cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE-2017-8291 shell injection in ghostscript.

Browse Source 
Apply patches from upstream git.
OK kili@ (maintainer)
This commit is contained in:
bluhm 2017-05-04 06:51:09 +00:00
parent 9db28f77b9
commit 8bdd831304
3 changed files with 71 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
print/ghostscript/gnu/Makefile
View File

@ -1,4 +1,4 @@
# $OpenBSD: Makefile,v 1.108 2016/09/13 18:52:05 naddy Exp $
# $OpenBSD: Makefile,v 1.109 2017/05/04 06:51:09 bluhm Exp $
COMMENT= GNU PostScript interpreter
@ -6,7 +6,7 @@ VERSION= 9.07
DISTNAME= ghostscript-${VERSION}
CATEGORIES= print lang
SHARED_LIBS= gs 15.0
REVISION= 3
REVISION= 4
MASTER_SITES= http://downloads.ghostscript.com/public/

49
print/ghostscript/gnu/patches/patch-psi_zfrsd_c Normal file
View File

@ -0,0 +1,49 @@
$OpenBSD: patch-psi_zfrsd_c,v 1.1 2017/05/04 06:51:09 bluhm Exp $
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce1
Index: psi/zfrsd.c
--- psi/zfrsd.c.orig
+++ psi/zfrsd.c
@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p)
ref *pFilter;
ref *pDecodeParms;
int Intent = 0;
- bool AsyncRead;
+ bool AsyncRead = false;
ref empty_array, filter1_array, parms1_array;
uint i;
- int code;
+ int code = 0;
+ if (ref_stack_count(&o_stack) < 1)
+ return_error(e_stackunderflow);
+ if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {
+ return_error(e_typecheck);
+ }
+
make_empty_array(&empty_array, a_readonly);
- if (dict_find_string(op, "Filter", &pFilter) > 0) {
+ if (r_has_type(op, t_dictionary)
+ && dict_find_string(op, "Filter", &pFilter) > 0) {
if (!r_is_array(pFilter)) {
if (!r_has_type(pFilter, t_name))
return_error(e_typecheck);
@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p)
return_error(e_typecheck);
}
}
- code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
+ if (r_has_type(op, t_dictionary))
+ code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
if (code < 0 && code != e_rangecheck) /* out-of-range int is ok, use 0 */
return code;
- if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0
- )
- return code;
+ if (r_has_type(op, t_dictionary))
+ if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0)
+ return code;
push(1);
op[-1] = *pFilter;
if (pDecodeParms)

20
print/ghostscript/gnu/patches/patch-psi_zmisc3_c Normal file
View File

@ -0,0 +1,20 @@
$OpenBSD: patch-psi_zmisc3_c,v 1.1 2017/05/04 06:51:09 bluhm Exp $
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88
Index: psi/zmisc3.c
--- psi/zmisc3.c.orig
+++ psi/zmisc3.c
@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p)
ref2_t stack[MAX_DEPTH + 1];
ref2_t *top = stack;
+ if (ref_stack_count(&o_stack) < 2)
+ return_error(e_stackunderflow);
+ if (!r_is_array(op - 1) || !r_is_array(op)) {
+ return_error(e_typecheck);
+ }
+
make_array(&stack[0].proc1, 0, 1, op - 1);
make_array(&stack[0].proc2, 0, 1, op);
for (;;) {