From ff17cad90e079f54d6c0632ab1d463b9d1ca9c37 Mon Sep 17 00:00:00 2001 From: Tim Waugh Date: Tue, 23 Oct 2007 13:37:33 +0000 Subject: [PATCH] - Applied patch from upstream to fix CVE-2007-2721 (bug #346511). --- ghostscript-CVE-2007-2721.patch | 48 +++++++++++++++++++++++++++++++++ ghostscript.spec | 10 ++++++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 ghostscript-CVE-2007-2721.patch diff --git a/ghostscript-CVE-2007-2721.patch b/ghostscript-CVE-2007-2721.patch new file mode 100644 index 0000000..aa59ce3 --- /dev/null +++ b/ghostscript-CVE-2007-2721.patch @@ -0,0 +1,48 @@ +diff -up ghostscript-8.60/jasper/src/libjasper/jp2/jp2_cod.c.CVE-2007-2721 ghostscript-8.60/jasper/src/libjasper/jp2/jp2_cod.c +--- ghostscript-8.60/jasper/src/libjasper/jp2/jp2_cod.c.CVE-2007-2721 2006-02-08 06:21:28.000000000 +0000 ++++ ghostscript-8.60/jasper/src/libjasper/jp2/jp2_cod.c 2007-10-23 14:15:01.000000000 +0100 +@@ -247,7 +247,7 @@ jp2_box_t *jp2_box_get(jas_stream_t *in) + box = 0; + tmpstream = 0; + +- if (!(box = jas_malloc(sizeof(jp2_box_t)))) { ++ if (!(box = jas_calloc(1, sizeof(jp2_box_t)))) { + goto error; + } + box->ops = &jp2_boxinfo_unk.ops; +diff -up ghostscript-8.60/jasper/src/libjasper/jpc/jpc_cs.c.CVE-2007-2721 ghostscript-8.60/jasper/src/libjasper/jpc/jpc_cs.c +--- ghostscript-8.60/jasper/src/libjasper/jpc/jpc_cs.c.CVE-2007-2721 2006-02-08 06:21:28.000000000 +0000 ++++ ghostscript-8.60/jasper/src/libjasper/jpc/jpc_cs.c 2007-10-23 14:15:01.000000000 +0100 +@@ -991,7 +991,10 @@ static int jpc_qcx_getcompparms(jpc_qcxc + compparms->numstepsizes = (len - n) / 2; + break; + } +-if (compparms->numstepsizes > 0) { ++if (compparms->numstepsizes > 3 * JPC_MAXRLVLS + 1) { ++ jpc_qcx_destroycompparms(compparms); ++ return -1; ++ } else if (compparms->numstepsizes > 0) { + compparms->stepsizes = jas_malloc(compparms->numstepsizes * + sizeof(uint_fast32_t)); + assert(compparms->stepsizes); +diff -up ghostscript-8.60/jasper/src/libjasper/jpc/jpc_dec.c.CVE-2007-2721 ghostscript-8.60/jasper/src/libjasper/jpc/jpc_dec.c +--- ghostscript-8.60/jasper/src/libjasper/jpc/jpc_dec.c.CVE-2007-2721 2006-12-06 22:25:01.000000000 +0000 ++++ ghostscript-8.60/jasper/src/libjasper/jpc/jpc_dec.c 2007-10-23 14:15:01.000000000 +0100 +@@ -1219,7 +1219,7 @@ static int jpc_dec_process_siz(jpc_dec_t + dec->numhtiles = JPC_CEILDIV(dec->xend - dec->tilexoff, dec->tilewidth); + dec->numvtiles = JPC_CEILDIV(dec->yend - dec->tileyoff, dec->tileheight); + dec->numtiles = dec->numhtiles * dec->numvtiles; +- if (!(dec->tiles = jas_malloc(dec->numtiles * sizeof(jpc_dec_tile_t)))) { ++ if (!(dec->tiles = jas_calloc(dec->numtiles, sizeof(jpc_dec_tile_t)))) { + return -1; + } + +@@ -1243,7 +1243,7 @@ static int jpc_dec_process_siz(jpc_dec_t + tile->pkthdrstreampos = 0; + tile->pptstab = 0; + tile->cp = 0; +- if (!(tile->tcomps = jas_malloc(dec->numcomps * ++ if (!(tile->tcomps = jas_calloc(dec->numcomps, + sizeof(jpc_dec_tcomp_t)))) { + return -1; + } diff --git a/ghostscript.spec b/ghostscript.spec index 20f0289..b2d9a53 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -5,7 +5,7 @@ Summary: A PostScript(TM) interpreter and renderer. Name: ghostscript Version: %{gs_ver} -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2 URL: http://www.ghostscript.com/ @@ -21,6 +21,7 @@ Patch3: ghostscript-noopt.patch Patch4: ghostscript-fPIC.patch Patch5: http://www.openprinting.org/download/printing/esp-gpl-ghostscript-merge/ghostscript-8.57-ijs-krgb.patch Patch6: ghostscript-mkstemp64.patch +Patch7: ghostscript-CVE-2007-2721.patch Requires: urw-fonts >= 1.1, ghostscript-fonts BuildRequires: libjpeg-devel, libXt-devel @@ -89,8 +90,12 @@ A GTK-enabled version of Ghostscript, called 'gsx'. # IJS KRGB patch. %patch5 -p1 -b .ijs-krgb +# From upstream. %patch6 -p1 -b .mkstemp64 +# Applied patch from upstream to fix CVE-2007-2721 (bug #346511). +%patch7 -p1 -b .CVE-2007-2721 + # Convert manual pages to UTF-8 from8859_1() { iconv -f iso-8859-1 -t utf-8 < "$1" > "${1}_" @@ -269,6 +274,9 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/libgs.so %changelog +* Tue Oct 23 2007 Tim Waugh 8.60-5 +- Applied patch from upstream to fix CVE-2007-2721 (bug #346511). + * Tue Oct 9 2007 Tim Waugh 8.60-4 - Marked localized man pages as %%lang (bug #322321).