From e0ca07cfe1d0dceaa1ee4ac5715002218fc6ec89 Mon Sep 17 00:00:00 2001 From: Michael J Gruber Date: Wed, 8 Nov 2023 00:16:02 +0100 Subject: [PATCH] fix txtwrite device and /selectdevice Fixes for: gs bug #707132 gs bug #707310 These bugs caused failure in our CI gating tests. Also, drop all unused patches (which are part of ghostscript-10.02.1). --- ...1.0-convert-defaultpage-to-lowercase.patch | 62 ---------- ...ite-Substituted-TTF-CIDFont-CID-hand.patch | 112 ------------------ ghostscript-10.01.2-CVE-2023-38559.patch | 27 ----- ghostscript-10.01.2-CVE-2023-43115.patch | 20 ---- ...-10.02.1-PostScript-Fix-selectdevice.patch | 33 ++++++ ...needs-to-countdown-the-device-on-tex.patch | 31 +++++ ghostscript.spec | 7 +- 7 files changed, 70 insertions(+), 222 deletions(-) delete mode 100644 ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch delete mode 100644 ghostscript-10.01.0-pdfwrite-Substituted-TTF-CIDFont-CID-hand.patch delete mode 100644 ghostscript-10.01.2-CVE-2023-38559.patch delete mode 100644 ghostscript-10.01.2-CVE-2023-43115.patch create mode 100644 ghostscript-10.02.1-PostScript-Fix-selectdevice.patch create mode 100644 ghostscript-10.02.1-txtwrite-device-needs-to-countdown-the-device-on-tex.patch diff --git a/ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch b/ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch deleted file mode 100644 index 465589e..0000000 --- a/ghostscript-10.01.0-convert-defaultpage-to-lowercase.patch +++ /dev/null @@ -1,62 +0,0 @@ -diff --git a/Resource/Init/gs_statd.ps b/Resource/Init/gs_statd.ps -index 6751c032908337e400c67c02a80cbeae8a8b3122..83181257dea8b3438ccf8ce290422283414f8755 100644 (file) ---- a/Resource/Init/gs_statd.ps -+++ b/Resource/Init/gs_statd.ps -@@ -42,7 +42,7 @@ statusdict begin - - % Keep the table of named paper sizes as procedures. Reuse them later - % as compatibility operators. --/.pagetypeprocs 70 dict begin -+/.pagetypeprocs 81 dict begin - - % Define various paper formats. The Adobe documentation defines only these: - % 11x17, a3, a4, a4small, b5, ledger, legal, letter, lettersmall, note. -@@ -116,6 +116,11 @@ statusdict begin - /archC {1296 1728 //.setpagesize stopped { pop pop /archC $error /errorname get signalerror } if } bind def - /archB {864 1296 //.setpagesize stopped { pop pop /archB $error /errorname get signalerror } if } bind def - /archA {648 864 //.setpagesize stopped { pop pop /archA $error /errorname get signalerror } if } bind def -+ /archa /archA load def -+ /archb /archB load def -+ /archc /archC load def -+ /archd /archD load def -+ /arche /archE load def - % Other paper sizes - /flsa {612 936 //.setpagesize stopped { pop pop /flsa $error /errorname get signalerror } if } bind def % U.S. foolscap - /flse {612 936 //.setpagesize stopped { pop pop /flse $error /errorname get signalerror } if } bind def % European foolscap -@@ -132,6 +137,12 @@ statusdict begin - /ANSI_D {1585 2448 //.setpagesize stopped { pop pop /ANSI_D $error /errorname get signalerror } if } bind def - /ANSI_E {2448 3168 //.setpagesize stopped { pop pop /ANSI_E $error /errorname get signalerror } if } bind def - /ANSI_F {2016 2880 //.setpagesize stopped { pop pop /ANSI_F $error /errorname get signalerror } if } bind def -+ /ansi_a /ANSI_A load def -+ /ansi_b /ANSI_B load def -+ /ansi_c /ANSI_C load def -+ /ansi_d /ANSI_D load def -+ /ansi_e /ANSI_E load def -+ /ansi_f /ANSI_F load def - %END SIZES - currentdict end - userdict begin dup { def } forall end % reuse! - diff --git a/psi/zmisc.c b/psi/zmisc.c - ---- a/psi/zmisc.c -+++ b/psi/zmisc.c -@@ -255,7 +255,7 @@ - { - os_ptr op = osp; - byte *value; -- int len = 0; -+ int len = 0, i; - - if (gp_defaultpapersize((char *)0, &len) > 0) { - /* no default paper size */ -@@ -269,6 +269,10 @@ - return_error(gs_error_VMerror); - } - DISCARD(gp_defaultpapersize((char *)value, &len)); /* can't fail */ -+ /* Note 'len' includes the NULL terminator, which we can ignore */ -+ for (i = 0;i < (len - 1); i++) -+ value[i] = tolower(value[i]); -+ - /* Delete the stupid C string terminator. */ - value = iresize_string(value, len, len - 1, - "defaultpapersize value"); /* can't fail */ diff --git a/ghostscript-10.01.0-pdfwrite-Substituted-TTF-CIDFont-CID-hand.patch b/ghostscript-10.01.0-pdfwrite-Substituted-TTF-CIDFont-CID-hand.patch deleted file mode 100644 index 3ebac1e..0000000 --- a/ghostscript-10.01.0-pdfwrite-Substituted-TTF-CIDFont-CID-hand.patch +++ /dev/null @@ -1,112 +0,0 @@ -From 346f12459aa67cdb5ff9e267c2c8cccc17f4a376 Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Wed, 15 Mar 2023 15:38:29 +0000 -Subject: [PATCH] Bug 706478: pdfwrite: Substituted TTF CIDFont CID handling - -The PS interpreter callback that handles converting a CID to a TTF GID did -not handle the case of substituted CIDFonts. - -It requires looking up the CID on the Decoding (to get a Unicode code point), -and then looking up the code point in the TTF cmap table to get the GID. - -The rendering code already handled it. ---- - psi/zfcid1.c | 73 +++++++++++++++++++++++++++++++++------------------- - 1 file changed, 46 insertions(+), 27 deletions(-) - -diff --git a/psi/zfcid1.c b/psi/zfcid1.c -index fd502ff12..55de85d45 100644 ---- a/psi/zfcid1.c -+++ b/psi/zfcid1.c -@@ -1,4 +1,4 @@ --/* Copyright (C) 2001-2021 Artifex Software, Inc. -+/* Copyright (C) 2001-2023 Artifex Software, Inc. - All Rights Reserved. - - This software is provided AS-IS with no warranty, either express or -@@ -77,37 +77,56 @@ z11_CIDMap_proc(gs_font_cid2 *pfont, gs_glyph glyph) - int gdbytes = pfont->cidata.common.GDBytes; - int gnum = 0; - const byte *data; -- int i, code; -+ int i, code = -1; - ref rcid; - ref *prgnum; -+ ref *p, *fdict = pfont_dict(pfont); -+ -+ if (r_has_type(fdict, t_dictionary) && dict_find_string(fdict, "Path", &p)) { -+ ref *Decoding = NULL, *TT_cmap = NULL, *SubstNWP = NULL, src_type, dst_type; -+ uint c; -+ -+ code = dict_find_string(fdict, "Decoding", &Decoding); -+ if (code > 0) -+ code = dict_find_string(fdict, "TT_cmap", &TT_cmap); -+ if (code > 0) -+ code = dict_find_string(fdict, "SubstNWP", &SubstNWP); -+ if (code > 0) { -+ code = cid_to_TT_charcode(pfont->memory, Decoding, TT_cmap, SubstNWP, cid, &c, &src_type, &dst_type); -+ if (code >= 0) -+ gnum = c; -+ } -+ } - -- switch (r_type(pcidmap)) { -- case t_string: -- if (cid >= r_size(pcidmap) / gdbytes) -- return_error(gs_error_rangecheck); -- data = pcidmap->value.const_bytes + cid * gdbytes; -- break; -- case t_integer: -- return cid + pcidmap->value.intval; -- case t_dictionary: -- make_int(&rcid, cid); -- code = dict_find(pcidmap, &rcid, &prgnum); -- if (code <= 0) -- return (code < 0 ? code : gs_note_error(gs_error_undefined)); -- if (!r_has_type(prgnum, t_integer)) -- return_error(gs_error_typecheck); -- return prgnum->value.intval; -- default: /* array type */ -- code = string_array_access_proc(pfont->memory, pcidmap, 1, cid * gdbytes, -- gdbytes, NULL, NULL, &data); -+ if (code < 0) { -+ switch (r_type(pcidmap)) { -+ case t_string: -+ if (cid >= r_size(pcidmap) / gdbytes) -+ return_error(gs_error_rangecheck); -+ data = pcidmap->value.const_bytes + cid * gdbytes; -+ break; -+ case t_integer: -+ return cid + pcidmap->value.intval; -+ case t_dictionary: -+ make_int(&rcid, cid); -+ code = dict_find(pcidmap, &rcid, &prgnum); -+ if (code <= 0) -+ return (code < 0 ? code : gs_note_error(gs_error_undefined)); -+ if (!r_has_type(prgnum, t_integer)) -+ return_error(gs_error_typecheck); -+ return prgnum->value.intval; -+ default: /* array type */ -+ code = string_array_access_proc(pfont->memory, pcidmap, 1, cid * gdbytes, -+ gdbytes, NULL, NULL, &data); - -- if (code < 0) -- return code; -- if ( code > 0 ) -- return_error(gs_error_invalidfont); -+ if (code < 0) -+ return code; -+ if ( code > 0 ) -+ return_error(gs_error_invalidfont); -+ } -+ for (i = 0; i < gdbytes; ++i) -+ gnum = (gnum << 8) + data[i]; - } -- for (i = 0; i < gdbytes; ++i) -- gnum = (gnum << 8) + data[i]; - if (gnum >= pfont->data.trueNumGlyphs) - return_error(gs_error_invalidfont); - return gnum; --- -2.39.2 - diff --git a/ghostscript-10.01.2-CVE-2023-38559.patch b/ghostscript-10.01.2-CVE-2023-38559.patch deleted file mode 100644 index 19e6ecc..0000000 --- a/ghostscript-10.01.2-CVE-2023-38559.patch +++ /dev/null @@ -1,27 +0,0 @@ -From d81b82c70bc1fb9991bb95f1201abb5dea55f57f Mon Sep 17 00:00:00 2001 -From: Chris Liddell -Date: Mon, 17 Jul 2023 14:06:37 +0100 -Subject: [PATCH] Bug 706897: Copy pcx buffer overrun fix from - devices/gdevpcx.c - -Bounds check the buffer, before dereferencing the pointer. ---- - base/gdevdevn.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/base/gdevdevn.c b/base/gdevdevn.c -index 7b14d9c71..6351fb77a 100644 ---- a/base/gdevdevn.c -+++ b/base/gdevdevn.c -@@ -1983,7 +1983,7 @@ devn_pcx_write_rle(const byte * from, const byte * end, int step, gp_file * file - byte data = *from; - - from += step; -- if (data != *from || from == end) { -+ if (from >= end || data != *from) { - if (data >= 0xc0) - gp_fputc(0xc1, file); - } else { --- -2.41.0 - diff --git a/ghostscript-10.01.2-CVE-2023-43115.patch b/ghostscript-10.01.2-CVE-2023-43115.patch deleted file mode 100644 index d2ef80f..0000000 --- a/ghostscript-10.01.2-CVE-2023-43115.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- a/devices/gdevijs.c -+++ b/devices/gdevijs.c -@@ -888,6 +888,8 @@ gsijs_initialize_device(gx_device *dev) - static const char rgb[] = "DeviceRGB"; - gx_device_ijs *ijsdev = (gx_device_ijs *)dev; - -+ if (ijsdev->memory->gs_lib_ctx->core->path_control_active) -+ return_error(gs_error_invalidaccess); - if (!ijsdev->ColorSpace) { - ijsdev->ColorSpace = gs_malloc(ijsdev->memory, sizeof(rgb), 1, - "gsijs_initialize"); -@@ -1326,7 +1328,7 @@ gsijs_put_params(gx_device *dev, gs_param_list *plist) - if (code >= 0) - code = gsijs_read_string(plist, "IjsServer", - ijsdev->IjsServer, sizeof(ijsdev->IjsServer), -- dev->LockSafetyParams, is_open); -+ ijsdev->memory->gs_lib_ctx->core->path_control_active, is_open); - - if (code >= 0) - code = gsijs_read_string_malloc(plist, "DeviceManufacturer", diff --git a/ghostscript-10.02.1-PostScript-Fix-selectdevice.patch b/ghostscript-10.02.1-PostScript-Fix-selectdevice.patch new file mode 100644 index 0000000..3aefed8 --- /dev/null +++ b/ghostscript-10.02.1-PostScript-Fix-selectdevice.patch @@ -0,0 +1,33 @@ +From 2febe352146a62c77d62a5b5dde9607f66575d14 Mon Sep 17 00:00:00 2001 +Message-ID: <2febe352146a62c77d62a5b5dde9607f66575d14.1699398720.git.mjg@fedoraproject.org> +From: Ken Sharp +Date: Mon, 6 Nov 2023 15:30:18 +0000 +Subject: [PATCH] PostScript - Fix selectdevice + +Bug 707310 "`selectdevice` no longer works" + +This was an oversight. Fixed here. + +In future I anticipate removing selectdevice as well, as it doesn't do +anything that can't be done using setpagedevice (and .defaultscreen). +However, it is currently documented, so this restores the behaviour. +--- + Resource/Init/gs_init.ps | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps +index 958e8247c..d6b55efb2 100644 +--- a/Resource/Init/gs_init.ps ++++ b/Resource/Init/gs_init.ps +@@ -871,7 +871,7 @@ currentdict /.makeinternaldict .undef + ifelse + } bind def + /selectdevice +- { finddevice setdevice .setdefaultscreen } bind def ++ { finddevice setdevice .setdefaultscreen } bind odef + /signalerror % signalerror - + { /errordict .systemvar exch get exec } bind def + /signaloperror { % signaloperror - +-- +2.43.0.rc0.447.g76a1efa614 + diff --git a/ghostscript-10.02.1-txtwrite-device-needs-to-countdown-the-device-on-tex.patch b/ghostscript-10.02.1-txtwrite-device-needs-to-countdown-the-device-on-tex.patch new file mode 100644 index 0000000..2eddb04 --- /dev/null +++ b/ghostscript-10.02.1-txtwrite-device-needs-to-countdown-the-device-on-tex.patch @@ -0,0 +1,31 @@ +From ea661034db7eb667375981dae883d0c9e7d79799 Mon Sep 17 00:00:00 2001 +Message-ID: +From: Ken Sharp +Date: Mon, 18 Sep 2023 17:40:18 +0100 +Subject: [PATCH] txtwrite device - needs to countdown the device on + text_release + +Bug #707132 "Error: finalizing subclassing device while child refcount > 1" + +The txtwrite device calls gs_text_enum_init() which counts up the +device, but does not count it down again when the enumertor is +released. Fixed here. +--- + devices/vector/gdevtxtw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/devices/vector/gdevtxtw.c b/devices/vector/gdevtxtw.c +index f64284f07..089d32f7e 100644 +--- a/devices/vector/gdevtxtw.c ++++ b/devices/vector/gdevtxtw.c +@@ -2059,6 +2059,7 @@ textw_text_release(gs_text_enum_t *pte, client_name_t cname) + gs_free(tdev->memory, penum->text_state, 1, sizeof(penum->text_state), "txtwrite free text state"); + penum->text_state = NULL; + } ++ rc_decrement_only(pte->dev, "textw_text_release"); + } + + /* This is the list of methods for the text enumerator */ +-- +2.43.0.rc0.447.g76a1efa614 + diff --git a/ghostscript.spec b/ghostscript.spec index 783b84f..bf51159 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -45,7 +45,7 @@ Name: ghostscript Summary: Interpreter for PostScript language & PDF Version: 10.02.1 -Release: 3%{?dist} +Release: 4%{?dist} License: AGPL-3.0-or-later @@ -105,6 +105,8 @@ BuildRequires: make # Upstream patches -- official upstream patches released by upstream since the # ---------------- last rebase that are necessary for any reason: #Patch000: example000.patch +Patch: ghostscript-10.02.1-txtwrite-device-needs-to-countdown-the-device-on-tex.patch +Patch: ghostscript-10.02.1-PostScript-Fix-selectdevice.patch # Downstream patches -- these should be always included when doing rebase: # ------------------ @@ -418,6 +420,9 @@ done # ============================================================================= %changelog +* Tue Nov 07 2023 Michael J Gruber - 10.02.1-4 +- fix txtwrite device and /selectdevice + * Tue Nov 07 2023 Michael J Gruber - 10.02.1-3 - revert/adjust spec change for jbig2dec 0.20 and fix FTI (rhbz#2248557)