diff --git a/SOURCES/ghostscript-cve-2017-8291.patch b/SOURCES/ghostscript-cve-2017-8291.patch new file mode 100644 index 0000000..ec91360 --- /dev/null +++ b/SOURCES/ghostscript-cve-2017-8291.patch @@ -0,0 +1,183 @@ +From a8b6d9b56b2e17990aa2cce23022e9196e487154 Mon Sep 17 00:00:00 2001 +From: Chris Liddell +Date: Thu, 27 Apr 2017 13:03:33 +0100 +Subject: [PATCH 1/4] Bug 697799: have .eqproc check its parameters + +The Ghostscript custom operator .eqproc was not check the number or type of +the parameters it was given. +--- + psi/zmisc3.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/psi/zmisc3.c b/psi/zmisc3.c +index 54b3042..0d357f1 100644 +--- a/psi/zmisc3.c ++++ b/psi/zmisc3.c +@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p) + ref2_t stack[MAX_DEPTH + 1]; + ref2_t *top = stack; + ++ if (ref_stack_count(&o_stack) < 2) ++ return_error(e_stackunderflow); ++ if (!r_is_array(op - 1) || !r_is_array(op)) { ++ return_error(e_typecheck); ++ } ++ + make_array(&stack[0].proc1, 0, 1, op - 1); + make_array(&stack[0].proc2, 0, 1, op); + for (;;) { +-- +2.9.3 + + +From d316ce788996a2cb2a1a6210bebb1000b8744a20 Mon Sep 17 00:00:00 2001 +From: Chris Liddell +Date: Thu, 27 Apr 2017 13:21:31 +0100 +Subject: [PATCH 2/4] Bug 697799: have .rsdparams check its parameters + +The Ghostscript internal operator .rsdparams wasn't checking the number or +type of the operands it was being passed. Do so. +--- + psi/zfrsd.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/psi/zfrsd.c b/psi/zfrsd.c +index fb4bce9..2629afa 100644 +--- a/psi/zfrsd.c ++++ b/psi/zfrsd.c +@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p) + ref *pFilter; + ref *pDecodeParms; + int Intent = 0; +- bool AsyncRead; ++ bool AsyncRead = false; + ref empty_array, filter1_array, parms1_array; + uint i; +- int code; ++ int code = 0; ++ ++ if (ref_stack_count(&o_stack) < 1) ++ return_error(e_stackunderflow); ++ if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) { ++ return_error(e_typecheck); ++ } + + make_empty_array(&empty_array, a_readonly); +- if (dict_find_string(op, "Filter", &pFilter) > 0) { ++ if (r_has_type(op, t_dictionary) ++ && dict_find_string(op, "Filter", &pFilter) > 0) { + if (!r_is_array(pFilter)) { + if (!r_has_type(pFilter, t_name)) + return_error(e_typecheck); +@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p) + return_error(e_typecheck); + } + } +- code = dict_int_param(op, "Intent", 0, 3, 0, &Intent); ++ if (r_has_type(op, t_dictionary)) ++ code = dict_int_param(op, "Intent", 0, 3, 0, &Intent); + if (code < 0 && code != e_rangecheck) /* out-of-range int is ok, use 0 */ + return code; +- if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0 +- ) +- return code; ++ if (r_has_type(op, t_dictionary)) ++ if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0) ++ return code; + push(1); + op[-1] = *pFilter; + if (pDecodeParms) +-- +2.9.3 + + +From 3e1daaa70bd5ed08d7627494e7497457ad3fec99 Mon Sep 17 00:00:00 2001 +From: Chris Liddell +Date: Wed, 3 May 2017 12:05:45 +0100 +Subject: [PATCH 3/4] Bug 697846: revision to commit 4f83478c88 (.eqproc) + +When using the "DELAYBIND" feature, it turns out that .eqproc can be called with +parameters that are not both procedures. In this case, it turns out, the +expectation is for the operator to return 'false', rather than throw an error. +--- + psi/zmisc3.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/psi/zmisc3.c b/psi/zmisc3.c +index 0d357f1..9042908 100644 +--- a/psi/zmisc3.c ++++ b/psi/zmisc3.c +@@ -38,6 +38,15 @@ zcliprestore(i_ctx_t *i_ctx_p) + return gs_cliprestore(igs); + } + ++static inline bool ++eqproc_check_type(ref *r) ++{ ++ return r_has_type(r, t_array) ++ || r_has_type(r, t_mixedarray) ++ || r_has_type(r, t_shortarray) ++ || r_has_type(r, t_oparray); ++} ++ + /* .eqproc */ + /* + * Test whether two procedures are equal to depth 10. +@@ -58,8 +67,10 @@ zeqproc(i_ctx_t *i_ctx_p) + + if (ref_stack_count(&o_stack) < 2) + return_error(e_stackunderflow); +- if (!r_is_array(op - 1) || !r_is_array(op)) { +- return_error(e_typecheck); ++ if (!eqproc_check_type(op -1) || !eqproc_check_type(op)) { ++ make_false(op - 1); ++ pop(1); ++ return 0; + } + + make_array(&stack[0].proc1, 0, 1, op - 1); +-- +2.9.3 + + +From 46c6f168d42e1d3d7d5a514a69cdba572466c638 Mon Sep 17 00:00:00 2001 +From: Chris Liddell +Date: Thu, 11 May 2017 14:07:48 +0100 +Subject: [PATCH 4/4] Bug 697892: fix check for op stack underflow. + +In the original fix, I used the wrong method to check for stack underflow, this +is using the correct method. +--- + psi/zfrsd.c | 3 +-- + psi/zmisc3.c | 1 + + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/psi/zfrsd.c b/psi/zfrsd.c +index 2629afa..fd9872e 100644 +--- a/psi/zfrsd.c ++++ b/psi/zfrsd.c +@@ -54,8 +54,7 @@ zrsdparams(i_ctx_t *i_ctx_p) + uint i; + int code = 0; + +- if (ref_stack_count(&o_stack) < 1) +- return_error(e_stackunderflow); ++ check_op(1); + if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) { + return_error(e_typecheck); + } +diff --git a/psi/zmisc3.c b/psi/zmisc3.c +index 9042908..5d73d94 100644 +--- a/psi/zmisc3.c ++++ b/psi/zmisc3.c +@@ -67,6 +67,7 @@ zeqproc(i_ctx_t *i_ctx_p) + + if (ref_stack_count(&o_stack) < 2) + return_error(e_stackunderflow); ++ check_op(2); + if (!eqproc_check_type(op -1) || !eqproc_check_type(op)) { + make_false(op - 1); + pop(1); +-- +2.9.3 + diff --git a/SPECS/ghostscript.spec b/SPECS/ghostscript.spec index 441ff3b..5330f0d 100644 --- a/SPECS/ghostscript.spec +++ b/SPECS/ghostscript.spec @@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer Name: ghostscript Version: %{gs_ver} -Release: 20%{?dist}.3 +Release: 20%{?dist}.5 # Included CMap data is Redistributable, no modification permitted, # see http://bugzilla.redhat.com/487510 @@ -52,6 +52,7 @@ Patch24: ghostscript-cve-2016-7977.patch Patch25: ghostscript-cve-2016-7978.patch Patch26: ghostscript-cve-2016-7979.patch Patch27: ghostscript-cve-2016-8602.patch +Patch32: ghostscript-cve-2017-8291.patch Requires: urw-fonts >= 1.1, ghostscript-fonts Requires: poppler-data @@ -218,6 +219,9 @@ rm -rf expat freetype icclib jasper jpeg lcms lcms2 libpng openjpeg zlib cups/li # Fix of SIGSEGV when processing GlyphDirectory (bug #1390847) %patch28 -p1 +# Fix for corruption of operand stack (bug #1446063): +%patch32 -p1 + # Remove pdfopt man pages which were mistakenly left in (bug #963882). rm man/{de/,}pdfopt.1 @@ -417,6 +421,12 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/libgs.so %changelog +* Thu May 11 2017 David Kaspar [Dee'Kej] - 9.07-20.el7_3.5 +- Security fix for CVE-2017-8291 updated to address SIGSEGV + +* Wed May 03 2017 David Kaspar [Dee'Kej] - 9.07-20.el7_3.4 +- Added security fix for CVE-2017-8291 (bug #1446063) + * Fri Jan 20 2017 David Kaspar [Dee'Kej] - 9.07-20.el7_3.3 - bogus date in previous changelog entry fixed