/base/gsicc_manage.c -+++ b/base/gsicc_manage.c -@@ -1521,8 +1521,8 @@ gsicc_set_device_profile(gx_device * pdev, gs_memory_t * mem, - icc_profile = - gsicc_profile_new(str, mem, file_name, strlen(file_name)); - code = sfclose(str); -- } -- if (str != NULL && icc_profile != NULL) { -+ if (icc_profile == NULL) -+ return_error(gs_error_VMerror); - if (pro_enum < gsPROOFPROFILE) { - if_debug1m(gs_debug_flag_icc, mem, - "[icc] Setting device profile %d\n", pro_enum); -@@ -1542,6 +1542,8 @@ gsicc_set_device_profile(gx_device * pdev, gs_memory_t * mem, - gsicc_get_profile_handle_buffer(icc_profile->buffer, - icc_profile->buffer_size, - mem); -+ if (icc_profile->profile_handle == NULL) -+ return_error(gs_error_unknownerror); - /* Compute the hash code of the profile. Everything in the - ICC manager will have it's hash code precomputed */ - gsicc_get_icc_buff_hash(icc_profile->buffer, -diff --git a/base/gsicc_nocm.c b/base/gsicc_nocm.c -index 8b2a353..bcc3138 100644 ---- a/base/gsicc_nocm.c -+++ b/base/gsicc_nocm.c -@@ -372,6 +372,9 @@ gsicc_nocm_get_link(const gs_imager_state *pis, gx_device *dev, - if (gsicc_alloc_link_entry(pis->icc_link_cache, &result, hash, false, false)) - return result; - -+ if (result == NULL) -+ return NULL; -+ - /* Now compute the link contents */ - result->procs.map_buffer = gsicc_nocm_transform_color_buffer; - result->procs.map_color = gsicc_nocm_transform_color; -diff --git a/base/gsicc_replacecm.c b/base/gsicc_replacecm.c -index 1a7c9e6..d1ab5ea 100644 ---- a/base/gsicc_replacecm.c -+++ b/base/gsicc_replacecm.c -@@ -330,6 +330,9 @@ gsicc_rcm_get_link(const gs_imager_state *pis, gx_device *dev, - if (gsicc_alloc_link_entry(pis->icc_link_cache, &result, hash, false, false)) - return result; - -+ if (result == NULL) -+ return result; -+ - /* Now compute the link contents */ - result->procs.map_buffer = gsicc_rcm_transform_color_buffer; - result->procs.map_color = gsicc_rcm_transform_color; --- -2.5.5 - diff --git a/SOURCES/ghostscript-cope-with-negative-run-length.patch b/SOURCES/ghostscript-cope-with-negative-run-length.patch deleted file mode 100644 index 209a7c2..0000000 --- a/SOURCES/ghostscript-cope-with-negative-run-length.patch +++ /dev/null @@ -1,70 +0,0 @@ -From ab4d21b69bf0717ac93072d24b076681bdb9b3a4 Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Wed, 19 Jun 2013 16:25:17 +0100 -Subject: [PATCH] Bug 693934: CCITT Fax decode - cope with negative run length - -In various places in the fax decode code we coped with the run length being -negative - in just a few we didn't. - -We'll now cope gracefully with negative run lengths in places. - -No cluster differences. ---- - base/scfd.c | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/base/scfd.c b/base/scfd.c -index 970c925..5f7f798 100644 ---- a/base/scfd.c -+++ b/base/scfd.c -@@ -611,6 +611,7 @@ v0: skip_bits(1); - rlen, "[w2]", d2l, out0); - /* rlen may be run2_pass, run_uncompressed, or */ - /* 0..countof(cf2_run_vertical)-1. */ -+rlen_lt_zero: - if (rlen < 0) - switch (rlen) { - case run2_pass: -@@ -726,6 +727,9 @@ v0: skip_bits(1); - status = ERRC; - goto out; - } -+ -+ if (rlen < 0) goto rlen_lt_zero; -+ - skip_data(rlen, hww); - /* Handle the second half of a white-black horizontal code. */ - hwb:get_run(cf_black_decode, cfd_black_initial_bits, cfd_black_min_bits, -@@ -734,6 +738,9 @@ v0: skip_bits(1); - status = ERRC; - goto out; - } -+ -+ if (rlen < 0) goto rlen_lt_zero; -+ - invert_data(rlen, black_byte, goto hwb, ihwb); - goto top; - outww:ss->run_color = -2; -@@ -747,6 +754,9 @@ v0: skip_bits(1); - status = ERRC; - goto out; - } -+ -+ if (rlen < 0) goto rlen_lt_zero; -+ - invert_data(rlen, black_byte, goto hbb, ihbb); - /* Handle the second half of a black-white horizontal code. */ - hbw:get_run(cf_white_decode, cfd_white_initial_bits, cfd_white_min_bits, -@@ -755,6 +765,9 @@ v0: skip_bits(1); - status = ERRC; - goto out; - } -+ -+ if (rlen < 0) goto rlen_lt_zero; -+ - skip_data(rlen, hbw); - goto top; - outbb:ss->run_color = 2; --- -2.9.4 - diff --git a/SOURCES/ghostscript-crash.patch b/SOURCES/ghostscript-crash.patch deleted file mode 100644 index 4cd24e8..0000000 --- a/SOURCES/ghostscript-crash.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -up ghostscript-9.10/psi/ialloc.c.crash ghostscript-9.10/psi/ialloc.c ---- ghostscript-9.10/psi/ialloc.c.crash 2013-08-30 11:37:28.000000000 +0100 -+++ ghostscript-9.10/psi/ialloc.c 2014-06-04 10:47:58.294526685 +0100 -@@ -160,6 +160,7 @@ gs_alloc_ref_array(gs_ref_memory_t * mem - uint num_refs, client_name_t cname) - { - ref *obj; -+ int i; - - /* If we're allocating a run of refs already, */ - /* and we aren't about to overflow the maximum run length, use it. */ -@@ -224,6 +225,9 @@ gs_alloc_ref_array(gs_ref_memory_t * mem - cp->where = (ref_packed *)obj; - } - } -+ for (i = 0; i < num_refs; i++) { -+ make_null(&(obj[i])); -+ } - make_array(parr, attrs | mem->space, num_refs, obj); - return 0; - } diff --git a/SOURCES/ghostscript-cups-colord.patch b/SOURCES/ghostscript-cups-colord.patch deleted file mode 100644 index 9d3f4e0..0000000 --- a/SOURCES/ghostscript-cups-colord.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff -up ghostscript-9.07/cups/gstoraster.c.cups-colord ghostscript-9.07/cups/gstoraster.c ---- ghostscript-9.07/cups/gstoraster.c.cups-colord 2013-07-01 17:06:10.977743028 +0100 -+++ ghostscript-9.07/cups/gstoraster.c 2013-07-01 17:18:36.597852666 +0100 -@@ -596,11 +596,21 @@ main (int argc, char **argv, char *envp[ - - qualifier = colord_get_qualifier_for_ppd (ppd); - if (qualifier != NULL) { -+ const char *env_printer = getenv("PRINTER"); -+ char *device_id; - -- fprintf(stderr, "DEBUG: PPD uses qualifier '%s.%s.%s'\n", -- qualifier[0], qualifier[1], qualifier[2]); -- icc_profile = colord_get_profile_for_device_id (getenv("PRINTER"), -- (const char**) qualifier); -+ if (env_printer) { -+ device_id = malloc (5 + strlen (env_printer) + 1); -+ if (device_id) { -+ strcpy (device_id, "cups-"); -+ strcpy (device_id + 5, env_printer); -+ fprintf(stderr, "DEBUG: PPD uses qualifier '%s.%s.%s'\n", -+ qualifier[0], qualifier[1], qualifier[2]); -+ icc_profile = colord_get_profile_for_device_id (device_id, -+ (const char**) qualifier); -+ free (device_id); -+ } -+ } - - /* fall back to the PPD */ - if (icc_profile == NULL) diff --git a/SOURCES/ghostscript-cups-filters.patch b/SOURCES/ghostscript-cups-filters.patch deleted file mode 100644 index ce82edd..0000000 --- a/SOURCES/ghostscript-cups-filters.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -up ghostscript-9.05/cups/cups.mak.cups-filters ghostscript-9.05/cups/cups.mak ---- ghostscript-9.05/cups/cups.mak.cups-filters 2012-02-08 08:48:50.000000000 +0000 -+++ ghostscript-9.05/cups/cups.mak 2012-02-09 11:42:22.211731587 +0000 -@@ -56,9 +56,9 @@ install-cups: cups - $(INSTALL_PROGRAM) $(GSTORASTER_XE) $(DESTDIR)$(CUPSSERVERBIN)/filter; \ - fi - $(INSTALL_PROGRAM) cups/gstopxl $(DESTDIR)$(CUPSSERVERBIN)/filter -- -mkdir -p $(DESTDIR)$(CUPSSERVERROOT) -+ -mkdir -p $(DESTDIR)$(CUPSDATA)/mime - if [ "$(CUPSPDFTORASTER)" = "1" ]; then \ -- $(INSTALL_DATA) cups/gstoraster.convs $(DESTDIR)$(CUPSSERVERROOT); \ -+ $(INSTALL_DATA) cups/gstoraster.convs $(DESTDIR)$(CUPSDATA)/mime; \ - fi - -mkdir -p $(DESTDIR)$(CUPSDATA)/model - $(INSTALL_DATA) cups/pxlcolor.ppd $(DESTDIR)$(CUPSDATA)/model diff --git a/SOURCES/ghostscript-cups-icc-profile.patch b/SOURCES/ghostscript-cups-icc-profile.patch deleted file mode 100644 index 5db5e38..0000000 --- a/SOURCES/ghostscript-cups-icc-profile.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 9e45d4a26eea12be326c5f515b44c7474a33f6c5 Mon Sep 17 00:00:00 2001 -From: Tim Waugh -Date: Tue, 12 Jul 2016 17:29:49 +0200 -Subject: [PATCH] Do not set device output ICC profile if the string is empty - ---- - cups/gstoraster.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cups/gstoraster.c b/cups/gstoraster.c -index 3ddc21f..8fe77a2 100644 ---- a/cups/gstoraster.c -+++ b/cups/gstoraster.c -@@ -665,7 +665,7 @@ main (int argc, char **argv, char *envp[]) - cupsArrayAdd(gs_args, strdup(tmpstr)); - - /* set the device output ICC profile */ -- if(icc_profile != NULL) { -+ if(icc_profile != NULL && icc_profile[0] != '\0') { - snprintf(tmpstr, sizeof(tmpstr), "-sOutputICCProfile=%s", icc_profile); - cupsArrayAdd(gs_args, strdup(tmpstr)); - } --- -2.5.5 - diff --git a/SOURCES/ghostscript-cve-2013-5653.patch b/SOURCES/ghostscript-cve-2013-5653.patch deleted file mode 100644 index affca36..0000000 --- a/SOURCES/ghostscript-cve-2013-5653.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 950c602dc2dbbcbf5a856e85dba99bc8ac8420b9 Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Sat, 5 Mar 2016 14:56:03 -0800 -Subject: [PATCH 1/1] Bug 694724: Have filenameforall and getenv honor SAFER - ---- - Resource/Init/gs_init.ps | 1 + - psi/zfile.c | 36 ++++++++++++++++++++---------------- - 2 files changed, 21 insertions(+), 16 deletions(-) - -diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps -index c3f567d..abb9489 100644 ---- a/Resource/Init/gs_init.ps -+++ b/Resource/Init/gs_init.ps -@@ -2019,6 +2019,7 @@ readonly def - /LockFilePermissions //true - >> setuserparams - } -+ systemdict /getenv {pop //false} put - if - % setpagedevice has the side effect of clearing the page, but - % we will just document that. Using setpagedevice keeps the device -diff --git a/psi/zfile.c b/psi/zfile.c -index 4011789..dd05919 100644 ---- a/psi/zfile.c -+++ b/psi/zfile.c -@@ -371,22 +371,26 @@ file_continue(i_ctx_t *i_ctx_p) - - if (len < devlen) - return_error(e_rangecheck); /* not even room for device len */ -- memcpy((char *)pscratch->value.bytes, iodev->dname, devlen); -- code = iodev->procs.enumerate_next(pfen, (char *)pscratch->value.bytes + devlen, -- len - devlen); -- if (code == ~(uint) 0) { /* all done */ -- esp -= 5; /* pop proc, pfen, devlen, iodev , mark */ -- return o_pop_estack; -- } else if (code > len) /* overran string */ -- return_error(e_rangecheck); -- else { -- push(1); -- ref_assign(op, pscratch); -- r_set_size(op, code + devlen); -- push_op_estack(file_continue); /* come again */ -- *++esp = pscratch[2]; /* proc */ -- return o_push_estack; -- } -+ -+ do { -+ memcpy((char *)pscratch->value.bytes, iodev->dname, devlen); -+ code = iodev->procs.enumerate_next(pfen, (char *)pscratch->value.bytes + devlen, -+ len - devlen); -+ if (code == ~(uint) 0) { /* all done */ -+ esp -= 5; /* pop proc, pfen, devlen, iodev , mark */ -+ return o_pop_estack; -+ } else if (code > len) /* overran string */ -+ return_error(gs_error_rangecheck); -+ else if (iodev != iodev_default(imemory) -+ || (check_file_permissions_reduced(i_ctx_p, (char *)pscratch->value.bytes, code + devlen, "PermitFileReading")) == 0) { -+ push(1); -+ ref_assign(op, pscratch); -+ r_set_size(op, code + devlen); -+ push_op_estack(file_continue); /* come again */ -+ *++esp = pscratch[2]; /* proc */ -+ return o_push_estack; -+ } -+ } while(1); - } - /* Cleanup procedure for enumerating files */ - static int --- -2.7.4 - diff --git a/SOURCES/ghostscript-cve-2016-7977.patch b/SOURCES/ghostscript-cve-2016-7977.patch deleted file mode 100644 index 43a0cae..0000000 --- a/SOURCES/ghostscript-cve-2016-7977.patch +++ /dev/null @@ -1,28 +0,0 @@ -From bd7fcaf389a56179281324d8c7b90e90bb3ee4ac Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Mon, 3 Oct 2016 01:46:28 +0100 -Subject: [PATCH] Bug 697169: Be rigorous with SAFER permissions - -Once we've opened our input file from the command line, enforce the SAFER -rules. ---- - psi/zfile.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/psi/zfile.c b/psi/zfile.c -index dd05919..2f13259 100644 ---- a/psi/zfile.c -+++ b/psi/zfile.c -@@ -1002,6 +1002,9 @@ lib_file_open(gs_file_path_ptr lib_path, const gs_memory_t *mem, i_ctx_t *i_ctx - gs_main_instance *minst = get_minst_from_memory(mem); - int code; - -+ if (i_ctx_p && starting_arg_file) -+ i_ctx_p->starting_arg_file = false; -+ - /* when starting arg files (@ files) iodev_default is not yet set */ - if (iodev == 0) - iodev = (gx_io_device *)gx_io_device_table[0]; --- -2.7.4 - diff --git a/SOURCES/ghostscript-cve-2016-7978.patch b/SOURCES/ghostscript-cve-2016-7978.patch deleted file mode 100644 index c19cd8b..0000000 --- a/SOURCES/ghostscript-cve-2016-7978.patch +++ /dev/null @@ -1,25 +0,0 @@ -From fc3f0de2d6cd6f74ae94fc340e4d5fe8ac165314 Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Wed, 5 Oct 2016 09:59:25 +0100 -Subject: [PATCH] Bug 697179: Reference count device icc profile - -when copying a device ---- - base/gsdevice.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/base/gsdevice.c b/base/gsdevice.c -index 37fcc7e..b52581c 100644 ---- a/base/gsdevice.c -+++ b/base/gsdevice.c -@@ -536,6 +536,7 @@ gx_device_init(gx_device * dev, const gx_device * proto, gs_memory_t * mem, - dev->memory = mem; - dev->retained = !internal; - rc_init(dev, mem, (internal ? 0 : 1)); -+ rc_increment(dev->icc_struct); - } - - void --- -2.7.4 - diff --git a/SOURCES/ghostscript-cve-2016-7979.patch b/SOURCES/ghostscript-cve-2016-7979.patch deleted file mode 100644 index 33d0404..0000000 --- a/SOURCES/ghostscript-cve-2016-7979.patch +++ /dev/null @@ -1,43 +0,0 @@ -From b80fc8cd2469fcdab0630cd507f42b410bb96fda Mon Sep 17 00:00:00 2001 -From: Ken Sharp -Date: Wed, 5 Oct 2016 10:10:58 +0100 -Subject: [PATCH] DSC parser - validate parameters - -Bug #697190 ".initialize_dsc_parser doesn't validate the parameter is a dict type before using it." - -Regardless of any security implications, its simply wrong for a PostScript -operator not to validate its parameter(s). - -No differences expected. ---- - psi/zdscpars.c | 13 +++++++++---- - 1 file changed, 9 insertions(+), 4 deletions(-) - -diff --git a/psi/zdscpars.c b/psi/zdscpars.c -index a6f8fc9..fa61d88 100644 ---- a/psi/zdscpars.c -+++ b/psi/zdscpars.c -@@ -132,11 +132,16 @@ zinitialize_dsc_parser(i_ctx_t *i_ctx_p) - ref local_ref; - int code; - os_ptr const op = osp; -- dict * const pdict = op->value.pdict; -- gs_memory_t * const mem = (gs_memory_t *)dict_memory(pdict); -- dsc_data_t * const data = -- gs_alloc_struct(mem, dsc_data_t, &st_dsc_data_t, "DSC parser init"); -+ dict *pdict; -+ gs_memory_t *mem; -+ dsc_data_t *data; - -+ check_read_type(*op, t_dictionary); -+ -+ pdict = op->value.pdict; -+ mem = (gs_memory_t *)dict_memory(pdict); -+ -+ data = gs_alloc_struct(mem, dsc_data_t, &st_dsc_data_t, "DSC parser init"); - if (!data) - return_error(e_VMerror); - data->document_level = 0; --- -2.7.4 - diff --git a/SOURCES/ghostscript-cve-2016-8602.patch b/SOURCES/ghostscript-cve-2016-8602.patch deleted file mode 100644 index 91785dc..0000000 --- a/SOURCES/ghostscript-cve-2016-8602.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 30d5e341367002ca5b853b6b651f63e97ba580d1 Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Sat, 8 Oct 2016 16:10:27 +0100 -Subject: [PATCH] Bug 697203: check for sufficient params in .sethalftone5 - -and param types ---- - base/gserrors.h | 1 + - psi/zht2.c | 12 ++++++++++-- - 2 files changed, 11 insertions(+), 2 deletions(-) - -diff --git a/base/gserrors.h b/base/gserrors.h -index 24b5eb4..c7dbe18 100644 ---- a/base/gserrors.h -+++ b/base/gserrors.h -@@ -33,6 +33,7 @@ - #define gs_error_limitcheck (-13) - #define gs_error_nocurrentpoint (-14) - #define gs_error_rangecheck (-15) -+#define gs_error_stackunderflow (-17) - #define gs_error_typecheck (-20) - #define gs_error_undefined (-21) - #define gs_error_undefinedfilename (-22) -diff --git a/psi/zht2.c b/psi/zht2.c -index a53b71b..95fef4b 100644 ---- a/psi/zht2.c -+++ b/psi/zht2.c -@@ -81,14 +81,22 @@ zsethalftone5(i_ctx_t *i_ctx_p) - gs_memory_t *mem; - uint edepth = ref_stack_count(&e_stack); - int npop = 2; -- int dict_enum = dict_first(op); -+ int dict_enum; - ref rvalue[2]; - int cname, colorant_number; - byte * pname; - uint name_size; - int halftonetype, type = 0; - gs_state *pgs = igs; -- int space_index = r_space_index(op - 1); -+ int space_index; -+ -+ if (ref_stack_count(&o_stack) < 2) -+ return_error(gs_error_stackunderflow); -+ check_type(*op, t_dictionary); -+ check_type(*(op - 1), t_dictionary); -+ -+ dict_enum = dict_first(op); -+ space_index = r_space_index(op - 1); - - mem = (gs_memory_t *) idmemory->spaces_indexed[space_index]; - --- -2.7.4 - diff --git a/SOURCES/ghostscript-cve-2017-7207.patch b/SOURCES/ghostscript-cve-2017-7207.patch deleted file mode 100644 index ebe83fe..0000000 --- a/SOURCES/ghostscript-cve-2017-7207.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 309eca4e0a31ea70dcc844812691439312dad091 Mon Sep 17 00:00:00 2001 -From: Ken Sharp -Date: Mon, 20 Mar 2017 09:34:11 +0000 -Subject: [PATCH] Ensure a device has raster memory, before trying to read it. - -Bug #697676 "Null pointer dereference in mem_get_bits_rectangle()" - -This is only possible by abusing/mis-using Ghostscript-specific -language extensions, so cannot happen in a general PostScript program. - -Nevertheless, Ghostscript should not crash. So this commit checks the -memory device to see if raster memory has been allocated, before trying -to read from it. ---- - base/gdevmem.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/base/gdevmem.c b/base/gdevmem.c -index afd05bd..d52d684 100644 ---- a/base/gdevmem.c -+++ b/base/gdevmem.c -@@ -606,6 +606,8 @@ mem_get_bits_rectangle(gx_device * dev, const gs_int_rect * prect, - GB_PACKING_CHUNKY | GB_COLORS_NATIVE | GB_ALPHA_NONE; - return_error(gs_error_rangecheck); - } -+ if (mdev->line_ptrs == 0x00) -+ return_error(gs_error_rangecheck); - if ((w <= 0) | (h <= 0)) { - if ((w | h) < 0) - return_error(gs_error_rangecheck); --- -2.9.3 - diff --git a/SOURCES/ghostscript-cve-2017-8291.patch b/SOURCES/ghostscript-cve-2017-8291.patch deleted file mode 100644 index 41289a3..0000000 --- a/SOURCES/ghostscript-cve-2017-8291.patch +++ /dev/null @@ -1,185 +0,0 @@ -From 3a0439ded9a206060f560bd6784942adeab759ff Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Thu, 27 Apr 2017 13:03:33 +0100 -Subject: [PATCH 1/4] Bug 697799: have .eqproc check its parameters - -The Ghostscript custom operator .eqproc was not check the number or type of -the parameters it was given. ---- - psi/zmisc3.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/psi/zmisc3.c b/psi/zmisc3.c -index 54b3042..0d357f1 100644 ---- a/psi/zmisc3.c -+++ b/psi/zmisc3.c -@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p) - ref2_t stack[MAX_DEPTH + 1]; - ref2_t *top = stack; - -+ if (ref_stack_count(&o_stack) < 2) -+ return_error(e_stackunderflow); -+ if (!r_is_array(op - 1) || !r_is_array(op)) { -+ return_error(e_typecheck); -+ } -+ - make_array(&stack[0].proc1, 0, 1, op - 1); - make_array(&stack[0].proc2, 0, 1, op); - for (;;) { --- -2.9.3 - - -From 9040e08c62422937c27fa5179657fbe3690809f3 Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Thu, 27 Apr 2017 13:21:31 +0100 -Subject: [PATCH 2/4] Bug 697799: have .rsdparams check its parameters - -The Ghostscript internal operator .rsdparams wasn't checking the number or -type of the operands it was being passed. Do so. ---- - psi/zfrsd.c | 22 +++++++++++++++------- - 1 file changed, 15 insertions(+), 7 deletions(-) - -diff --git a/psi/zfrsd.c b/psi/zfrsd.c -index fb4bce9..2629afa 100644 ---- a/psi/zfrsd.c -+++ b/psi/zfrsd.c -@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p) - ref *pFilter; - ref *pDecodeParms; - int Intent = 0; -- bool AsyncRead; -+ bool AsyncRead = false; - ref empty_array, filter1_array, parms1_array; - uint i; -- int code; -+ int code = 0; -+ -+ if (ref_stack_count(&o_stack) < 1) -+ return_error(e_stackunderflow); -+ if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) { -+ return_error(e_typecheck); -+ } - - make_empty_array(&empty_array, a_readonly); -- if (dict_find_string(op, "Filter", &pFilter) > 0) { -+ if (r_has_type(op, t_dictionary) -+ && dict_find_string(op, "Filter", &pFilter) > 0) { - if (!r_is_array(pFilter)) { - if (!r_has_type(pFilter, t_name)) - return_error(e_typecheck); -@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p) - return_error(e_typecheck); - } - } -- code = dict_int_param(op, "Intent", 0, 3, 0, &Intent); -+ if (r_has_type(op, t_dictionary)) -+ code = dict_int_param(op, "Intent", 0, 3, 0, &Intent); - if (code < 0 && code != e_rangecheck) /* out-of-range int is ok, use 0 */ - return code; -- if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0 -- ) -- return code; -+ if (r_has_type(op, t_dictionary)) -+ if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0) -+ return code; - push(1); - op[-1] = *pFilter; - if (pDecodeParms) --- -2.9.3 - - -From ba6c38c25e8c0ece91c47d96578f3f7a0e6c4e6c Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Wed, 3 May 2017 12:05:45 +0100 -Subject: [PATCH 3/4] Bug 697846: revision to commit 4f83478c88 (.eqproc) - -When using the "DELAYBIND" feature, it turns out that .eqproc can be called with -parameters that are not both procedures. In this case, it turns out, the -expectation is for the operator to return 'false', rather than throw an error. ---- - psi/zmisc3.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - -diff --git a/psi/zmisc3.c b/psi/zmisc3.c -index 0d357f1..9042908 100644 ---- a/psi/zmisc3.c -+++ b/psi/zmisc3.c -@@ -38,6 +38,15 @@ zcliprestore(i_ctx_t *i_ctx_p) - return gs_cliprestore(igs); - } - -+static inline bool -+eqproc_check_type(ref *r) -+{ -+ return r_has_type(r, t_array) -+ || r_has_type(r, t_mixedarray) -+ || r_has_type(r, t_shortarray) -+ || r_has_type(r, t_oparray); -+} -+ - /* .eqproc */ - /* - * Test whether two procedures are equal to depth 10. -@@ -58,8 +67,10 @@ zeqproc(i_ctx_t *i_ctx_p) - - if (ref_stack_count(&o_stack) < 2) - return_error(e_stackunderflow); -- if (!r_is_array(op - 1) || !r_is_array(op)) { -- return_error(e_typecheck); -+ if (!eqproc_check_type(op -1) || !eqproc_check_type(op)) { -+ make_false(op - 1); -+ pop(1); -+ return 0; - } - - make_array(&stack[0].proc1, 0, 1, op - 1); --- -2.9.3 - - -From ae3fdbd05b0e654273402e7391288a091a1c0a9e Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Thu, 11 May 2017 14:07:48 +0100 -Subject: [PATCH 4/4] Bug 697892: fix check for op stack underflow. - -In the original fix, I used the wrong method to check for stack underflow, this -is using the correct method. ---- - psi/zfrsd.c | 3 +-- - psi/zmisc3.c | 3 +-- - 2 files changed, 2 insertions(+), 4 deletions(-) - -diff --git a/psi/zfrsd.c b/psi/zfrsd.c -index 2629afa..fd9872e 100644 ---- a/psi/zfrsd.c -+++ b/psi/zfrsd.c -@@ -54,8 +54,7 @@ zrsdparams(i_ctx_t *i_ctx_p) - uint i; - int code = 0; - -- if (ref_stack_count(&o_stack) < 1) -- return_error(e_stackunderflow); -+ check_op(1); - if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) { - return_error(e_typecheck); - } -diff --git a/psi/zmisc3.c b/psi/zmisc3.c -index 9042908..43803b5 100644 ---- a/psi/zmisc3.c -+++ b/psi/zmisc3.c -@@ -65,8 +65,7 @@ zeqproc(i_ctx_t *i_ctx_p) - ref2_t stack[MAX_DEPTH + 1]; - ref2_t *top = stack; - -- if (ref_stack_count(&o_stack) < 2) -- return_error(e_stackunderflow); -+ check_op(2); - if (!eqproc_check_type(op -1) || !eqproc_check_type(op)) { - make_false(op - 1); - pop(1); --- -2.9.3 - diff --git a/SOURCES/ghostscript-cve-2018-10194.patch b/SOURCES/ghostscript-cve-2018-10194.patch deleted file mode 100644 index 88c6604..0000000 --- a/SOURCES/ghostscript-cve-2018-10194.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 544b68a3436e72f138e283af26b168ac46dda4c5 Mon Sep 17 00:00:00 2001 -From: Ken Sharp -Date: Wed, 18 Apr 2018 15:46:32 +0100 -Subject: [PATCH] pdfwrite - Guard against trying to output an infinite number - -Bug #699255 " Buffer overflow on pprintg1 due to mishandle postscript file data to pdf" - -The file uses an enormous parameter to xyxhow, causing an overflow in -the calculation of text positioning (value > 1e39). - -Since this is basically a nonsense value, and PostScript only supports -real values up to 1e38, this patch follows the same approach as for -a degenerate CTM, and treats it as 0. - -Adobe Acrobat Distiller throws a limitcheck error, so we could do that -instead if this approach proves to be a problem. ---- - base/gdevpdts.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/base/gdevpdts.c b/base/gdevpdts.c -index f9321a3..fff6c17 100644 ---- a/base/gdevpdts.c -+++ b/base/gdevpdts.c -@@ -152,9 +152,14 @@ append_text_move(pdf_text_state_t *pts, floatp dw) - static int - set_text_distance(gs_point *pdist, floatp dx, floatp dy, const gs_matrix *pmat) - { -- int code = gs_distance_transform_inverse(dx, dy, pmat, pdist); -+ int code; - double rounded; - -+ if (dx > 1e38 || dy > 1e38) -+ code = gs_error_undefinedresult; -+ else -+ code = gs_distance_transform_inverse(dx, dy, pmat, pdist); -+ - if (code == gs_error_undefinedresult) { - /* The CTM is degenerate. - Can't know the distance in user space. --- -2.14.3 - diff --git a/SOURCES/ghostscript-cve-2018-15908.patch b/SOURCES/ghostscript-cve-2018-15908.patch deleted file mode 100644 index 1a9849c..0000000 --- a/SOURCES/ghostscript-cve-2018-15908.patch +++ /dev/null @@ -1,155 +0,0 @@ -From: Chris Liddell -Date: Tue, 21 Aug 2018 19:17:05 +0000 (+0100) -Subject: Bug 699657: properly apply file permissions to .tempfile - -Bug 699657: properly apply file permissions to .tempfile - -https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0d3901189f245232f0161addf215d7268c4d05a3 ---- - -diff -up a/psi/zfile.c.cve-2018-15908 b/psi/zfile.c ---- a/psi/zfile.c.cve-2018-15908 2018-11-14 15:13:31.249625819 +0100 -+++ b/psi/zfile.c 2018-11-14 15:14:16.933831779 +0100 -@@ -121,7 +121,7 @@ make_invalid_file(i_ctx_t *i_ctx_p, ref - /* strings of the permitgroup array. */ - static int - check_file_permissions_reduced(i_ctx_t *i_ctx_p, const char *fname, int len, -- const char *permitgroup) -+ gx_io_device *iodev, const char *permitgroup) - { - long i; - ref *permitlist = NULL; -@@ -131,8 +131,14 @@ check_file_permissions_reduced(i_ctx_t * - bool use_windows_pathsep = (gs_file_name_check_separator(win_sep2, 1, win_sep2) == 1); - uint plen = gp_file_name_parents(fname, len); - -- /* Assuming a reduced file name. */ -+ /* we're protecting arbitrary file system accesses, not Postscript device accesses. -+ * Although, note that %pipe% is explicitly checked for and disallowed elsewhere -+ */ -+ if (iodev && iodev != iodev_default(imemory)) { -+ return 0; -+ } - -+ /* Assuming a reduced file name. */ - if (dict_find_string(&(i_ctx_p->userparams), permitgroup, &permitlist) <= 0) - return 0; /* if Permissions not found, just allow access */ - -@@ -187,14 +193,14 @@ check_file_permissions_reduced(i_ctx_t * - /* strings of the permitgroup array */ - static int - check_file_permissions(i_ctx_t *i_ctx_p, const char *fname, int len, -- const char *permitgroup) -+ gx_io_device *iodev, const char *permitgroup) - { - char fname_reduced[gp_file_name_sizeof]; - uint rlen = sizeof(fname_reduced); - - if (gp_file_name_reduce(fname, len, fname_reduced, &rlen) != gp_combine_success) - return e_invalidaccess; /* fail if we couldn't reduce */ -- return check_file_permissions_reduced(i_ctx_p, fname_reduced, rlen, permitgroup); -+ return check_file_permissions_reduced(i_ctx_p, fname_reduced, rlen, iodev, permitgroup); - } - - /* file */ -@@ -298,7 +304,7 @@ zdeletefile(i_ctx_t *i_ctx_p) - return code; - if (pname.iodev == iodev_default(imemory)) { - if ((code = check_file_permissions(i_ctx_p, pname.fname, pname.len, -- "PermitFileControl")) < 0 && -+ pname.iodev, "PermitFileControl")) < 0 && - !file_is_tempfile(i_ctx_p, op->value.bytes, r_size(op))) { - return code; - } -@@ -382,7 +388,7 @@ file_continue(i_ctx_t *i_ctx_p) - } else if (code > len) /* overran string */ - return_error(gs_error_rangecheck); - else if (iodev != iodev_default(imemory) -- || (check_file_permissions_reduced(i_ctx_p, (char *)pscratch->value.bytes, code + devlen, "PermitFileReading")) == 0) { -+ || (check_file_permissions_reduced(i_ctx_p, (char *)pscratch->value.bytes, code + devlen, NULL, "PermitFileReading")) == 0) { - push(1); - ref_assign(op, pscratch); - r_set_size(op, code + devlen); -@@ -432,12 +438,12 @@ zrenamefile(i_ctx_t *i_ctx_p) - * and FileWriting permissions to the destination file/path. - */ - ((check_file_permissions(i_ctx_p, pname1.fname, pname1.len, -- "PermitFileControl") < 0 && -+ pname1.iodev, "PermitFileControl") < 0 && - !file_is_tempfile(i_ctx_p, op[-1].value.bytes, r_size(op - 1))) || - (check_file_permissions(i_ctx_p, pname2.fname, pname2.len, -- "PermitFileControl") < 0 || -+ pname2.iodev, "PermitFileControl") < 0 || - check_file_permissions(i_ctx_p, pname2.fname, pname2.len, -- "PermitFileWriting") < 0 )))) { -+ pname2.iodev, "PermitFileWriting") < 0 )))) { - code = gs_note_error(e_invalidfileaccess); - } else { - code = (*pname1.iodev->procs.rename_file)(pname1.iodev, -@@ -484,8 +490,11 @@ zstatus(i_ctx_t *i_ctx_p) - code = gs_terminate_file_name(&pname, imemory, "status"); - if (code < 0) - return code; -- code = (*pname.iodev->procs.file_status)(pname.iodev, -+ if ((code = check_file_permissions(i_ctx_p, pname.fname, pname.len, -+ pname.iodev, "PermitFileReading")) >= 0) { -+ code = (*pname.iodev->procs.file_status)(pname.iodev, - pname.fname, &fstat); -+ } - switch (code) { - case 0: - check_ostack(4); -@@ -694,8 +703,24 @@ ztempfile(i_ctx_t *i_ctx_p) - } - - if (gp_file_name_is_absolute(pstr, strlen(pstr))) { -- if (check_file_permissions(i_ctx_p, pstr, strlen(pstr), -- "PermitFileWriting") < 0) { -+ int plen = strlen(pstr); -+ const char *sep = gp_file_name_separator(); -+#ifdef DEBUG -+ int seplen = strlen(sep); -+ if (seplen != 1) -+ return_error(gs_error_Fatal); -+#endif -+ /* strip off the file name prefix, leave just the directory name -+ * so we can check if we are allowed to write to it -+ */ -+ for ( ; plen >=0; plen--) { -+ if (pstr[plen] == sep[0]) -+ break; -+ } -+ memcpy(fname, pstr, plen); -+ fname[plen] = '\0'; -+ if (check_file_permissions(i_ctx_p, fname, strlen(fname), -+ NULL, "PermitFileWriting") < 0) { - return_error(e_invalidfileaccess); - } - } else if (!prefix_is_simple(pstr)) { -@@ -837,6 +862,7 @@ zopen_file(i_ctx_t *i_ctx_p, const gs_pa - const char *file_access, stream **ps, gs_memory_t *mem) - { - gx_io_device *const iodev = pfn->iodev; -+ int code = 0; - - if (pfn->fname == NULL) /* just a device */ - return iodev->procs.open_device(iodev, file_access, ps, mem); -@@ -847,7 +873,7 @@ zopen_file(i_ctx_t *i_ctx_p, const gs_pa - open_file = iodev_os_open_file; - /* Check OS files to make sure we allow the type of access */ - if (open_file == iodev_os_open_file) { -- int code = check_file_permissions(i_ctx_p, pfn->fname, pfn->len, -+ code = check_file_permissions(i_ctx_p, pfn->fname, pfn->len, pfn->iodev, - file_access[0] == 'r' ? "PermitFileReading" : "PermitFileWriting"); - - if (code < 0 && !file_is_tempfile(i_ctx_p, -@@ -894,7 +920,7 @@ check_file_permissions_aux(i_ctx_t *i_ct - /* fname must be reduced. */ - if (i_ctx_p == NULL) - return 0; -- if (check_file_permissions_reduced(i_ctx_p, fname, flen, "PermitFileReading") < 0) -+ if (check_file_permissions_reduced(i_ctx_p, fname, flen, NULL, "PermitFileReading") < 0) - return_error(e_invalidfileaccess); - return 0; - } - \ No newline at end of file diff --git a/SOURCES/ghostscript-cve-2018-15909.patch b/SOURCES/ghostscript-cve-2018-15909.patch deleted file mode 100644 index 372e663..0000000 --- a/SOURCES/ghostscript-cve-2018-15909.patch +++ /dev/null @@ -1,93 +0,0 @@ -From: Ken Sharp -Date: Thu, 23 Aug 2018 13:12:48 +0000 (+0100) -Subject: Fix Bug 699660 "shading_param incomplete type checking" - -Fix Bug 699660 "shading_param incomplete type checking" - -Its possible to pass a t_struct parameter to .shfill which is not a -shading function built by .buildshading. This could then lead to memory -corruption or a segmentation fault by treating the object passed in -as if it were a shading. - -Its non-trivial to check the t_struct, because this function can take -7 different kinds of structures as a parameter. Checking these is -possible, of course, but would add a performance penalty. - -However, we can note that we never call .shfill without first calling -.buildshading, and we never call .buildshading without immediately -calling .shfill. So we can treat these as an atomic operation. The -.buildshading function takes all its parameters as PostScript objects -and validates them, so that should be safe. - -This allows us to 'hide' the .shfill operator preventing the possibility -of passing an invalid parameter. - -https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0b6cd1918e1ec4ffd087400a754a845180a4522b - -From: Ken Sharp -Date: Fri, 24 Aug 2018 11:44:26 +0000 (+0100) -Subject: Hide the .shfill operator - -Hide the .shfill operator - -Commit 0b6cd1918e1ec4ffd087400a754a845180a4522b was supposed to make -the .shfill operator unobtainable, but I accidentally left a comment -in the line doing so. - -Fix it here, without this the operator can still be exploited. - -https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6 ---- - -diff -up ghostscript-9.07/Resource/Init/gs_init.ps.cve-2018-15909 ghostscript-9.07/Resource/Init/gs_init.ps ---- ghostscript-9.07/Resource/Init/gs_init.ps.cve-2018-15909 2018-12-10 11:23:36.732179705 +0100 -+++ ghostscript-9.07/Resource/Init/gs_init.ps 2018-12-10 11:23:36.738179607 +0100 -@@ -2136,8 +2136,8 @@ SAFER { .setsafe } if - /.getiodevice /.getdevparms /.putdevparams /.bbox_transform /.matchmedia /.matchpagesize /.defaultpapersize - /.oserrno /.setoserrno /.oserrorstring /.getCPSImode - /.getscanconverter /.setscanconverter /.type1encrypt /.type1decrypt/.languagelevel /.setlanguagelevel /.eqproc /.fillpage /.buildpattern1 /.saslprep --/.buildshading1 /.buildshadin2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern --/.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring -+/.buildshading1 /.buildshading2 /.buildshading3 /.buildshading4 /.buildshading5 /.buildshading6 /.buildshading7 /.buildshadingpattern -+/.shfill /.argindex /.bytestring /.namestring /.stringbreak /.stringmatch /.globalvmarray /.globalvmdict /.globalvmpackedarray /.globalvmstring - /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile - /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams - /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath -diff -up ghostscript-9.07/Resource/Init/gs_ll3.ps.cve-2018-15909 ghostscript-9.07/Resource/Init/gs_ll3.ps ---- ghostscript-9.07/Resource/Init/gs_ll3.ps.cve-2018-15909 2013-02-14 08:58:16.000000000 +0100 -+++ ghostscript-9.07/Resource/Init/gs_ll3.ps 2018-12-10 11:23:36.739179591 +0100 -@@ -406,6 +406,11 @@ systemdict /.reuseparamdict mark - /shfill .systemvar /undefined signalerror - } ifelse - } bind def -+ -+/.buildshading_and_shfill { -+ .buildshading .shfill -+} bind def -+ - systemdict /.reuseparamdict undef - - /.buildpattern2 { %