diff options
Diffstat (limited to 'gnu/packages/patches/ghostscript-CVE-2016-7979.patch')
| -rw-r--r-- | gnu/packages/patches/ghostscript-CVE-2016-7979.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/gnu/packages/patches/ghostscript-CVE-2016-7979.patch b/gnu/packages/patches/ghostscript-CVE-2016-7979.patch new file mode 100644 index 0000000000..a557adfdea --- /dev/null +++ b/gnu/packages/patches/ghostscript-CVE-2016-7979.patch @@ -0,0 +1,48 @@ +The following patch was adapted for GNU Ghostscript +by Mark H Weaver <mhw@netris.org> based on: + +http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=875a0095f37626a721c7ff57d606a0f95af03913 + +From 875a0095f37626a721c7ff57d606a0f95af03913 Mon Sep 17 00:00:00 2001 +From: Ken Sharp <ken.sharp@artifex.com> +Date: Wed, 5 Oct 2016 10:10:58 +0100 +Subject: [PATCH] DSC parser - validate parameters + +Bug #697190 ".initialize_dsc_parser doesn't validate the parameter is a dict type before using it." + +Regardless of any security implications, its simply wrong for a PostScript +operator not to validate its parameter(s). + +No differences expected. +--- + psi/zdscpars.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/psi/zdscpars.c b/psi/zdscpars.c +index c05e154..9b4b605 100644 +--- a/psi/zdscpars.c ++++ b/psi/zdscpars.c +@@ -150,11 +150,16 @@ zinitialize_dsc_parser(i_ctx_t *i_ctx_p) + ref local_ref; + int code; + os_ptr const op = osp; +- dict * const pdict = op->value.pdict; +- gs_memory_t * const mem = (gs_memory_t *)dict_memory(pdict); +- dsc_data_t * const data = +- gs_alloc_struct(mem, dsc_data_t, &st_dsc_data_t, "DSC parser init"); ++ dict *pdict; ++ gs_memory_t *mem; ++ dsc_data_t *data; + ++ check_read_type(*op, t_dictionary); ++ ++ pdict = op->value.pdict; ++ mem = (gs_memory_t *)dict_memory(pdict); ++ ++ data = gs_alloc_struct(mem, dsc_data_t, &st_dsc_data_t, "DSC parser init"); + if (!data) + return_error(e_VMerror); + data->document_level = 0; +-- +2.9.1 + |