aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2015-07-31 15:07:22 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2015-07-31 15:08:00 +0000
commit65e4c60a4f8332d1525882aa8b02db6d3c554ffe (patch)
tree8c3084cf5fea3f330ba29201cf2648f80ef1bf33
parentf9376f05439ebebe90c0fb5ef0bf2e8a45c86259 (diff)
downloadaports-65e4c60a4f8332d1525882aa8b02db6d3c554ffe.tar.bz2
aports-65e4c60a4f8332d1525882aa8b02db6d3c554ffe.tar.xz
main/ghostscript: security fix for CVE-2015-3228
ref #4468
-rw-r--r--main/ghostscript/APKBUILD12
-rw-r--r--main/ghostscript/CVE-2015-3228.patch29
2 files changed, 37 insertions, 4 deletions
diff --git a/main/ghostscript/APKBUILD b/main/ghostscript/APKBUILD
index e62f5fa1bf..b574c54664 100644
--- a/main/ghostscript/APKBUILD
+++ b/main/ghostscript/APKBUILD
@@ -2,7 +2,7 @@
# Maintainer: Cameron Banta <cbanta@gmail.com>
pkgname=ghostscript
pkgver=9.16
-pkgrel=1
+pkgrel=2
pkgdesc="An interpreter for the PostScript language and for PDF"
url="http://ghostscript.com/"
arch="all"
@@ -16,6 +16,7 @@ source="http://downloads.ghostscript.com/public/$pkgname-$pkgver.tar.gz
ghostscript-system-openjpeg2.patch
ghostscript-wrf-snprintf.patch
fix-sprintf.patch
+ CVE-2015-3228.patch
"
_builddir="$srcdir/ghostscript-$pkgver"
@@ -114,14 +115,17 @@ md5sums="829319325bbdb83f5c81379a8f86f38f ghostscript-9.16.tar.gz
c180cac458c6ab7bcd319fe092abb9cd ghostscript-system-zlib.patch
7bc12888cccf6d2827d0ff012813220f ghostscript-system-openjpeg2.patch
f5129f6cc01a3d593cf02fe1ef94cbe8 ghostscript-wrf-snprintf.patch
-ed14fa288463e08e1e6074a5d1ebbcbb fix-sprintf.patch"
+ed14fa288463e08e1e6074a5d1ebbcbb fix-sprintf.patch
+27971c7530ffd4e4046d1ffb61cac13d CVE-2015-3228.patch"
sha256sums="746d77280cca8afdd3d4c2c1389e332ed9b0605bd107bcaae1d761b061d1a68d ghostscript-9.16.tar.gz
bcbd4154fc186b3564fa6140d57117f243a5d703823c03443434c09aeef20684 ghostscript-system-zlib.patch
0d029c98b2149715b63d2eae9634eca0d427bf77e713dd355854412fc92b35ac ghostscript-system-openjpeg2.patch
3ca8f75d743aae7f2baa109a2a9217c33867c13e88e0ddbc96dc9be39157ae72 ghostscript-wrf-snprintf.patch
-3051dff937ab9ced9f88b36384400b10bc9cdb39b2abd3ece8f4c41a0246874e fix-sprintf.patch"
+3051dff937ab9ced9f88b36384400b10bc9cdb39b2abd3ece8f4c41a0246874e fix-sprintf.patch
+e6407cc5d74b6963242efec942c92b093a076c835451e6b949417b85d24c85d1 CVE-2015-3228.patch"
sha512sums="cd7da12f55379f7d388bd2573a307426da230a2220766a7138ab49990fb34343801a6d5e76ba0f4d6c97a5871359658ca043fcc700242b02f30de30a15b2847f ghostscript-9.16.tar.gz
6449fe3594d2b61aa4a96762a91db847242dbbb407c6743af8a5db0f7f18bb82df3c89e974e6b23deecaaf7b6bf1fb6930713cbe6229ec3d8b26dd65115893a8 ghostscript-system-zlib.patch
f874540fc53f85a3587253aaf8a29fc7792590938daf7f44e573cbbdac258b39db8baccce9569737c5c1a0a3816c6a8ff55b97f60dbefbba0c1729fd202d0ddd ghostscript-system-openjpeg2.patch
86f30dd61c4ee87e1cf72686da4ee6d0dd89100e122279c038dd7cb813a72b95d170ca2ae8cf6a10f2a01b18e49c704dc6aca5cbb5253886908332a90b7a7c2b ghostscript-wrf-snprintf.patch
-300712709ec75f728c703f6a2a5abd992b7c2137df81cc1dd4f6e96c690077e0d5a4afd0e06ce55660061911ddfbf1e68d7020ec3e5f2124602133a10451ec42 fix-sprintf.patch"
+300712709ec75f728c703f6a2a5abd992b7c2137df81cc1dd4f6e96c690077e0d5a4afd0e06ce55660061911ddfbf1e68d7020ec3e5f2124602133a10451ec42 fix-sprintf.patch
+142772a600d69e48e2a58d84ebf08fb89a8794cfa0424b81f35b7bb99399a07ed2bbfb2a2e7c60663f3e8cfcc223c04c23433cb81a3ab5dbd59cd8252f930367 CVE-2015-3228.patch"
diff --git a/main/ghostscript/CVE-2015-3228.patch b/main/ghostscript/CVE-2015-3228.patch
new file mode 100644
index 0000000000..ebd87f7bf7
--- /dev/null
+++ b/main/ghostscript/CVE-2015-3228.patch
@@ -0,0 +1,29 @@
+From 0c0b0859ae1aba64861599f0e7f74f143f305932 Mon Sep 17 00:00:00 2001
+From: Chris Liddell <chris.liddell@artifex.com>
+Date: Tue, 7 Jul 2015 16:57:41 +0100
+Subject: [PATCH] Bug 696041: sanity check for memory allocation.
+
+In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the
+variable holding the actual number of bytes we allocate.
+
+No cluster differences
+---
+ gs/base/gsmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gs/base/gsmalloc.c b/gs/base/gsmalloc.c
+index 624552d..cad79c2 100644
+--- a/base/gsmalloc.c
++++ b/base/gsmalloc.c
+@@ -178,7 +178,7 @@ gs_heap_alloc_bytes(gs_memory_t * mem, uint size, client_name_t cname)
+ } else {
+ uint added = size + sizeof(gs_malloc_block_t);
+
+- if (mmem->limit - added < mmem->used)
++ if (added <= size || mmem->limit - added < mmem->used)
+ set_msg("exceeded limit");
+ else if ((ptr = (byte *) Memento_label(malloc(added), cname)) == 0)
+ set_msg("failed");
+--
+2.4.6
+