From 1c07afbc5a528f98bb7831c0f401668fa5ca768b Mon Sep 17 00:00:00 2001 From: "David Kaspar [Dee'Kej]" Date: Mon, 30 Jul 2018 14:59:45 +0200 Subject: [PATCH] create-GC-descriptors-for-JPEG-passthrough.patch added Resolves: #1589467 --- ...-GC-descriptors-for-JPEG-passthrough.patch | 60 +++++++++++++++++++ ghostscript.spec | 1 + 2 files changed, 61 insertions(+) create mode 100644 ghostscript-9.23-001-create-GC-descriptors-for-JPEG-passthrough.patch diff --git a/ghostscript-9.23-001-create-GC-descriptors-for-JPEG-passthrough.patch b/ghostscript-9.23-001-create-GC-descriptors-for-JPEG-passthrough.patch new file mode 100644 index 0000000..a077b84 --- /dev/null +++ b/ghostscript-9.23-001-create-GC-descriptors-for-JPEG-passthrough.patch @@ -0,0 +1,60 @@ +From da3810ce626a1c5dca856a7bac757bf254761f69 Mon Sep 17 00:00:00 2001 +From: Ken Sharp +Date: Thu, 28 Jun 2018 16:44:41 +0100 +Subject: [PATCH] pdfwrite - create GC desscriptors for JPEG Passthrough stream + +Bug #699427 " Shrinking PDF is causing SIGSEGV" + +Its not absolutely clear that this is the same problem, but I'm +reasonably confident. When passing JPEG data through untouched, we +copied the stream pointer for the uncompressed data into the device +structure (because the image enumerator isn't available at that time) +but if the stream should be relocated after the copy is taken, then the +old stream might not be valid any more. + +This commit adds a GC descriptor for the copied stream pointer to the +PDF device structure. For me this solves the problem, but the nature +of these kinds of problems means that *any* change which affects memory +layout will affect the execution, so I'm not 100% certain this is the +problem. +--- + devices/vector/gdevpdf.c | 2 ++ + devices/vector/gdevpdfx.h | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/devices/vector/gdevpdf.c b/devices/vector/gdevpdf.c +index 5c1079e15..544259fbf 100644 +--- a/devices/vector/gdevpdf.c ++++ b/devices/vector/gdevpdf.c +@@ -118,6 +118,7 @@ ENUM_PTRS_WITH(device_pdfwrite_enum_ptrs, gx_device_pdf *pdev) + ENUM_PTR(39, gx_device_pdf, EmbeddedFiles); + ENUM_PTR(40, gx_device_pdf, pdf_font_dir); + ENUM_PTR(41, gx_device_pdf, ExtensionMetadata); ++ ENUM_PTR(42, gx_device_pdf, PassThroughWriter); + #define e1(i,elt) ENUM_PARAM_STRING_PTR(i + gx_device_pdf_num_ptrs, gx_device_pdf, elt); + gx_device_pdf_do_param_strings(e1) + #undef e1 +@@ -170,6 +171,7 @@ static RELOC_PTRS_WITH(device_pdfwrite_reloc_ptrs, gx_device_pdf *pdev) + RELOC_PTR(gx_device_pdf, EmbeddedFiles); + RELOC_PTR(gx_device_pdf, pdf_font_dir); + RELOC_PTR(gx_device_pdf, ExtensionMetadata); ++ RELOC_PTR(gx_device_pdf, PassThroughWriter); + #define r1(i,elt) RELOC_PARAM_STRING_PTR(gx_device_pdf,elt); + gx_device_pdf_do_param_strings(r1) + #undef r1 +diff --git a/devices/vector/gdevpdfx.h b/devices/vector/gdevpdfx.h +index f06eb16a6..1aa2a9d71 100644 +--- a/devices/vector/gdevpdfx.h ++++ b/devices/vector/gdevpdfx.h +@@ -927,7 +927,7 @@ struct gx_device_pdf_s { + m(39, gx_device_pdf, EmbeddedFiles); + m(40, gx_device_pdf, pdf_font_dir); + m(41, gx_device_pdf, Extension_Metadata);*/ +-#define gx_device_pdf_num_ptrs 42 ++#define gx_device_pdf_num_ptrs 43 + #define gx_device_pdf_do_param_strings(m)\ + m(0, OwnerPassword) m(1, UserPassword) m(2, NoEncrypt)\ + m(3, DocumentUUID) m(4, InstanceUUID) +-- +2.14.4 + diff --git a/ghostscript.spec b/ghostscript.spec index 23e06ef..c8fb20e 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -94,6 +94,7 @@ BuildRequires: libXt-devel # ---------------- last rebase that are necessary for any reason: #Patch000: example000.patch Patch000: ghostscript-9.23-000-CVE-2018-10194.patch +Patch001: ghostscript-9.23-001-create-GC-descriptors-for-JPEG-passthrough.patch # Downstream patches -- these should be always included when doing rebase: