summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHongxu Jia <hongxu.jia@windriver.com>2018-11-28 15:02:54 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-12-01 11:38:36 +0000
commit93db812f0c8a5612e95464d29f04f2e48e9879bc (patch)
treee0fc3cd466c3c4197beb4d02b5e437fe88f12b75
parent407138c7e59d1fe871cc563d57311e1223edd5c2 (diff)
downloadpoky-93db812f0c8a5612e95464d29f04f2e48e9879bc.tar.gz
ghostscript: 9.25 -> 9.26
- Drop backported CVE fixes 000[1-8]*.patch (From OE-Core rev: f30bd6bf01dbf81f0872382be44d507fb981f953) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-extended/ghostscript/files/0001-Bug-699795-add-operand-checking-to-.setnativefontmap.patch59
-rw-r--r--meta/recipes-extended/ghostscript/files/0002-Bug-699816-Improve-hiding-of-security-critical-custo.patch434
-rw-r--r--meta/recipes-extended/ghostscript/files/0003-Bug-699832-add-control-over-hiding-error-handlers.patch172
-rw-r--r--meta/recipes-extended/ghostscript/files/0004-For-hidden-operators-pass-a-name-object-to-error-han.patch105
-rw-r--r--meta/recipes-extended/ghostscript/files/0005-Bug-699938-.loadfontloop-must-be-an-operator.patch31
-rw-r--r--meta/recipes-extended/ghostscript/files/0006-Undefine-some-additional-internal-operators.patch42
-rw-r--r--meta/recipes-extended/ghostscript/files/0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch197
-rw-r--r--meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch245
-rw-r--r--meta/recipes-extended/ghostscript/ghostscript_9.26.bb (renamed from meta/recipes-extended/ghostscript/ghostscript_9.25.bb)14
9 files changed, 3 insertions, 1296 deletions
diff --git a/meta/recipes-extended/ghostscript/files/0001-Bug-699795-add-operand-checking-to-.setnativefontmap.patch b/meta/recipes-extended/ghostscript/files/0001-Bug-699795-add-operand-checking-to-.setnativefontmap.patch
deleted file mode 100644
index f175da0caf..0000000000
--- a/meta/recipes-extended/ghostscript/files/0001-Bug-699795-add-operand-checking-to-.setnativefontmap.patch
+++ /dev/null
@@ -1,59 +0,0 @@
1From 274b2cc08b0d10a4cac3fe8b50022889f22580cb Mon Sep 17 00:00:00 2001
2From: Chris Liddell <chris.liddell@artifex.com>
3Date: Thu, 20 Sep 2018 16:35:28 +0100
4Subject: [PATCH 1/5] Bug 699795: add operand checking to
5 .setnativefontmapbuilt
6
7.setnativefontmapbuilt .forceputs a value into systemdict - it is intended
8to be a boolean, but in this case was being called with a compound object
9(a dictionary). Such an object, in local VM, being forced into systemdict
10would then confuse the garbager, since it could be restored away with the
11reference remaining.
12
13This adds operand checking, so .setnativefontmapbuilt will simply ignore
14anything other than a boolean value, and also removes the definition of
15.setnativefontmapbuilt after use, since it is only used in two, closely
16related places.
17
18CVE: CVE-2018-17961
19Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
20Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
21---
22 Resource/Init/gs_fonts.ps | 11 ++++++++---
23 1 file changed, 8 insertions(+), 3 deletions(-)
24
25diff --git a/Resource/Init/gs_fonts.ps b/Resource/Init/gs_fonts.ps
26index 38f0f6c..45b6613 100644
27--- a/Resource/Init/gs_fonts.ps
28+++ b/Resource/Init/gs_fonts.ps
29@@ -372,9 +372,13 @@ FONTPATH length 0 eq { (%END FONTPATH) .skipeof } if
30 % of strings: what the system thinks is the ps name,
31 % and the access path.
32 /.setnativefontmapbuilt { % set whether we've been run
33- systemdict exch /.nativefontmapbuilt exch .forceput
34+ dup type /booleantype eq {
35+ systemdict exch /.nativefontmapbuilt exch .forceput
36+ }
37+ {pop}
38+ ifelse
39 } .bind executeonly def
40-systemdict /NONATIVEFONTMAP known .setnativefontmapbuilt
41+systemdict /NONATIVEFONTMAP known //.setnativefontmapbuilt exec
42 /.buildnativefontmap { % - .buildnativefontmap <bool>
43 systemdict /.nativefontmapbuilt .knownget not
44 { //false} if
45@@ -415,9 +419,10 @@ systemdict /NONATIVEFONTMAP known .setnativefontmapbuilt
46 } forall
47 } if
48 % record that we've been run
49- //true .setnativefontmapbuilt
50+ //true //.setnativefontmapbuilt exec
51 } ifelse
52 } bind def
53+currentdict /.setnativefontmapbuilt .forceundef
54
55 % Create the dictionary that registers the .buildfont procedure
56 % (called by definefont) for each FontType.
57--
582.7.4
59
diff --git a/meta/recipes-extended/ghostscript/files/0002-Bug-699816-Improve-hiding-of-security-critical-custo.patch b/meta/recipes-extended/ghostscript/files/0002-Bug-699816-Improve-hiding-of-security-critical-custo.patch
deleted file mode 100644
index 000f9c9ef2..0000000000
--- a/meta/recipes-extended/ghostscript/files/0002-Bug-699816-Improve-hiding-of-security-critical-custo.patch
+++ /dev/null
@@ -1,434 +0,0 @@
1From 0661bf23a5be32973682e17afed4a2f23a8214ba Mon Sep 17 00:00:00 2001
2From: Chris Liddell <chris.liddell@artifex.com>
3Date: Sat, 29 Sep 2018 15:34:55 +0100
4Subject: [PATCH 2/5] Bug 699816: Improve hiding of security critical custom
5 operators
6
7Make procedures that use .forceput/.forcedef/.forceundef into operators.
8
9The result of this is that errors get reported against the "top" operator,
10rather than the "called" operator within the procedure.
11
12For example:
13/myproc
14{
15 myop
16} bind def
17
18If 'myop' throws an error, the error handler will be passed the 'myop'
19operator. Promoting 'myproc' to a operator means the error handler will be
20passed 'myproc'.
21
22CVE: CVE-2018-17961
23Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
24Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
25---
26 Resource/Init/gs_diskn.ps | 2 +-
27 Resource/Init/gs_dps.ps | 2 +-
28 Resource/Init/gs_fntem.ps | 2 +-
29 Resource/Init/gs_fonts.ps | 10 +++++-----
30 Resource/Init/gs_lev2.ps | 13 +++++++++----
31 Resource/Init/gs_pdfwr.ps | 2 +-
32 Resource/Init/gs_setpd.ps | 25 +++++++++++++++++--------
33 Resource/Init/gs_typ32.ps | 14 +++++++++-----
34 Resource/Init/gs_type1.ps | 2 +-
35 Resource/Init/pdf_base.ps | 2 +-
36 Resource/Init/pdf_draw.ps | 10 +++++-----
37 Resource/Init/pdf_font.ps | 8 ++++----
38 Resource/Init/pdf_main.ps | 4 ++--
39 Resource/Init/pdf_ops.ps | 8 ++++----
40 14 files changed, 61 insertions(+), 43 deletions(-)
41
42diff --git a/Resource/Init/gs_diskn.ps b/Resource/Init/gs_diskn.ps
43index 5540715..26ec0b5 100644
44--- a/Resource/Init/gs_diskn.ps
45+++ b/Resource/Init/gs_diskn.ps
46@@ -53,7 +53,7 @@ systemdict begin
47 exch .setglobal
48 }
49 if
50-} .bind executeonly def % must be bound and hidden for .forceput
51+} .bind executeonly odef % must be bound and hidden for .forceput
52
53 % Modify .putdevparams to force regeneration of .searchabledevs list
54 /.putdevparams {
55diff --git a/Resource/Init/gs_dps.ps b/Resource/Init/gs_dps.ps
56index cad7056..daf7b0f 100644
57--- a/Resource/Init/gs_dps.ps
58+++ b/Resource/Init/gs_dps.ps
59@@ -70,7 +70,7 @@
60 % Save a copy of the initial gstate.
61 //systemdict /savedinitialgstate gstate readonly .forceput
62 .setglobal
63-} .bind executeonly def % must be bound and hidden for .forceput
64+} .bind executeonly odef % must be bound and hidden for .forceput
65
66 % Initialize local dictionaries and gstate when creating a new context.
67 % Note that until this completes, we are in the anomalous situation of
68diff --git a/Resource/Init/gs_fntem.ps b/Resource/Init/gs_fntem.ps
69index 3ceee18..c1f7651 100644
70--- a/Resource/Init/gs_fntem.ps
71+++ b/Resource/Init/gs_fntem.ps
72@@ -408,7 +408,7 @@ currentdict end def
73 exit
74 } loop
75 exch setglobal
76-} .bind executeonly def % must be bound and hidden for .forceput
77+} .bind executeonly odef % must be bound and hidden for .forceput
78
79 currentdict end /ProcSet defineresource pop
80
81diff --git a/Resource/Init/gs_fonts.ps b/Resource/Init/gs_fonts.ps
82index 45b6613..89c3ab7 100644
83--- a/Resource/Init/gs_fonts.ps
84+++ b/Resource/Init/gs_fonts.ps
85@@ -377,8 +377,8 @@ FONTPATH length 0 eq { (%END FONTPATH) .skipeof } if
86 }
87 {pop}
88 ifelse
89-} .bind executeonly def
90-systemdict /NONATIVEFONTMAP known //.setnativefontmapbuilt exec
91+} .bind executeonly odef
92+systemdict /NONATIVEFONTMAP known .setnativefontmapbuilt
93 /.buildnativefontmap { % - .buildnativefontmap <bool>
94 systemdict /.nativefontmapbuilt .knownget not
95 { //false} if
96@@ -419,7 +419,7 @@ systemdict /NONATIVEFONTMAP known //.setnativefontmapbuilt exec
97 } forall
98 } if
99 % record that we've been run
100- //true //.setnativefontmapbuilt exec
101+ //true .setnativefontmapbuilt
102 } ifelse
103 } bind def
104 currentdict /.setnativefontmapbuilt .forceundef
105@@ -1103,7 +1103,7 @@ $error /SubstituteFont { } put
106
107 % Check to make sure the font was actually loaded.
108 dup 3 index .fontknownget
109- { dup /PathLoad 4 index //.putgstringcopy exec
110+ { dup /PathLoad 4 index .putgstringcopy
111 4 1 roll pop pop pop //true exit
112 } if
113
114@@ -1115,7 +1115,7 @@ $error /SubstituteFont { } put
115 { % Stack: origfontname fontdirectory path filefontname
116 2 index 1 index .fontknownget
117 { % Yes. Stack: origfontname fontdirectory path filefontname fontdict
118- dup 4 -1 roll /PathLoad exch //.putgstringcopy exec
119+ dup 4 -1 roll /PathLoad exch .putgstringcopy
120 % Stack: origfontname fontdirectory filefontname fontdict
121 3 -1 roll pop
122 % Stack: origfontname filefontname fontdict
123diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
124index eee0b9f..a8ed892 100644
125--- a/Resource/Init/gs_lev2.ps
126+++ b/Resource/Init/gs_lev2.ps
127@@ -163,10 +163,11 @@ end
128 % Set them again to the new values. From here on, we are safe,
129 % since a context switch will consult userparams.
130 .setuserparams
131-} .bind executeonly def % must be bound and hidden for .forceput
132+} .bind executeonly odef % must be bound and hidden for .forceput
133
134 /setuserparams { % <dict> setuserparams -
135- .setuserparams2
136+ {.setuserparams2} stopped
137+ {/setuserparams load $error /errorname get signalerror} if
138 } .bind odef
139 % Initialize user parameters managed here.
140 /JobName () .definepsuserparam
141@@ -415,7 +416,9 @@ psuserparams /ProcessDSCComment {.checkprocesscomment} put
142
143 % VMReclaim and VMThreshold are user parameters.
144 /setvmthreshold { % <int> setvmthreshold -
145- mark /VMThreshold 2 .argindex .dicttomark .setuserparams2 pop
146+ mark /VMThreshold 2 .argindex .dicttomark {.setuserparams2} stopped
147+ {pop /setvmthreshold load $error /errorname get signalerror}
148+ {pop} ifelse
149 } odef
150 /vmreclaim { % <int> vmreclaim -
151 dup 0 gt {
152@@ -427,7 +430,9 @@ psuserparams /ProcessDSCComment {.checkprocesscomment} put
153 ifelse
154 } {
155 % VMReclaim userparam controls enable/disable GC
156- mark /VMReclaim 2 index .dicttomark .setuserparams2 pop
157+ mark /VMReclaim 2 index .dicttomark {.setuserparams2} stopped
158+ {pop /vmreclaim load $error /errorname get signalerror}
159+ {pop} ifelse
160 } ifelse
161 } odef
162 -1 setvmthreshold
163diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
164index fb1c419..58e75d3 100644
165--- a/Resource/Init/gs_pdfwr.ps
166+++ b/Resource/Init/gs_pdfwr.ps
167@@ -660,7 +660,7 @@ currentdict /.pdfmarkparams .undef
168 {
169 pop
170 } ifelse
171-} .bind executeonly def % must be bound and hidden for .forceput
172+} .bind executeonly odef % must be bound and hidden for .forceput
173
174 % Use the DSC processing hook to pass DSC comments to the driver.
175 % We use a pseudo-parameter named DSC whose value is an array:
176diff --git a/Resource/Init/gs_setpd.ps b/Resource/Init/gs_setpd.ps
177index 8fa7c51..afb4ffa 100644
178--- a/Resource/Init/gs_setpd.ps
179+++ b/Resource/Init/gs_setpd.ps
180@@ -608,6 +608,20 @@ NOMEDIAATTRS {
181 % in the <failed> dictionary with the policy value,
182 % and we replace the key in the <merged> dictionary with its prior value
183 % (or remove it if it had no prior value).
184+
185+% Making this an operator means we can properly hide
186+% the contents - specifically .forceput
187+/1Policy
188+{
189+ % Roll back the failed request to its previous status.
190+ SETPDDEBUG { (Rolling back.) = pstack flush } if
191+ 3 index 2 index 3 -1 roll .forceput
192+ 4 index 1 index .knownget
193+ { 4 index 3 1 roll .forceput }
194+ { 3 index exch .undef }
195+ ifelse
196+} bind executeonly odef
197+
198 /.policyprocs mark
199 % These procedures are called with the following on the stack:
200 % <orig> <merged> <failed> <Policies> <key> <policy>
201@@ -631,14 +645,7 @@ NOMEDIAATTRS {
202 /setpagedevice .systemvar /configurationerror signalerror
203 } ifelse
204 } bind
205- 1 { % Roll back the failed request to its previous status.
206-SETPDDEBUG { (Rolling back.) = pstack flush } if
207- 3 index 2 index 3 -1 roll .forceput
208- 4 index 1 index .knownget
209- { 4 index 3 1 roll .forceput }
210- { 3 index exch .undef }
211- ifelse
212- } .bind executeonly % must be bound and hidden for .forceput
213+ 1 /1Policy load
214 7 { % For PageSize only, just impose the request.
215 1 index /PageSize eq
216 { pop pop 1 index /PageSize 7 put }
217@@ -646,6 +653,8 @@ SETPDDEBUG { (Rolling back.) = pstack flush } if
218 ifelse
219 } bind
220 .dicttomark readonly def
221+currentdict /1Policy undef
222+
223 /.applypolicies % <orig> <merged> <failed> .applypolicies
224 % <orig> <merged'> <failed'>
225 { 1 index /Policies get 1 index
226diff --git a/Resource/Init/gs_typ32.ps b/Resource/Init/gs_typ32.ps
227index b6600b0..9150f71 100644
228--- a/Resource/Init/gs_typ32.ps
229+++ b/Resource/Init/gs_typ32.ps
230@@ -79,15 +79,19 @@ systemdict /.removeglyphs .undef
231 .dicttomark /ProcSet defineresource pop
232
233 /.cidfonttypes where { pop } { /.cidfonttypes 6 dict def } ifelse
234-.cidfonttypes begin
235-
236-4 % CIDFontType 4 = FontType 32
237-{ dup /FontType 32 .forceput
238+/CIDFontType4
239+{
240+ dup /FontType 32 .forceput
241 dup /CharStrings 20 dict .forceput
242 1 index exch .buildfont32 exch pop
243-} .bind executeonly def % must be bound and hidden for .forceput
244+} .bind executeonly odef
245+.cidfonttypes begin
246+
247+
248+4 /CIDFontType4 load def % CIDFontType 4 = FontType 32
249
250 end % .cidfonttypes
251+currentdict /CIDFontType4 .forceundef
252
253 % Define the BuildGlyph procedure.
254 % Since Type 32 fonts are indexed by CID, there is no BuildChar procedure.
255diff --git a/Resource/Init/gs_type1.ps b/Resource/Init/gs_type1.ps
256index efdae48..2935d9c 100644
257--- a/Resource/Init/gs_type1.ps
258+++ b/Resource/Init/gs_type1.ps
259@@ -283,7 +283,7 @@ currentdict /closesourcedict .undef
260 } if
261 2 copy /WeightVector exch .forceput
262 .setweightvector
263-} .bind executeonly def
264+} .bind executeonly odef
265 end
266
267 % Register the font types for definefont.
268diff --git a/Resource/Init/pdf_base.ps b/Resource/Init/pdf_base.ps
269index a82a2a3..7ccd4cd 100644
270--- a/Resource/Init/pdf_base.ps
271+++ b/Resource/Init/pdf_base.ps
272@@ -218,7 +218,7 @@ currentdict /num-chars-dict .undef
273 } ifelse
274 } ifelse
275 } ifelse
276-} bind executeonly def
277+} bind executeonly odef
278 /PDFScanRules_true << /PDFScanRules //true >> def
279 /PDFScanRules_null << /PDFScanRules //null >> def
280 /.pdfrun { % <file> <opdict> .pdfrun -
281diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps
282index d1b6ac9..c239daf 100644
283--- a/Resource/Init/pdf_draw.ps
284+++ b/Resource/Init/pdf_draw.ps
285@@ -1158,7 +1158,7 @@ currentdict end readonly def
286 Q
287 PDFDEBUG { pdfdict /PDFSTEPcount .knownget { 1 le } { //true } ifelse { (%End PaintProc) print dup === flush } if } if
288 PDFfile exch setfileposition
289-} bind executeonly def
290+} bind executeonly odef
291
292 /.pdfpaintproc {
293 %% Get the /m from pdfopdict (must be present)
294@@ -1189,7 +1189,7 @@ currentdict end readonly def
295 {
296 switch_to_text_marking_ops
297 } if
298-}bind executeonly def
299+}bind executeonly odef
300
301 /resolvepattern { % <patternstreamdict> resolvepattern <patterndict>
302 % Don't do the resolvestream now: just capture the data
303@@ -2353,7 +2353,7 @@ currentdict /last-ditch-bpc-csp undef
304 }{
305 pdfdict /AppearanceNumber 0 .forceput
306 } ifelse
307-}bind executeonly def
308+}bind executeonly odef
309
310 /MakeAppearanceName {
311 pdfdict /AppearanceNumber get
312@@ -2382,7 +2382,7 @@ currentdict /last-ditch-bpc-csp undef
313 DoForm
314 pdfdict /.PreservePDFForm 3 -1 roll .forceput
315 grestore
316-} bind executeonly def
317+} bind executeonly odef
318
319 /DoForm {
320 %% save the current value, if its true we will set it to false later, in order
321@@ -2541,7 +2541,7 @@ currentdict /last-ditch-bpc-csp undef
322 end
323 } if
324 pdfdict /.PreservePDFForm 3 -1 roll .forceput
325-} bind executeonly def
326+} bind executeonly odef
327
328 /_dops_save 1 array def
329
330diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
331index feaf0d0..535b14a 100644
332--- a/Resource/Init/pdf_font.ps
333+++ b/Resource/Init/pdf_font.ps
334@@ -718,7 +718,7 @@ currentdict end readonly def
335 {pop pop pop}
336 ifelse
337
338-} bind executeonly def
339+} bind executeonly odef
340
341 currentdict /.DoToUnicode? .forceundef
342
343@@ -1241,7 +1241,7 @@ currentdict /eexec_pdf_param_dict .undef
344 } bdef
345 dup currentdict Encoding .processToUnicode
346 currentdict end .completefont exch pop
347-} bind executeonly def
348+} bind executeonly odef
349 /.adjustcharwidth { % <wx> <wy> .adjustcharwidth <wx'> <wy'>
350 % Enforce the metrics, in glyph space, to the values found in the PDF Font object
351 % - force wy == 0 (assumed, and not stored in the PDF font)
352@@ -2026,7 +2026,7 @@ currentdict /CMap_read_dict undef
353 } if
354 /findresource cvx /undefined signalerror
355 } loop
356-} bind executeonly def
357+} bind executeonly odef
358
359 /buildCIDType0 { % <CIDFontType0-font-resource> buildCIDType0 <font>
360 dup /BaseFont get findCIDFont exch pop
361@@ -2211,7 +2211,7 @@ currentdict /CMap_read_dict undef
362 /Type0 //buildType0
363 /Type1 //buildType1
364 /MMType1 //buildType1
365- /Type3 //buildType3
366+ /Type3 /buildType3 load
367 /TrueType //buildTrueType
368 /CIDFontType0 //buildCIDType0
369 /CIDFontType2 //buildCIDType2
370diff --git a/Resource/Init/pdf_main.ps b/Resource/Init/pdf_main.ps
371index 09f8735..c823e69 100644
372--- a/Resource/Init/pdf_main.ps
373+++ b/Resource/Init/pdf_main.ps
374@@ -660,7 +660,7 @@ currentdict /runpdfstring .undef
375 } forall
376 pop
377 } ifelse
378-} bind executeonly def
379+} bind executeonly odef
380
381 currentdict /pdf_collection_files .undef
382
383@@ -2715,7 +2715,7 @@ currentdict /PDF2PS_matrix_key undef
384 .setglobal
385 /RepairedAnError exch def
386 /Repaired exch def
387-} bind executeonly def
388+} bind executeonly odef
389
390 % Display the contents of a page (including annotations).
391 /showpagecontents { % <pagedict> showpagecontents -
392diff --git a/Resource/Init/pdf_ops.ps b/Resource/Init/pdf_ops.ps
393index c45fc51..8672d61 100644
394--- a/Resource/Init/pdf_ops.ps
395+++ b/Resource/Init/pdf_ops.ps
396@@ -193,7 +193,7 @@ currentdict /gput_always_allow .undef
397 pdfformaterror
398 } ifelse
399 } if
400-} bind executeonly def
401+} bind executeonly odef
402
403 % Save PDF gstate
404 /qstate { % - qstate <qstate>
405@@ -451,7 +451,7 @@ currentdict /gput_always_allow .undef
406 %% a gsave, so we haven't copied it to /self, if we don't do that here
407 %% then transparent annotations cause an invalid access error.
408 currentdict //nodict eq {/self dup load end 5 dict begin def} if
409-} bind executeonly def
410+} bind executeonly odef
411 /AIS { .setalphaisshape } bind executeonly def
412 /BM {
413 /.setblendmode where {
414@@ -1077,7 +1077,7 @@ end readonly def
415 pdfopdict /v {inside_text_v} bind .forceput
416 pdfopdict /y {inside_text_y} bind .forceput
417 pdfopdict /re {inside_text_re} bind .forceput
418-} bind executeonly def
419+} bind executeonly odef
420
421 /switch_to_normal_marking_ops {
422 pdfopdict /m {normal_m} bind .forceput
423@@ -1086,7 +1086,7 @@ end readonly def
424 pdfopdict /v {normal_v} bind .forceput
425 pdfopdict /y {normal_y} bind .forceput
426 pdfopdict /re {normal_re} bind .forceput
427-} bind executeonly def
428+} bind executeonly odef
429
430 /BT {
431 currentdict /TextSaveMatrix known {
432--
4332.7.4
434
diff --git a/meta/recipes-extended/ghostscript/files/0003-Bug-699832-add-control-over-hiding-error-handlers.patch b/meta/recipes-extended/ghostscript/files/0003-Bug-699832-add-control-over-hiding-error-handlers.patch
deleted file mode 100644
index cd78659583..0000000000
--- a/meta/recipes-extended/ghostscript/files/0003-Bug-699832-add-control-over-hiding-error-handlers.patch
+++ /dev/null
@@ -1,172 +0,0 @@
1From 1f9a91c86bd56acf57826b9b0e020ebe1953e2ae Mon Sep 17 00:00:00 2001
2From: Chris Liddell <chris.liddell@artifex.com>
3Date: Thu, 4 Oct 2018 10:42:13 +0100
4Subject: [PATCH 3/5] Bug 699832: add control over hiding error handlers.
5
6With a previous commit changing error handling in SAFER so the handler gets
7passed a name object (rather than executable object), it is less critical to
8hide the error handlers.
9
10This introduces a -dSAFERERRORS option to force only use of the default error
11handlers.
12
13It also adds a .setsafererrors Postscript call, meaning a caller, without
14-dSAFERERRORS, can create their own default error handlers (in errordict, as
15normal), and then call .setsafererrors meaning their own handlers are always
16called.
17
18With -dSAFERERRORS or after a call to .setsafererrors, .setsafererrors is
19removed.
20
21CVE: CVE-2018-17961
22Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
23Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
24---
25 Resource/Init/gs_init.ps | 42 +++++++++++++++++++++++++++++------------
26 psi/interp.c | 49 ++++++++++++++++++++++++++++--------------------
27 2 files changed, 59 insertions(+), 32 deletions(-)
28
29diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
30index bec307d..f952f32 100644
31--- a/Resource/Init/gs_init.ps
32+++ b/Resource/Init/gs_init.ps
33@@ -188,6 +188,16 @@ currentdict /DELAYSAFER known { /DELAYSAFER //true def /NOSAFER //true def } if
34 currentdict /PARANOIDSAFER known or % PARANOIDSAFER is equivalent
35 }
36 ifelse def
37+
38+/SAFERERRORS
39+currentdict /NOSAFERERRORS known
40+{
41+ //false
42+}
43+{
44+ currentdict /SAFERERRORS known
45+} ifelse def
46+
47 currentdict /SHORTERRORS known /SHORTERRORS exch def
48 currentdict /TTYPAUSE known /TTYPAUSE exch def
49 currentdict /WRITESYSTEMDICT known /WRITESYSTEMDICT exch def
50@@ -1123,12 +1133,23 @@ errordict begin
51 } bind def
52 end % errordict
53
54-% Put all the default handlers in gserrordict
55-gserrordict
56-errordict {2 index 3 1 roll put} forall
57-noaccess pop
58-% remove the non-standard errors from errordict
59+gserrordict /unknownerror errordict /unknownerror get put
60 errordict /unknownerror .undef
61+
62+/.SAFERERRORLIST ErrorNames def
63+/.setsafererrors
64+{
65+% Put all the requested handlers in gserrordict
66+ gserrordict
67+ //.SAFERERRORLIST
68+ {dup errordict exch get 2 index 3 1 roll put} forall
69+ noaccess pop
70+ systemdict /.setsafeerrors .forceundef
71+ systemdict /.SAFERERRORLIST .forceundef
72+} bind executeonly odef
73+
74+SAFERERRORS {.setsafererrors} if
75+
76 % Define a stable private copy of handleerror that we will always use under
77 % JOBSERVER mode.
78 /.GShandleerror errordict /handleerror get def
79@@ -1760,18 +1781,15 @@ currentdict /.runlibfile .undef
80
81 % Bind all the operators defined as procedures.
82 /.bindoperators % binds operators in currentdict
83- { % Temporarily disable the typecheck error.
84- errordict /typecheck 2 copy get
85- errordict /typecheck { pop } put % pop the command
86+ {
87 currentdict
88 { dup type /operatortype eq
89- { % This might be a real operator, so bind might cause a typecheck,
90- % but we've made the error a no-op temporarily.
91- .bind
92+ {
93+ % This might be a real operator, so bind might cause a typecheck
94+ {.bind} .internalstopped pop
95 }
96 if pop pop
97 } forall
98- put
99 } def
100 DELAYBIND not { .bindoperators } if
101
102diff --git a/psi/interp.c b/psi/interp.c
103index 3dd5f7a..cd894f9 100644
104--- a/psi/interp.c
105+++ b/psi/interp.c
106@@ -662,27 +662,18 @@ again:
107 if (gs_errorname(i_ctx_p, code, &error_name) < 0)
108 return code; /* out-of-range error code! */
109
110- /* If LockFilePermissions is true, we only refer to gserrordict, which
111- * is not accessible to Postcript jobs
112+ /* We refer to gserrordict first, which is not accessible to Postcript jobs
113+ * If we're running with SAFERERRORS all the handlers are copied to gserrordict
114+ * so we'll always find the default one. If not SAFERERRORS, only gs specific
115+ * errors are in gserrordict.
116 */
117- if (i_ctx_p->LockFilePermissions) {
118- if (((dict_find_string(systemdict, "gserrordict", &perrordict) <= 0 ||
119- dict_find(perrordict, &error_name, &epref) <= 0))
120- )
121- return code; /* error name not in errordict??? */
122- }
123- else {
124- /*
125- * For greater Adobe compatibility, only the standard PostScript errors
126- * are defined in errordict; the rest are in gserrordict.
127- */
128- if (dict_find_string(systemdict, "errordict", &perrordict) <= 0 ||
129- (dict_find(perrordict, &error_name, &epref) <= 0 &&
130- (dict_find_string(systemdict, "gserrordict", &perrordict) <= 0 ||
131- dict_find(perrordict, &error_name, &epref) <= 0))
132- )
133- return code; /* error name not in errordict??? */
134- }
135+ if (dict_find_string(systemdict, "gserrordict", &perrordict) <= 0 ||
136+ (dict_find(perrordict, &error_name, &epref) <= 0 &&
137+ (dict_find_string(systemdict, "errordict", &perrordict) <= 0 ||
138+ dict_find(perrordict, &error_name, &epref) <= 0))
139+ )
140+ return code; /* error name not in errordict??? */
141+
142 doref = *epref;
143 epref = &doref;
144 /* Push the error object on the operand stack if appropriate. */
145@@ -695,6 +686,24 @@ again:
146 }
147 *osp = *perror_object;
148 errorexec_find(i_ctx_p, osp);
149+ /* If using SAFER, hand a name object to the error handler, rather than the executable
150+ * object/operator itself.
151+ */
152+ if (i_ctx_p->LockFilePermissions) {
153+ code = obj_cvs(imemory, osp, buf + 2, 256, &rlen, (const byte **)&bufptr);
154+ if (code < 0) {
155+ const char *unknownstr = "--unknown--";
156+ rlen = strlen(unknownstr);
157+ memcpy(buf, unknownstr, rlen);
158+ }
159+ else {
160+ buf[0] = buf[1] = buf[rlen + 2] = buf[rlen + 3] = '-';
161+ rlen += 4;
162+ }
163+ code = name_ref(imemory, buf, rlen, osp, 1);
164+ if (code < 0)
165+ make_null(osp);
166+ }
167 }
168 goto again;
169 }
170--
1712.7.4
172
diff --git a/meta/recipes-extended/ghostscript/files/0004-For-hidden-operators-pass-a-name-object-to-error-han.patch b/meta/recipes-extended/ghostscript/files/0004-For-hidden-operators-pass-a-name-object-to-error-han.patch
deleted file mode 100644
index 6c715ad43b..0000000000
--- a/meta/recipes-extended/ghostscript/files/0004-For-hidden-operators-pass-a-name-object-to-error-han.patch
+++ /dev/null
@@ -1,105 +0,0 @@
1From 34a8c5aa987d4db5234172a62218b168371606b1 Mon Sep 17 00:00:00 2001
2From: Chris Liddell <chris.liddell@artifex.com>
3Date: Tue, 2 Oct 2018 16:02:58 +0100
4Subject: [PATCH 4/5] For hidden operators, pass a name object to error
5 handler.
6
7In normal operation, Postscript error handlers are passed the object which
8triggered the error: this is invariably an operator object.
9
10The issue arises when an error is triggered by an operator which is for internal
11use only, and that operator is then passed to the error handler, meaning it
12becomes visible to the error handler code.
13
14By converting to a name object, the error message is still valid, but we no
15longer expose internal use only operators.
16
17The change in gs_dps1.ps is related to the above: previously an error in
18scheck would throw an error against .gcheck, but as .gcheck is now a hidden
19operator, it resulted in a name object being passed to the error handler. As
20scheck is a 'real' operator, it's better to use the real operator, rather than
21the name of an internal, hidden one.
22
23CVE: CVE-2018-17961
24Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
25Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
26---
27 Resource/Init/gs_dps1.ps | 2 +-
28 psi/interp.c | 33 ++++++++++++++++++++++++---------
29 2 files changed, 25 insertions(+), 10 deletions(-)
30
31diff --git a/Resource/Init/gs_dps1.ps b/Resource/Init/gs_dps1.ps
32index 1182f53..ec5db61 100644
33--- a/Resource/Init/gs_dps1.ps
34+++ b/Resource/Init/gs_dps1.ps
35@@ -21,7 +21,7 @@ level2dict begin
36 % ------ Virtual memory ------ %
37
38 /currentshared /.currentglobal load def
39-/scheck /.gcheck load def
40+/scheck {.gcheck} bind odef
41 %****** FOLLOWING IS WRONG ******
42 /shareddict currentdict /globaldict .knownget not { 20 dict } if def
43
44diff --git a/psi/interp.c b/psi/interp.c
45index cd894f9..b70769d 100644
46--- a/psi/interp.c
47+++ b/psi/interp.c
48@@ -678,6 +678,8 @@ again:
49 epref = &doref;
50 /* Push the error object on the operand stack if appropriate. */
51 if (!GS_ERROR_IS_INTERRUPT(code)) {
52+ byte buf[260], *bufptr;
53+ uint rlen;
54 /* Replace the error object if within an oparray or .errorexec. */
55 osp++;
56 if (osp >= ostop) {
57@@ -686,23 +688,36 @@ again:
58 }
59 *osp = *perror_object;
60 errorexec_find(i_ctx_p, osp);
61- /* If using SAFER, hand a name object to the error handler, rather than the executable
62- * object/operator itself.
63- */
64- if (i_ctx_p->LockFilePermissions) {
65+
66+ if (!r_has_type(osp, t_string) && !r_has_type(osp, t_name)) {
67 code = obj_cvs(imemory, osp, buf + 2, 256, &rlen, (const byte **)&bufptr);
68 if (code < 0) {
69 const char *unknownstr = "--unknown--";
70 rlen = strlen(unknownstr);
71 memcpy(buf, unknownstr, rlen);
72+ bufptr = buf;
73 }
74 else {
75- buf[0] = buf[1] = buf[rlen + 2] = buf[rlen + 3] = '-';
76- rlen += 4;
77+ ref *tobj;
78+ bufptr[rlen] = '\0';
79+ /* Only pass a name object if the operator doesn't exist in systemdict
80+ * i.e. it's an internal operator we have hidden
81+ */
82+ code = dict_find_string(systemdict, (const char *)bufptr, &tobj);
83+ if (code < 0) {
84+ buf[0] = buf[1] = buf[rlen + 2] = buf[rlen + 3] = '-';
85+ rlen += 4;
86+ bufptr = buf;
87+ }
88+ else {
89+ bufptr = NULL;
90+ }
91+ }
92+ if (bufptr) {
93+ code = name_ref(imemory, buf, rlen, osp, 1);
94+ if (code < 0)
95+ make_null(osp);
96 }
97- code = name_ref(imemory, buf, rlen, osp, 1);
98- if (code < 0)
99- make_null(osp);
100 }
101 }
102 goto again;
103--
1042.7.4
105
diff --git a/meta/recipes-extended/ghostscript/files/0005-Bug-699938-.loadfontloop-must-be-an-operator.patch b/meta/recipes-extended/ghostscript/files/0005-Bug-699938-.loadfontloop-must-be-an-operator.patch
deleted file mode 100644
index 4924b3cac6..0000000000
--- a/meta/recipes-extended/ghostscript/files/0005-Bug-699938-.loadfontloop-must-be-an-operator.patch
+++ /dev/null
@@ -1,31 +0,0 @@
1From f0a61679d28bc1561640403d92492e199bc1c0f3 Mon Sep 17 00:00:00 2001
2From: Chris Liddell <chris.liddell@artifex.com>
3Date: Wed, 10 Oct 2018 23:25:51 +0100
4Subject: [PATCH 5/5] Bug 699938: .loadfontloop must be an operator
5
6In the fix for Bug 699816, I omitted to make .loadfontloop into an operator, to
7better hide .forceundef and .putgstringcopy.
8
9CVE: CVE-2018-17961
10Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
11Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
12---
13 Resource/Init/gs_fonts.ps | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/Resource/Init/gs_fonts.ps b/Resource/Init/gs_fonts.ps
17index 89c3ab7..72feff2 100644
18--- a/Resource/Init/gs_fonts.ps
19+++ b/Resource/Init/gs_fonts.ps
20@@ -1148,7 +1148,7 @@ $error /SubstituteFont { } put
21
22 } loop % end of loop
23
24- } bind executeonly def % must be bound and hidden for .putgstringcopy
25+ } bind executeonly odef % must be bound and hidden for .putgstringcopy
26
27 currentdict /.putgstringcopy .undef
28
29--
302.7.4
31
diff --git a/meta/recipes-extended/ghostscript/files/0006-Undefine-some-additional-internal-operators.patch b/meta/recipes-extended/ghostscript/files/0006-Undefine-some-additional-internal-operators.patch
deleted file mode 100644
index 19cf7cc8c0..0000000000
--- a/meta/recipes-extended/ghostscript/files/0006-Undefine-some-additional-internal-operators.patch
+++ /dev/null
@@ -1,42 +0,0 @@
1From 37d7c9117b70e75ebed21c6c8192251f127c0fb0 Mon Sep 17 00:00:00 2001
2From: Nancy Durgin <nancy.durgin@artifex.com>
3Date: Mon, 5 Nov 2018 15:36:27 +0800
4Subject: [PATCH 1/2] Undefine some additional internal operators.
5
6.type, .writecvs, .setSMask, .currentSMask
7
8These don't seem to be referenced anywhere outside of the initialization code,
9which binds their usages. Passes cluster if they are removed.
10
11CVE: CVE-2018-18073
12Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
13
14Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
15---
16 Resource/Init/gs_init.ps | 3 ++-
17 1 file changed, 2 insertions(+), 1 deletion(-)
18
19diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
20index f952f32..7c71d18 100644
21--- a/Resource/Init/gs_init.ps
22+++ b/Resource/Init/gs_init.ps
23@@ -2230,6 +2230,7 @@ SAFER { .setsafeglobal } if
24 /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
25 /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
26 /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
27+ /.type /.writecvs /.setSMask /.currentSMask
28
29 % Used by a free user in the Library of Congress. Apparently this is used to
30 % draw a partial page, which is then filled in by the results of a barcode
31@@ -2248,7 +2249,7 @@ SAFER { .setsafeglobal } if
32 % test files/utilities, or engineers expressed a desire to keep them visible.
33 %
34 %/currentdevice /.sort /.buildfont0 /.buildfont1 /.buildfont2 /.buildfont3 /.buildfont4 /.buildfont9 /.buildfont10 /.buildfont11
35- %/.buildfotn32 /.buildfont42 /.type9mapcid /.type11mapcid /.swapcolors
36+ %/.buildfont32 /.buildfont42 /.type9mapcid /.type11mapcid /.swapcolors
37 %/currentdevice /.quit /.setuseciecolor /.needinput /.setoverprintmode /.special_op /.dicttomark /.knownget
38 %/.FAPIavailable /.FAPIpassfont /.FAPIrebuildfont /.FAPIBuildGlyph /.FAPIBuildChar /.FAPIBuildGlyph9
39 %/.tempfile /.numicc_components /.set_outputintent /.max /.min /.vmreclaim /.getpath /.setglobal
40--
412.7.4
42
diff --git a/meta/recipes-extended/ghostscript/files/0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch b/meta/recipes-extended/ghostscript/files/0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch
deleted file mode 100644
index ad66fc3d6e..0000000000
--- a/meta/recipes-extended/ghostscript/files/0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch
+++ /dev/null
@@ -1,197 +0,0 @@
1From 430f39144244ba4fd7b720cf87031e415e0fabce Mon Sep 17 00:00:00 2001
2From: Chris Liddell <chris.liddell@artifex.com>
3Date: Mon, 5 Nov 2018 15:42:52 +0800
4Subject: [PATCH 2/2] Bug 699927: don't include operator arrays in execstack
5 output
6
7When we transfer the contents of the execution stack into the array, take the
8extra step of replacing any operator arrays on the stack with the operator
9that reference them.
10
11This prevents the contents of Postscript defined, internal only operators (those
12created with .makeoperator) being exposed via execstack (and thus, via error
13handling).
14
15This necessitates a change in the resource remapping 'resource', which contains
16a procedure which relies on the contents of the operators arrays being present.
17As we already had internal-only variants of countexecstack and execstack
18(.countexecstack and .execstack) - using those, and leaving thier operation
19including the operator arrays means the procedure continues to work correctly.
20
21Both .countexecstack and .execstack are undefined after initialization.
22
23Also, when we store the execstack (or part thereof) for an execstackoverflow
24error, make the same oparray/operator substitution as above for execstack.
25
26CVE: CVE-2018-18073
27Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
28Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
29---
30 Resource/Init/gs_init.ps | 4 ++--
31 Resource/Init/gs_resmp.ps | 2 +-
32 psi/int.mak | 2 +-
33 psi/interp.c | 14 +++++++++++---
34 psi/interp.h | 2 ++
35 psi/zcontrol.c | 13 ++++++++++---
36 6 files changed, 27 insertions(+), 10 deletions(-)
37
38diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
39index 7c71d18..f4c1053 100644
40--- a/Resource/Init/gs_init.ps
41+++ b/Resource/Init/gs_init.ps
42@@ -2191,7 +2191,7 @@ SAFER { .setsafeglobal } if
43 %% but can be easily restored (just delete the name from the list in the array). In future
44 %% we may remove the operator and the code implementation entirely.
45 [
46- /.bitadd /.charboxpath /.cond /.countexecstack /.execstack /.runandhide /.popdevicefilter
47+ /.bitadd /.charboxpath /.cond /.runandhide /.popdevicefilter
48 /.execfile /.filenamesplit /.file_name_parent
49 /.setdefaultmatrix /.isprocfilter /.unread /.psstringencode
50 /.buildsampledfunction /.isencapfunction /.currentaccuratecurves /.currentcurvejoin /.currentdashadapt /.currentdotlength
51@@ -2230,7 +2230,7 @@ SAFER { .setsafeglobal } if
52 /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
53 /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
54 /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
55- /.type /.writecvs /.setSMask /.currentSMask
56+ /.type /.writecvs /.setSMask /.currentSMask /.countexecstack /.execstack
57
58 % Used by a free user in the Library of Congress. Apparently this is used to
59 % draw a partial page, which is then filled in by the results of a barcode
60diff --git a/Resource/Init/gs_resmp.ps b/Resource/Init/gs_resmp.ps
61index 7cacaf8..9bb4263 100644
62--- a/Resource/Init/gs_resmp.ps
63+++ b/Resource/Init/gs_resmp.ps
64@@ -183,7 +183,7 @@ setpacking
65 % We don't check them.
66
67 currentglobal //false setglobal % <object> bGlobal
68- countexecstack array execstack % <object> bGlobal [execstack]
69+ //false .countexecstack array //false .execstack % <object> bGlobal [execstack]
70 dup //null exch % <object> bGlobal [execstack] null [execstack]
71 length 3 sub -1 0 { % <object> bGlobal [execstack] null i
72 2 index exch get % <object> bGlobal [execstack] null proc
73diff --git a/psi/int.mak b/psi/int.mak
74index 5d9b3d5..6ab5bf0 100644
75--- a/psi/int.mak
76+++ b/psi/int.mak
77@@ -323,7 +323,7 @@ $(PSOBJ)zarray.$(OBJ) : $(PSSRC)zarray.c $(OP) $(memory__h)\
78
79 $(PSOBJ)zcontrol.$(OBJ) : $(PSSRC)zcontrol.c $(OP) $(string__h)\
80 $(estack_h) $(files_h) $(ipacked_h) $(iutil_h) $(store_h) $(stream_h)\
81- $(INT_MAK) $(MAKEDIRS)
82+ $(interp_h) $(INT_MAK) $(MAKEDIRS)
83 $(PSCC) $(PSO_)zcontrol.$(OBJ) $(C_) $(PSSRC)zcontrol.c
84
85 $(PSOBJ)zdict.$(OBJ) : $(PSSRC)zdict.c $(OP)\
86diff --git a/psi/interp.c b/psi/interp.c
87index b70769d..6dc0dda 100644
88--- a/psi/interp.c
89+++ b/psi/interp.c
90@@ -142,7 +142,6 @@ static int oparray_pop(i_ctx_t *);
91 static int oparray_cleanup(i_ctx_t *);
92 static int zerrorexec(i_ctx_t *);
93 static int zfinderrorobject(i_ctx_t *);
94-static int errorexec_find(i_ctx_t *, ref *);
95 static int errorexec_pop(i_ctx_t *);
96 static int errorexec_cleanup(i_ctx_t *);
97 static int zsetstackprotect(i_ctx_t *);
98@@ -761,7 +760,7 @@ copy_stack(i_ctx_t *i_ctx_p, const ref_stack_t * pstack, int skip, ref * arr)
99 {
100 uint size = ref_stack_count(pstack) - skip;
101 uint save_space = ialloc_space(idmemory);
102- int code;
103+ int code, i;
104
105 if (size > 65535)
106 size = 65535;
107@@ -770,6 +769,15 @@ copy_stack(i_ctx_t *i_ctx_p, const ref_stack_t * pstack, int skip, ref * arr)
108 if (code >= 0)
109 code = ref_stack_store(pstack, arr, size, 0, 1, true, idmemory,
110 "copy_stack");
111+ /* If we are copying the exec stack, try to replace any oparrays with
112+ * with the operator than references them
113+ */
114+ if (pstack == &e_stack) {
115+ for (i = 0; i < size; i++) {
116+ if (errorexec_find(i_ctx_p, &arr->value.refs[i]) < 0)
117+ make_null(&arr->value.refs[i]);
118+ }
119+ }
120 ialloc_set_space(idmemory, save_space);
121 return code;
122 }
123@@ -1934,7 +1942,7 @@ zfinderrorobject(i_ctx_t *i_ctx_p)
124 * .errorexec with errobj != null, store it in *perror_object and return 1,
125 * otherwise return 0;
126 */
127-static int
128+int
129 errorexec_find(i_ctx_t *i_ctx_p, ref *perror_object)
130 {
131 long i;
132diff --git a/psi/interp.h b/psi/interp.h
133index e9275b9..4f551d1 100644
134--- a/psi/interp.h
135+++ b/psi/interp.h
136@@ -91,5 +91,7 @@ void gs_interp_reset(i_ctx_t *i_ctx_p);
137 /* Define the top-level interface to the interpreter. */
138 int gs_interpret(i_ctx_t **pi_ctx_p, ref * pref, int user_errors,
139 int *pexit_code, ref * perror_object);
140+int
141+errorexec_find(i_ctx_t *i_ctx_p, ref *perror_object);
142
143 #endif /* interp_INCLUDED */
144diff --git a/psi/zcontrol.c b/psi/zcontrol.c
145index 36da22c..0362cf4 100644
146--- a/psi/zcontrol.c
147+++ b/psi/zcontrol.c
148@@ -24,6 +24,7 @@
149 #include "ipacked.h"
150 #include "iutil.h"
151 #include "store.h"
152+#include "interp.h"
153
154 /* Forward references */
155 static int check_for_exec(const_os_ptr);
156@@ -787,7 +788,7 @@ zexecstack2(i_ctx_t *i_ctx_p)
157 /* Continuation operator to do the actual transfer. */
158 /* r_size(op1) was set just above. */
159 static int
160-do_execstack(i_ctx_t *i_ctx_p, bool include_marks, os_ptr op1)
161+do_execstack(i_ctx_t *i_ctx_p, bool include_marks, bool include_oparrays, os_ptr op1)
162 {
163 os_ptr op = osp;
164 ref *arefs = op1->value.refs;
165@@ -829,6 +830,12 @@ do_execstack(i_ctx_t *i_ctx_p, bool include_marks, os_ptr op1)
166 strlen(tname), (const byte *)tname);
167 break;
168 }
169+ case t_array:
170+ case t_shortarray:
171+ case t_mixedarray:
172+ if (!include_oparrays && errorexec_find(i_ctx_p, rq) < 0)
173+ make_null(rq);
174+ break;
175 default:
176 ;
177 }
178@@ -841,14 +848,14 @@ execstack_continue(i_ctx_t *i_ctx_p)
179 {
180 os_ptr op = osp;
181
182- return do_execstack(i_ctx_p, false, op);
183+ return do_execstack(i_ctx_p, false, false, op);
184 }
185 static int
186 execstack2_continue(i_ctx_t *i_ctx_p)
187 {
188 os_ptr op = osp;
189
190- return do_execstack(i_ctx_p, op->value.boolval, op - 1);
191+ return do_execstack(i_ctx_p, op->value.boolval, true, op - 1);
192 }
193
194 /* - .needinput - */
195--
1962.7.4
197
diff --git a/meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch b/meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch
deleted file mode 100644
index 7cc51629ed..0000000000
--- a/meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch
+++ /dev/null
@@ -1,245 +0,0 @@
1From 9096beaa4451c12dd2a2caf000658fbac4a5bcdf Mon Sep 17 00:00:00 2001
2From: Ken Sharp <ken.sharp@artifex.com>
3Date: Mon, 5 Nov 2018 15:51:32 +0800
4Subject: [PATCH] Make .forceput unavailable from '.policyprocs' helper
5 dictionary
6
7Bug #69963 "1Policy is a dangerous operator, any callers should be odef"
8
9Leaving the .policyprocs dictionary with a procedure which is a simple
10wrapper for .forceput effectively leaves .forceput available.
11
12It seems that the only reason to have .policyprocs is to minimise the
13code in .applypolicies, so we can remove the dictionary and put the
14code straight into .applypolicies, which we can then bind and make
15executeonly, which hides the .forceput. Also, since we don't need
16.applypolicies after startup, we can undefine that from systemdict too.
17
18While we're here, review all the uses of .force* to make certain that
19there are no other similar cases. This showed a few places where we
20hadn't made a function executeonly, so do that too. Its probably not
21required, since I'm reasonably sure its impossible to load those
22functions as packed arrays (they are all defined as operators), but lets
23have a belt and braces approach, the additional time cost is negligible.
24
25CVE: CVE-2018-18284
26Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
27
28Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
29---
30 Resource/Init/gs_diskn.ps | 2 +-
31 Resource/Init/gs_dps.ps | 2 +-
32 Resource/Init/gs_epsf.ps | 2 +-
33 Resource/Init/gs_fonts.ps | 4 +-
34 Resource/Init/gs_init.ps | 2 +-
35 Resource/Init/gs_setpd.ps | 100 ++++++++++++++++++++++++----------------------
36 6 files changed, 58 insertions(+), 54 deletions(-)
37
38diff --git a/Resource/Init/gs_diskn.ps b/Resource/Init/gs_diskn.ps
39index 26ec0b5..fd694bc 100644
40--- a/Resource/Init/gs_diskn.ps
41+++ b/Resource/Init/gs_diskn.ps
42@@ -61,7 +61,7 @@ systemdict begin
43 % doesn't get run enough to justify the complication
44 //.putdevparams
45 //systemdict /.searchabledevs .forceundef
46-} .bind odef % must be bound and hidden for .forceundef
47+} .bind executeonly odef % must be bound and hidden for .forceundef
48
49 % ------ extend filenameforall to handle wildcards in %dev% part of pattern -------%
50 /filenameforall {
51diff --git a/Resource/Init/gs_dps.ps b/Resource/Init/gs_dps.ps
52index daf7b0f..00c14d5 100644
53--- a/Resource/Init/gs_dps.ps
54+++ b/Resource/Init/gs_dps.ps
55@@ -124,7 +124,7 @@
56 /savedinitialgstate .systemvar setgstate gsave
57 % Wrap up.
58 end .setglobal
59-} odef
60+} bind executeonly odef
61
62 % Check whether an object is a procedure.
63 /.proccheck { % <obj> .proccheck <bool>
64diff --git a/Resource/Init/gs_epsf.ps b/Resource/Init/gs_epsf.ps
65index e4037d9..2d0f677 100644
66--- a/Resource/Init/gs_epsf.ps
67+++ b/Resource/Init/gs_epsf.ps
68@@ -31,7 +31,7 @@
69 /EPSBoundingBoxState 5 def
70 /EPSBoundingBoxSetState {
71 //systemdict /EPSBoundingBoxState 3 -1 roll .forceput
72-} .bind odef % .forceput must be bound and hidden
73+} .bind executeonly odef % .forceput must be bound and hidden
74
75 % Parse 4 numbers for a bounding box
76 /EPSBoundingBoxParse { % (llx lly urx ury) -- llx lly urx ury true OR false
77diff --git a/Resource/Init/gs_fonts.ps b/Resource/Init/gs_fonts.ps
78index 72feff2..803faca 100644
79--- a/Resource/Init/gs_fonts.ps
80+++ b/Resource/Init/gs_fonts.ps
81@@ -583,7 +583,7 @@ buildfontdict 3 /.buildfont3 cvx put
82 } bind def
83 /.setloadingfont {
84 //systemdict /.loadingfont 3 -1 roll .forceput
85-} .bind odef % .forceput must be bound and hidden
86+} .bind executeonly odef % .forceput must be bound and hidden
87 /.loadfont
88 { % Some buggy fonts leave extra junk on the stack,
89 % so we have to make a closure that records the stack depth
90@@ -1012,7 +1012,7 @@ $error /SubstituteFont { } put
91 dup length string copy
92 .forceput setglobal
93 } ifelse
94-} .bind odef % must be bound and hidden for .forceput
95+} .bind executeonly odef % must be bound and hidden for .forceput
96
97 % Attempt to load a font from a file.
98 /.tryloadfont { % <fontname> .tryloadfont <font> true
99diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
100index f4c1053..07ee968 100644
101--- a/Resource/Init/gs_init.ps
102+++ b/Resource/Init/gs_init.ps
103@@ -2230,7 +2230,7 @@ SAFER { .setsafeglobal } if
104 /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
105 /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
106 /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
107- /.type /.writecvs /.setSMask /.currentSMask /.countexecstack /.execstack
108+ /.type /.writecvs /.setSMask /.currentSMask /.countexecstack /.execstack /.applypolicies
109
110 % Used by a free user in the Library of Congress. Apparently this is used to
111 % draw a partial page, which is then filled in by the results of a barcode
112diff --git a/Resource/Init/gs_setpd.ps b/Resource/Init/gs_setpd.ps
113index afb4ffa..7c076ad 100644
114--- a/Resource/Init/gs_setpd.ps
115+++ b/Resource/Init/gs_setpd.ps
116@@ -609,6 +609,23 @@ NOMEDIAATTRS {
117 % and we replace the key in the <merged> dictionary with its prior value
118 % (or remove it if it had no prior value).
119
120+% These procedures are called with the following on the stack:
121+% <orig> <merged> <failed> <Policies> <key> <policy>
122+% They are expected to consume the top 2 operands.
123+% NOTE: we currently treat all values other than 0, 1, or 7 (for PageSize)
124+% the same as 0, i.e., we signal an error.
125+/0Policy { % Set errorinfo and signal a configurationerror.
126+ NOMEDIAATTRS {
127+ % NOMEDIAATTRS means that the default policy is 7...
128+ pop 2 index exch 7 put
129+ } {
130+ pop dup 4 index exch get 2 array astore
131+ $error /errorinfo 3 -1 roll put
132+ cleartomark
133+ /setpagedevice .systemvar /configurationerror signalerror
134+ } ifelse
135+} bind executeonly odef
136+
137 % Making this an operator means we can properly hide
138 % the contents - specifically .forceput
139 /1Policy
140@@ -617,59 +634,46 @@ NOMEDIAATTRS {
141 SETPDDEBUG { (Rolling back.) = pstack flush } if
142 3 index 2 index 3 -1 roll .forceput
143 4 index 1 index .knownget
144- { 4 index 3 1 roll .forceput }
145- { 3 index exch .undef }
146+ { 4 index 3 1 roll .forceput }
147+ { 3 index exch .undef }
148 ifelse
149 } bind executeonly odef
150
151-/.policyprocs mark
152-% These procedures are called with the following on the stack:
153-% <orig> <merged> <failed> <Policies> <key> <policy>
154-% They are expected to consume the top 2 operands.
155-% NOTE: we currently treat all values other than 0, 1, or 7 (for PageSize)
156-% the same as 0, i.e., we signal an error.
157-%
158-% M. Sweet, Easy Software Products:
159-%
160-% Define NOMEDIAATTRS to turn off the default (but unimplementable) media
161-% selection policies for setpagedevice. This is used by CUPS to support
162-% the standard Adobe media attributes.
163- 0 { % Set errorinfo and signal a configurationerror.
164- NOMEDIAATTRS {
165- % NOMEDIAATTRS means that the default policy is 7...
166- pop 2 index exch 7 put
167- } {
168- pop dup 4 index exch get 2 array astore
169- $error /errorinfo 3 -1 roll put
170- cleartomark
171- /setpagedevice .systemvar /configurationerror signalerror
172- } ifelse
173- } bind
174- 1 /1Policy load
175- 7 { % For PageSize only, just impose the request.
176- 1 index /PageSize eq
177- { pop pop 1 index /PageSize 7 put }
178- { .policyprocs 0 get exec }
179- ifelse
180- } bind
181-.dicttomark readonly def
182-currentdict /1Policy undef
183+/7Policy { % For PageSize only, just impose the request.
184+ 1 index /PageSize eq
185+ { pop pop 1 index /PageSize 7 put }
186+ { .policyprocs 0 get exec }
187+ ifelse
188+} bind executeonly odef
189
190 /.applypolicies % <orig> <merged> <failed> .applypolicies
191 % <orig> <merged'> <failed'>
192- { 1 index /Policies get 1 index
193- { type /integertype eq
194- { pop % already processed
195- }
196- { 2 copy .knownget not { 1 index /PolicyNotFound get } if
197- % Stack: <orig> <merged> <failed> <Policies> <key>
198- % <policy>
199- .policyprocs 1 index .knownget not { .policyprocs 0 get } if exec
200- }
201- ifelse
202- }
203- forall pop
204- } bind def
205+{
206+ 1 index /Policies get 1 index
207+ { type /integertype eq
208+ {
209+ pop % already processed
210+ }{
211+ 2 copy .knownget not { 1 index /PolicyNotFound get } if
212+ % Stack: <orig> <merged> <failed> <Policies> <key>
213+ % <policy>
214+ dup 1 eq {
215+ 1Policy
216+ }{
217+ dup 7 eq {
218+ 7Policy
219+ }{
220+ 0Policy
221+ } ifelse
222+ } ifelse
223+ } ifelse
224+ }
225+ forall pop
226+} bind executeonly odef
227+
228+currentdict /0Policy undef
229+currentdict /1Policy undef
230+currentdict /7Policy undef
231
232 % Prepare to present parameters to the device, by spreading them onto the
233 % operand stack and removing any that shouldn't be presented.
234@@ -1006,7 +1010,7 @@ SETPDDEBUG { (Installing.) = pstack flush } if
235 .postinstall
236 } ifelse
237 setglobal % return to original VM allocation mode
238-} odef
239+} bind executeonly odef
240
241 % We break out the code after calling the Install procedure into a
242 % separate procedure, since it is executed even if Install causes an error.
243--
2442.7.4
245
diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.25.bb b/meta/recipes-extended/ghostscript/ghostscript_9.26.bb
index fdca8a2ac9..5ca978f86c 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_9.25.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_9.26.bb
@@ -19,20 +19,12 @@ DEPENDS_class-native = "libpng-native"
19UPSTREAM_CHECK_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases" 19UPSTREAM_CHECK_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases"
20UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.tar" 20UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.tar"
21 21
22SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs925/${BPN}-${PV}.tar.gz \ 22SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs926/${BPN}-${PV}.tar.gz \
23 file://ghostscript-9.15-parallel-make.patch \ 23 file://ghostscript-9.15-parallel-make.patch \
24 file://ghostscript-9.16-Werror-return-type.patch \ 24 file://ghostscript-9.16-Werror-return-type.patch \
25 file://do-not-check-local-libpng-source.patch \ 25 file://do-not-check-local-libpng-source.patch \
26 file://avoid-host-contamination.patch \ 26 file://avoid-host-contamination.patch \
27 file://mkdir-p.patch \ 27 file://mkdir-p.patch \
28 file://0001-Bug-699795-add-operand-checking-to-.setnativefontmap.patch \
29 file://0002-Bug-699816-Improve-hiding-of-security-critical-custo.patch \
30 file://0003-Bug-699832-add-control-over-hiding-error-handlers.patch \
31 file://0004-For-hidden-operators-pass-a-name-object-to-error-han.patch \
32 file://0005-Bug-699938-.loadfontloop-must-be-an-operator.patch \
33 file://0006-Undefine-some-additional-internal-operators.patch \
34 file://0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch \
35 file://0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch \
36" 28"
37 29
38SRC_URI = "${SRC_URI_BASE} \ 30SRC_URI = "${SRC_URI_BASE} \
@@ -47,8 +39,8 @@ SRC_URI_class-native = "${SRC_URI_BASE} \
47 file://base-genht.c-add-a-preprocessor-define-to-allow-fope.patch \ 39 file://base-genht.c-add-a-preprocessor-define-to-allow-fope.patch \
48 " 40 "
49 41
50SRC_URI[md5sum] = "eebd0fadbfa8e800094422ce65e94d5d" 42SRC_URI[md5sum] = "806bc2dedbc7f69b003f536658e08d4a"
51SRC_URI[sha256sum] = "baafa64740b090bff50b220a6df3be95c46069b7e30f4b4effed28316e5b2389" 43SRC_URI[sha256sum] = "831fc019bd477f7cc2d481dc5395ebfa4a593a95eb2fe1eb231a97e450d7540d"
52 44
53# Put something like 45# Put something like
54# 46#