Accepting request 492484 from home:jsmeix:branches:Printing
CVE-2017-8291.patch fixes a type confusion in .rsdparams and .eqproc see https://bugs.ghostscript.com/show_bug.cgi?id=697808 and https://bugs.ghostscript.com/show_bug.cgi?id=697799 (bsc#1036453) OBS-URL: https://build.opensuse.org/request/show/492484 OBS-URL: https://build.opensuse.org/package/show/Printing/ghostscript?expand=0&rev=77
This commit is contained in:
Johannes Meixner
Git OBS Bridge
parent
1ec563fa1e
commit
30603cab46
59
CVE-2017-8291.patch
Normal file
59
CVE-2017-8291.patch
Normal file
@ -0,0 +1,59 @@
|
||||
--- ghostscript-9.21/psi/zmisc3.c.orig 2017-03-16 11:12:02.000000000 +0100
|
||||
+++ ghostscript-9.21/psi/zmisc3.c 2017-05-02 14:43:41.000000000 +0200
|
||||
@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p)
|
||||
ref2_t stack[MAX_DEPTH + 1];
|
||||
ref2_t *top = stack;
|
||||
|
||||
+ if (ref_stack_count(&o_stack) < 2)
|
||||
+ return_error(gs_error_stackunderflow);
|
||||
+ if (!r_is_array(op - 1) || !r_is_array(op)) {
|
||||
+ return_error(gs_error_typecheck);
|
||||
+ }
|
||||
+
|
||||
make_array(&stack[0].proc1, 0, 1, op - 1);
|
||||
make_array(&stack[0].proc2, 0, 1, op);
|
||||
for (;;) {
|
||||
--- ghostscript-9.21/psi/zfrsd.c.orig 2017-03-16 11:12:02.000000000 +0100
|
||||
+++ ghostscript-9.21/psi/zfrsd.c 2017-05-02 14:45:35.000000000 +0200
|
||||
@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p)
|
||||
ref *pFilter;
|
||||
ref *pDecodeParms;
|
||||
int Intent = 0;
|
||||
- bool AsyncRead;
|
||||
+ bool AsyncRead = false;
|
||||
ref empty_array, filter1_array, parms1_array;
|
||||
uint i;
|
||||
- int code;
|
||||
+ int code = 0;
|
||||
+
|
||||
+ if (ref_stack_count(&o_stack) < 1)
|
||||
+ return_error(gs_error_stackunderflow);
|
||||
+ if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {
|
||||
+ return_error(gs_error_typecheck);
|
||||
+ }
|
||||
|
||||
make_empty_array(&empty_array, a_readonly);
|
||||
- if (dict_find_string(op, "Filter", &pFilter) > 0) {
|
||||
+ if (r_has_type(op, t_dictionary)
|
||||
+ && dict_find_string(op, "Filter", &pFilter) > 0) {
|
||||
if (!r_is_array(pFilter)) {
|
||||
if (!r_has_type(pFilter, t_name))
|
||||
return_error(gs_error_typecheck);
|
||||
@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p)
|
||||
return_error(gs_error_typecheck);
|
||||
}
|
||||
}
|
||||
- code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
|
||||
+ if (r_has_type(op, t_dictionary))
|
||||
+ code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
|
||||
if (code < 0 && code != gs_error_rangecheck) /* out-of-range int is ok, use 0 */
|
||||
return code;
|
||||
- if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0
|
||||
- )
|
||||
- return code;
|
||||
+ if (r_has_type(op, t_dictionary))
|
||||
+ if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0)
|
||||
+ return code;
|
||||
push(1);
|
||||
op[-1] = *pFilter;
|
||||
if (pDecodeParms)
|
||||
@ -1,3 +1,12 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue May 2 14:27:22 CEST 2017 - jsmeix@suse.de
|
||||
|
||||
- CVE-2017-8291.patch fixes
|
||||
a type confusion in .rsdparams and .eqproc
|
||||
see https://bugs.ghostscript.com/show_bug.cgi?id=697808
|
||||
and https://bugs.ghostscript.com/show_bug.cgi?id=697799
|
||||
(bsc#1036453).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Apr 12 11:12:27 CEST 2017 - jsmeix@suse.de
|
||||
|
||||
|
||||
@ -83,6 +83,11 @@ Patch100: remove-zlib-h-dependency.patch
|
||||
# https://bugs.ghostscript.com/show_bug.cgi?id=697548
|
||||
# (bsc#1032114)
|
||||
Patch101: CVE-2017-5951.patch
|
||||
# Patch102 CVE-2017-8291.patch fixes a type confusion in .rsdparams and .eqproc
|
||||
# see https://bugs.ghostscript.com/show_bug.cgi?id=697808
|
||||
# and https://bugs.ghostscript.com/show_bug.cgi?id=697799
|
||||
# and https://bugzilla.opensuse.org/show_bug.cgi?id=1036453
|
||||
Patch102: CVE-2017-8291.patch
|
||||
# RPM dependencies:
|
||||
Conflicts: ghostscript
|
||||
Conflicts: ghostscript-x11
|
||||
@ -156,7 +161,7 @@ This package contains the development files for Minimal Ghostscript.
|
||||
# because LCMS 1.x is removed since Ghostscript 9.16
|
||||
# but the hunk for LCMS2 (lcms2/include/lcms2.h) is still needed
|
||||
# see http://bugs.ghostscript.com/show_bug.cgi?id=695544
|
||||
%patch11 -p1 -b ppc64le-support.orig
|
||||
%patch11 -p1 -b .ppc64le-support.orig
|
||||
# Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h
|
||||
# in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball:
|
||||
#patch100 -p1 -b remove-zlib-h-dependency.orig
|
||||
@ -172,7 +177,12 @@ rm -rf freetype jpeg libpng tiff
|
||||
# related to mem_get_bits_rectangle() in base/gdevmem.c
|
||||
# https://bugs.ghostscript.com/show_bug.cgi?id=697548
|
||||
# (bsc#1032114)
|
||||
%patch101 -b CVE-2017-5951.orig
|
||||
%patch101 -b .CVE-2017-5951.orig
|
||||
# Patch102 CVE-2017-8291.patch fixes a type confusion in .rsdparams and .eqproc
|
||||
# see https://bugs.ghostscript.com/show_bug.cgi?id=697808
|
||||
# and https://bugs.ghostscript.com/show_bug.cgi?id=697799
|
||||
# and https://bugzilla.opensuse.org/show_bug.cgi?id=1036453
|
||||
%patch102 -p1 -b .CVE-2017-8291.orig
|
||||
|
||||
%build
|
||||
# Derive build timestamp from latest changelog entry
|
||||
|
||||
@ -1,3 +1,12 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue May 2 14:27:22 CEST 2017 - jsmeix@suse.de
|
||||
|
||||
- CVE-2017-8291.patch fixes
|
||||
a type confusion in .rsdparams and .eqproc
|
||||
see https://bugs.ghostscript.com/show_bug.cgi?id=697808
|
||||
and https://bugs.ghostscript.com/show_bug.cgi?id=697799
|
||||
(bsc#1036453).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Apr 12 11:12:27 CEST 2017 - jsmeix@suse.de
|
||||
|
||||
|
||||
@ -103,6 +103,11 @@ Patch100: remove-zlib-h-dependency.patch
|
||||
# https://bugs.ghostscript.com/show_bug.cgi?id=697548
|
||||
# (bsc#1032114)
|
||||
Patch101: CVE-2017-5951.patch
|
||||
# Patch102 CVE-2017-8291.patch fixes a type confusion in .rsdparams and .eqproc
|
||||
# see https://bugs.ghostscript.com/show_bug.cgi?id=697808
|
||||
# and https://bugs.ghostscript.com/show_bug.cgi?id=697799
|
||||
# and https://bugzilla.opensuse.org/show_bug.cgi?id=1036453
|
||||
Patch102: CVE-2017-8291.patch
|
||||
# RPM dependencies:
|
||||
# Additional RPM Provides of the ghostscript-library packages in openSUSE 11.4 from
|
||||
# "rpm -q --provides ghostscript-library" and "rpm -q --provides ghostscript-x11":
|
||||
@ -292,7 +297,7 @@ This package contains the development files for Ghostscript.
|
||||
# because LCMS 1.x is removed since Ghostscript 9.16
|
||||
# but the hunk for LCMS2 (lcms2/include/lcms2.h) is still needed
|
||||
# see http://bugs.ghostscript.com/show_bug.cgi?id=695544
|
||||
%patch11 -p1 -b ppc64le-support.orig
|
||||
%patch11 -p1 -b .ppc64le-support.orig
|
||||
# Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h
|
||||
# in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball:
|
||||
#patch100 -p1 -b remove-zlib-h-dependency.orig
|
||||
@ -308,7 +313,12 @@ rm -rf freetype jpeg libpng tiff
|
||||
# related to mem_get_bits_rectangle() in base/gdevmem.c
|
||||
# https://bugs.ghostscript.com/show_bug.cgi?id=697548
|
||||
# (bsc#1032114)
|
||||
%patch101 -b CVE-2017-5951.orig
|
||||
%patch101 -b .CVE-2017-5951.orig
|
||||
# Patch102 CVE-2017-8291.patch fixes a type confusion in .rsdparams and .eqproc
|
||||
# see https://bugs.ghostscript.com/show_bug.cgi?id=697808
|
||||
# and https://bugs.ghostscript.com/show_bug.cgi?id=697799
|
||||
# and https://bugzilla.opensuse.org/show_bug.cgi?id=1036453
|
||||
%patch102 -p1 -b .CVE-2017-8291.orig
|
||||
|
||||
%build
|
||||
# Derive build timestamp from latest changelog entry
|
||||
|
||||
Loading…
Reference in New Issue
Block a user