diff --git a/ghostscript-10.01.0-CVE-2023-28879.patch b/ghostscript-10.01.0-CVE-2023-28879.patch new file mode 100644 index 0000000..0629e99 --- /dev/null +++ b/ghostscript-10.01.0-CVE-2023-28879.patch @@ -0,0 +1,44 @@ +From 37ed5022cecd584de868933b5b60da2e995b3179 Mon Sep 17 00:00:00 2001 +From: Ken Sharp +Date: Fri, 24 Mar 2023 13:19:57 +0000 +Subject: [PATCH] Graphics library - prevent buffer overrun in (T)BCP encoding + +Bug #706494 "Buffer Overflow in s_xBCPE_process" + +As described in detail in the bug report, if the write buffer is filled +to one byte less than full, and we then try to write an escaped +character, we overrun the buffer because we don't check before +writing two bytes to it. + +This just checks if we have two bytes before starting to write an +escaped character and exits if we don't (replacing the consumed byte +of the input). + +Up for further discussion; why do we even permit a BCP encoding filter +anyway ? I think we should remove this, at least when SAFER is true. +--- + base/sbcp.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/base/sbcp.c b/base/sbcp.c +index 979ae0992..47fc233ec 100644 +--- a/base/sbcp.c ++++ b/base/sbcp.c +@@ -50,6 +50,14 @@ s_xBCPE_process(stream_state * st, stream_cursor_read * pr, + byte ch = *++p; + + if (ch <= 31 && escaped[ch]) { ++ /* Make sure we have space to store two characters in the write buffer, ++ * if we don't then exit without consuming the input character, we'll process ++ * that on the next time round. ++ */ ++ if (pw->limit - q < 2) { ++ p--; ++ break; ++ } + if (p == rlimit) { + p--; + break; +-- +2.39.2 + diff --git a/ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch b/ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch new file mode 100644 index 0000000..465589e --- /dev/null +++ b/ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch @@ -0,0 +1,62 @@ +diff --git a/Resource/Init/gs_statd.ps b/Resource/Init/gs_statd.ps +index 6751c032908337e400c67c02a80cbeae8a8b3122..83181257dea8b3438ccf8ce290422283414f8755 100644 (file) +--- a/Resource/Init/gs_statd.ps ++++ b/Resource/Init/gs_statd.ps +@@ -42,7 +42,7 @@ statusdict begin + + % Keep the table of named paper sizes as procedures. Reuse them later + % as compatibility operators. +-/.pagetypeprocs 70 dict begin ++/.pagetypeprocs 81 dict begin + + % Define various paper formats. The Adobe documentation defines only these: + % 11x17, a3, a4, a4small, b5, ledger, legal, letter, lettersmall, note. +@@ -116,6 +116,11 @@ statusdict begin + /archC {1296 1728 //.setpagesize stopped { pop pop /archC $error /errorname get signalerror } if } bind def + /archB {864 1296 //.setpagesize stopped { pop pop /archB $error /errorname get signalerror } if } bind def + /archA {648 864 //.setpagesize stopped { pop pop /archA $error /errorname get signalerror } if } bind def ++ /archa /archA load def ++ /archb /archB load def ++ /archc /archC load def ++ /archd /archD load def ++ /arche /archE load def + % Other paper sizes + /flsa {612 936 //.setpagesize stopped { pop pop /flsa $error /errorname get signalerror } if } bind def % U.S. foolscap + /flse {612 936 //.setpagesize stopped { pop pop /flse $error /errorname get signalerror } if } bind def % European foolscap +@@ -132,6 +137,12 @@ statusdict begin + /ANSI_D {1585 2448 //.setpagesize stopped { pop pop /ANSI_D $error /errorname get signalerror } if } bind def + /ANSI_E {2448 3168 //.setpagesize stopped { pop pop /ANSI_E $error /errorname get signalerror } if } bind def + /ANSI_F {2016 2880 //.setpagesize stopped { pop pop /ANSI_F $error /errorname get signalerror } if } bind def ++ /ansi_a /ANSI_A load def ++ /ansi_b /ANSI_B load def ++ /ansi_c /ANSI_C load def ++ /ansi_d /ANSI_D load def ++ /ansi_e /ANSI_E load def ++ /ansi_f /ANSI_F load def + %END SIZES + currentdict end + userdict begin dup { def } forall end % reuse! + diff --git a/psi/zmisc.c b/psi/zmisc.c + +--- a/psi/zmisc.c ++++ b/psi/zmisc.c +@@ -255,7 +255,7 @@ + { + os_ptr op = osp; + byte *value; +- int len = 0; ++ int len = 0, i; + + if (gp_defaultpapersize((char *)0, &len) > 0) { + /* no default paper size */ +@@ -269,6 +269,10 @@ + return_error(gs_error_VMerror); + } + DISCARD(gp_defaultpapersize((char *)value, &len)); /* can't fail */ ++ /* Note 'len' includes the NULL terminator, which we can ignore */ ++ for (i = 0;i < (len - 1); i++) ++ value[i] = tolower(value[i]); ++ + /* Delete the stupid C string terminator. */ + value = iresize_string(value, len, len - 1, + "defaultpapersize value"); /* can't fail */ diff --git a/ghostscript-10.01.0-set-a4-as-default-pagesize.patch b/ghostscript-10.01.0-set-a4-as-default-pagesize.patch deleted file mode 100644 index 9b92569..0000000 --- a/ghostscript-10.01.0-set-a4-as-default-pagesize.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/Resource/Init/gs_init.ps 2022-09-21 10:39:46.000000000 +0200 -+++ b/Resource/Init/gs_init.ps 2023-03-31 09:43:05.759701348 +0200 -@@ -72,7 +72,7 @@ - % standard page size A4 rather than US letter, the page size of - % devices that default to letter or A4 can be changed by setting - % DEFAULTPAPERSIZE. --% /DEFAULTPAPERSIZE (a4) def -+/DEFAULTPAPERSIZE (a4) def - - % Turn on array packing for the rest of initialization. - //true setpacking diff --git a/ghostscript.spec b/ghostscript.spec index e6af2af..f691e6e 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -45,7 +45,7 @@ Name: ghostscript Summary: Interpreter for PostScript language & PDF Version: 10.01.0 -Release: 2%{?dist} +Release: 3%{?dist} License: AGPL-3.0-or-later @@ -107,7 +107,9 @@ BuildRequires: make #Patch000: example000.patch Patch001: ghostscript-10.01.0-pdfwrite-Substituted-TTF-CIDFont-CID-hand.patch -Patch002: ghostscript-10.01.0-set-a4-as-default-pagesize.patch +Patch002: ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch +Patch003: ghostscript-10.01.0-CVE-2023-28879.patch + # Downstream patches -- these should be always included when doing rebase: # ------------------ @@ -421,6 +423,10 @@ done # ============================================================================= %changelog +* Thu Apr 06 2023 Richard Lescak - 10.01.0-3 +- fix for CVE-2023-28879 (#2184586) +- add patch for converting default page name to lowercase (#2183166) + * Mon Apr 03 2023 Richard Lescak - 10.01.0-2 - set 'a4' as a default in gs_init.ps to fix unrecognized 'Letter' page size (#2183166)