From f35503ceee4d0f0ceb1da1b6faa8102feb28c198 Mon Sep 17 00:00:00 2001 From: Tim Waugh Date: Thu, 2 Sep 2010 12:15:51 +0100 Subject: [PATCH 1/4] Applied upstream patch to fix iname.c segfault (bug #465311). --- ghostscript-iname-segfault.patch | 90 ++++++++++++++++++++++++++++++++ ghostscript.spec | 9 +++- 2 files changed, 98 insertions(+), 1 deletion(-) create mode 100644 ghostscript-iname-segfault.patch diff --git a/ghostscript-iname-segfault.patch b/ghostscript-iname-segfault.patch new file mode 100644 index 0000000..f03a91e --- /dev/null +++ b/ghostscript-iname-segfault.patch @@ -0,0 +1,90 @@ +diff -up ghostscript-8.71/psi/iname.c.iname-segfault ghostscript-8.71/psi/iname.c +--- ghostscript-8.71/psi/iname.c.iname-segfault 2008-10-21 17:26:09.000000000 +0100 ++++ ghostscript-8.71/psi/iname.c 2010-09-02 12:13:02.833819490 +0100 +@@ -47,8 +47,8 @@ gs_private_st_composite(st_name_table, n + + /* Forward references */ + static int name_alloc_sub(name_table *); +-static void name_free_sub(name_table *, uint); +-static void name_scan_sub(name_table *, uint, bool); ++static void name_free_sub(name_table *, uint, bool); ++static void name_scan_sub(name_table *, uint, bool, bool); + + /* Debugging printout */ + #ifdef DEBUG +@@ -99,7 +99,7 @@ names_init(ulong count, gs_ref_memory_t + + if (code < 0) { + while (nt->sub_next > 0) +- name_free_sub(nt, --(nt->sub_next)); ++ name_free_sub(nt, --(nt->sub_next), false); + gs_free_object(mem, nt, "name_init(nt)"); + return 0; + } +@@ -413,16 +413,7 @@ names_trace_finish(name_table * nt, gc_s + if (sub != 0) { + int save_count = nt->sub_count; + +- name_scan_sub(nt, i, true); +- if (save_count != nt->sub_count) { +- /* name_scan_sub has released the i-th entry. */ +- continue; +- } +- if (nt->sub[i].names == 0 && gcst != 0) { +- /* Mark the just-freed sub-table as unmarked. */ +- o_set_unmarked((obj_header_t *)sub - 1); +- o_set_unmarked((obj_header_t *)ssub - 1); +- } ++ name_scan_sub(nt, i, true, true && (gcst != 0)); + } + } + nt->sub_next = 0; +@@ -506,7 +497,7 @@ name_alloc_sub(name_table * nt) + /* Add the newly allocated entries to the free list. */ + /* Note that the free list will only be properly sorted if */ + /* it was empty initially. */ +- name_scan_sub(nt, sub_index, false); ++ name_scan_sub(nt, sub_index, false, false); + #ifdef DEBUG + if (gs_debug_c('n')) { /* Print the lengths of the hash chains. */ + int i0; +@@ -535,8 +526,20 @@ name_alloc_sub(name_table * nt) + + /* Free a sub-table. */ + static void +-name_free_sub(name_table * nt, uint sub_index) ++name_free_sub(name_table * nt, uint sub_index, bool unmark) + { ++ /* If the subtable is in a previous save level, gs_free_object() ++ * may not actually free the memory, in case that happens, we need ++ * to explicitly remove the gc mark. ++ */ ++ if (unmark) { ++ name_sub_table *sub = nt->sub[sub_index].names; ++ name_string_sub_table_t *ssub = nt->sub[sub_index].strings; ++ ++ o_set_unmarked((obj_header_t *)sub - 1); ++ o_set_unmarked((obj_header_t *)ssub - 1); ++ } ++ + gs_free_object(nt->memory, nt->sub[sub_index].strings, + "name_free_sub(string sub-table)"); + gs_free_object(nt->memory, nt->sub[sub_index].names, +@@ -550,7 +553,7 @@ name_free_sub(name_table * nt, uint sub_ + /* will stay sorted. If all entries are unmarked and free_empty is true, */ + /* free the sub-table. */ + static void +-name_scan_sub(name_table * nt, uint sub_index, bool free_empty) ++name_scan_sub(name_table * nt, uint sub_index, bool free_empty, bool unmark) + { + name_string_sub_table_t *ssub = nt->sub[sub_index].strings; + uint free = nt->free; +@@ -579,7 +582,7 @@ name_scan_sub(name_table * nt, uint sub_ + nt->free = free; + else { + /* No marked entries, free the sub-table. */ +- name_free_sub(nt, sub_index); ++ name_free_sub(nt, sub_index, unmark); + if (sub_index == nt->sub_count - 1) { + /* Back up over a final run of deleted sub-tables. */ + do { diff --git a/ghostscript.spec b/ghostscript.spec index 867caf0..59d6ebc 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer. Name: ghostscript Version: %{gs_ver} -Release: 11%{?dist} +Release: 12%{?dist} # Included CMap data is Redistributable, no modification permitted, # see http://bugzilla.redhat.com/487510 @@ -24,6 +24,7 @@ Patch5: ghostscript-runlibfileifexists.patch Patch6: ghostscript-system-jasper.patch Patch7: ghostscript-pksmraw.patch Patch8: ghostscript-jbig2dec-nullderef.patch +Patch9: ghostscript-iname-segfault.patch Patch10: ghostscript-CVE-2009-4270.patch Patch11: ghostscript-vsnprintf.patch Patch12: ghostscript-cups-filters.patch @@ -135,6 +136,9 @@ rm -rf libpng zlib jpeg jasper # Applied patch to fix NULL dereference in JBIG2 decoder (bug #501710). %patch8 -p1 -b .jbig2dec-nullderef +# Applied upstream patch to fix iname.c segfault (bug #465311). +%patch9 -p1 -b .iname-segfault + # Fix debugging output from gdevcups (bug #540760). %patch10 -p1 -b .CVE-2009-4270 @@ -370,6 +374,9 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/libgs.so %changelog +* Thu Sep 2 2010 Tim Waugh 8.71-12 +- Applied upstream patch to fix iname.c segfault (bug #465311). + * Thu Aug 26 2010 Tim Waugh 8.71-11 - Avoid epstopdf failure using upstream patch (bug #627390). - More upstream fixes for bug #599564. From 92552fba1ef3cd320d11e5f8996db10061a20de9 Mon Sep 17 00:00:00 2001 From: Tim Waugh Date: Thu, 2 Sep 2010 13:05:00 +0100 Subject: [PATCH 2/4] Applied patch to fix NULL dereference in bbox driver (bug #591624). --- ghostscript-bbox-close.patch | 12 ++++++++++++ ghostscript.spec | 5 +++++ 2 files changed, 17 insertions(+) create mode 100644 ghostscript-bbox-close.patch diff --git a/ghostscript-bbox-close.patch b/ghostscript-bbox-close.patch new file mode 100644 index 0000000..7f6ab72 --- /dev/null +++ b/ghostscript-bbox-close.patch @@ -0,0 +1,12 @@ +diff -up ghostscript-8.71/base/gdevbbox.c.bbox-close ghostscript-8.71/base/gdevbbox.c +--- ghostscript-8.71/base/gdevbbox.c.bbox-close 2010-01-19 15:48:57.000000000 +0000 ++++ ghostscript-8.71/base/gdevbbox.c 2010-09-02 13:03:37.742943978 +0100 +@@ -249,7 +249,7 @@ bbox_close_device(gx_device * dev) + * This device was created as a wrapper for a compositor. + * Just free the devices. + */ +- int code = (bdev->forward_open_close ? gs_closedevice(tdev) : 0); ++ int code = (tdev && bdev->forward_open_close ? gs_closedevice(tdev) : 0); + + gs_free_object(dev->memory, dev, "bbox_close_device(composite)"); + return code; diff --git a/ghostscript.spec b/ghostscript.spec index 59d6ebc..d20b29c 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -40,6 +40,7 @@ Patch21: ghostscript-jbig2-image-refcount.patch Patch22: ghostscript-SEARCH_HERE_FIRST.patch Patch23: ghostscript--P-.patch Patch24: ghostscript-epstopdf-failure.patch +Patch25: ghostscript-bbox-close.patch Requires: urw-fonts >= 1.1, ghostscript-fonts BuildRequires: xz @@ -186,6 +187,9 @@ rm -rf libpng zlib jpeg jasper # Avoid epstopdf failure using upstream patch (bug #627390). %patch24 -p1 -b .epstopdf-failure +# Applied patch to fix NULL dereference in bbox driver (bug #591624). +%patch25 -p1 -b .bbox-close + # Convert manual pages to UTF-8 from8859_1() { iconv -f iso-8859-1 -t utf-8 < "$1" > "${1}_" @@ -375,6 +379,7 @@ rm -rf $RPM_BUILD_ROOT %changelog * Thu Sep 2 2010 Tim Waugh 8.71-12 +- Applied patch to fix NULL dereference in bbox driver (bug #591624). - Applied upstream patch to fix iname.c segfault (bug #465311). * Thu Aug 26 2010 Tim Waugh 8.71-11 From d24aadea6e24b25b1e746c62316b7908e17ad438 Mon Sep 17 00:00:00 2001 From: Tim Waugh Date: Thu, 2 Sep 2010 14:42:58 +0100 Subject: [PATCH 3/4] Applied patch to let gdevcups use automatic memory allocation. --- ghostscript-gdevcups-ripcache.patch | 31 +++++++++++++++++++++++++++++ ghostscript.spec | 7 +++++++ 2 files changed, 38 insertions(+) create mode 100644 ghostscript-gdevcups-ripcache.patch diff --git a/ghostscript-gdevcups-ripcache.patch b/ghostscript-gdevcups-ripcache.patch new file mode 100644 index 0000000..9c6347d --- /dev/null +++ b/ghostscript-gdevcups-ripcache.patch @@ -0,0 +1,31 @@ +diff -up ghostscript-8.71/cups/gdevcups.c.gdevcups-ripcache ghostscript-8.71/cups/gdevcups.c +--- ghostscript-8.71/cups/gdevcups.c.gdevcups-ripcache 2010-09-02 14:38:53.886818591 +0100 ++++ ghostscript-8.71/cups/gdevcups.c 2010-09-02 14:40:49.925943426 +0100 +@@ -915,8 +915,7 @@ cups_get_space_params(const gx_device_pr + switch (sscanf(cache_env, "%f%254s", &cache_size, cache_units)) + { + case 0 : +- cache_size = 8 * 1024 * 1024; +- break; ++ return; + case 1 : + cache_size *= 4 * CUPS_TILE_SIZE * CUPS_TILE_SIZE; + break; +@@ -933,12 +932,15 @@ cups_get_space_params(const gx_device_pr + } + } + else +- cache_size = 8 * 1024 * 1024; ++ return; ++ ++ if (cache_size == 0) ++ return; + + dprintf1("DEBUG2: cache_size = %.0f\n", cache_size); + + space_params->MaxBitmap = (int)cache_size; +- space_params->BufferSpace = (int)cache_size / 10; ++ space_params->BufferSpace = (int)cache_size; + } + + diff --git a/ghostscript.spec b/ghostscript.spec index d20b29c..7d656cd 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -41,6 +41,7 @@ Patch22: ghostscript-SEARCH_HERE_FIRST.patch Patch23: ghostscript--P-.patch Patch24: ghostscript-epstopdf-failure.patch Patch25: ghostscript-bbox-close.patch +Patch26: ghostscript-gdevcups-ripcache.patch Requires: urw-fonts >= 1.1, ghostscript-fonts BuildRequires: xz @@ -190,6 +191,10 @@ rm -rf libpng zlib jpeg jasper # Applied patch to fix NULL dereference in bbox driver (bug #591624). %patch25 -p1 -b .bbox-close +# Applied patch to let gdevcups use automatic memory allocation. Use +# RIPCache=auto in /etc/cups/cupsd.conf to enable. +%patch26 -p1 -b .gdevcups-ripcache + # Convert manual pages to UTF-8 from8859_1() { iconv -f iso-8859-1 -t utf-8 < "$1" > "${1}_" @@ -379,6 +384,8 @@ rm -rf $RPM_BUILD_ROOT %changelog * Thu Sep 2 2010 Tim Waugh 8.71-12 +- Applied patch to let gdevcups use automatic memory allocation. Use + RIPCache=auto in /etc/cups/cupsd.conf to enable. - Applied patch to fix NULL dereference in bbox driver (bug #591624). - Applied upstream patch to fix iname.c segfault (bug #465311). From 14bd3ebe380d8829b23b1a9f4c320c6727a52154 Mon Sep 17 00:00:00 2001 From: Tim Waugh Date: Fri, 3 Sep 2010 11:56:39 +0100 Subject: [PATCH 4/4] Restored Fontmap.local patch (bug #610301). --- ghostscript-Fontmap.local.patch | 9 +++++++++ ghostscript.spec | 11 +++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 ghostscript-Fontmap.local.patch diff --git a/ghostscript-Fontmap.local.patch b/ghostscript-Fontmap.local.patch new file mode 100644 index 0000000..3d1fee2 --- /dev/null +++ b/ghostscript-Fontmap.local.patch @@ -0,0 +1,9 @@ +diff -up ghostscript-8.71/Resource/Init/Fontmap.Fontmap.local ghostscript-8.71/Resource/Init/Fontmap +--- ghostscript-8.71/Resource/Init/Fontmap.Fontmap.local 2008-08-08 05:22:38.000000000 +0100 ++++ ghostscript-8.71/Resource/Init/Fontmap 2010-09-03 11:53:47.273865979 +0100 +@@ -2,3 +2,5 @@ + % See Fontmap.GS for the syntax of real Fontmap files. + %% Replace 1 (Fontmap.GS) + (Fontmap.GS) .runlibfile ++% must be at the bottom of line to allow people overriding everything. ++(Fontmap.local) .runlibfileifexists diff --git a/ghostscript.spec b/ghostscript.spec index 7d656cd..951687f 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -5,7 +5,7 @@ Summary: A PostScript interpreter and renderer. Name: ghostscript Version: %{gs_ver} -Release: 12%{?dist} +Release: 15%{?dist} # Included CMap data is Redistributable, no modification permitted, # see http://bugzilla.redhat.com/487510 @@ -42,6 +42,7 @@ Patch23: ghostscript--P-.patch Patch24: ghostscript-epstopdf-failure.patch Patch25: ghostscript-bbox-close.patch Patch26: ghostscript-gdevcups-ripcache.patch +Patch27: ghostscript-Fontmap.local.patch Requires: urw-fonts >= 1.1, ghostscript-fonts BuildRequires: xz @@ -195,6 +196,10 @@ rm -rf libpng zlib jpeg jasper # RIPCache=auto in /etc/cups/cupsd.conf to enable. %patch26 -p1 -b .gdevcups-ripcache +# Restored Fontmap.local patch, incorrectly dropped after +# ghostscript-8.15.4-3 (bug #610301). +%patch27 -p1 -b .Fontmap.local + # Convert manual pages to UTF-8 from8859_1() { iconv -f iso-8859-1 -t utf-8 < "$1" > "${1}_" @@ -383,7 +388,9 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/libgs.so %changelog -* Thu Sep 2 2010 Tim Waugh 8.71-12 +* Fri Sep 3 2010 Tim Waugh 8.71-15 +- Restored Fontmap.local patch, incorrectly dropped after + ghostscript-8.15.4-3 (bug #610301). - Applied patch to let gdevcups use automatic memory allocation. Use RIPCache=auto in /etc/cups/cupsd.conf to enable. - Applied patch to fix NULL dereference in bbox driver (bug #591624).