diff options
| author | Daniel Sabogal <dsabogalcc@gmail.com> | 2017-05-03 13:41:29 -0400 |
|---|---|---|
| committer | Leonardo Arena <rnalrd@alpinelinux.org> | 2017-05-10 09:24:46 +0000 |
| commit | 0a5ced2a76fa26cf8046b45043f634f0c8a271ae (patch) | |
| tree | b21d5609f52d45d06b5675ff03dedec930ce9604 /main/ghostscript/CVE-2017-8291.patch | |
| parent | a07d9f929286a0f3ccf9ea20f55c62b03f91c4c4 (diff) | |
| download | aports-0a5ced2a76fa26cf8046b45043f634f0c8a271ae.tar.bz2 aports-0a5ced2a76fa26cf8046b45043f634f0c8a271ae.tar.xz | |
main/ghostscript: security fix for CVE-2017-8291
Diffstat (limited to 'main/ghostscript/CVE-2017-8291.patch')
| -rw-r--r-- | main/ghostscript/CVE-2017-8291.patch | 60 |
1 files changed, 60 insertions, 0 deletions
diff --git a/main/ghostscript/CVE-2017-8291.patch b/main/ghostscript/CVE-2017-8291.patch new file mode 100644 index 0000000000..83f3b4fcc5 --- /dev/null +++ b/main/ghostscript/CVE-2017-8291.patch @@ -0,0 +1,60 @@ +From 04b37bbce174eed24edec7ad5b920eb93db4d47d Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Thu, 27 Apr 2017 13:21:31 +0100 +Subject: [PATCH] Bug 697799: have .rsdparams check its parameters + +The Ghostscript internal operator .rsdparams wasn't checking the number or +type of the operands it was being passed. Do so. +--- + psi/zfrsd.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/psi/zfrsd.c b/psi/zfrsd.c +index 191107d..950588d 100644 +--- a/psi/zfrsd.c ++++ b/psi/zfrsd.c +@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p) + ref *pFilter; + ref *pDecodeParms; + int Intent = 0; +- bool AsyncRead; ++ bool AsyncRead = false; + ref empty_array, filter1_array, parms1_array; + uint i; +- int code; ++ int code = 0; ++ ++ if (ref_stack_count(&o_stack) < 1) ++ return_error(gs_error_stackunderflow); ++ if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) { ++ return_error(gs_error_typecheck); ++ } + + make_empty_array(&empty_array, a_readonly); +- if (dict_find_string(op, "Filter", &pFilter) > 0) { ++ if (r_has_type(op, t_dictionary) ++ && dict_find_string(op, "Filter", &pFilter) > 0) { + if (!r_is_array(pFilter)) { + if (!r_has_type(pFilter, t_name)) + return_error(gs_error_typecheck); +@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p) + return_error(gs_error_typecheck); + } + } +- code = dict_int_param(op, "Intent", 0, 3, 0, &Intent); ++ if (r_has_type(op, t_dictionary)) ++ code = dict_int_param(op, "Intent", 0, 3, 0, &Intent); + if (code < 0 && code != gs_error_rangecheck) /* out-of-range int is ok, use 0 */ + return code; +- if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0 +- ) +- return code; ++ if (r_has_type(op, t_dictionary)) ++ if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0) ++ return code; + push(1); + op[-1] = *pFilter; + if (pDecodeParms) +-- +2.9.1 + |