summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHongxu Jia <hongxu.jia@windriver.com>2018-11-05 16:03:37 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2018-11-07 23:08:54 +0000
commit05c548c5f41cb7aa74984a0697b8ee8e0dceeb20 (patch)
treedad8550b61c16f21a25c12ba54b5ba427b144122
parent9e2e38d349d5ac41c140761f44b96a31171d5109 (diff)
downloadpoky-05c548c5f41cb7aa74984a0697b8ee8e0dceeb20.tar.gz
ghostscript: fix CVE-2018-18284
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. (From OE-Core rev: 98ab5c5770d20b39bf3c58083f31f31838f2e940) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch245
-rw-r--r--meta/recipes-extended/ghostscript/ghostscript_9.25.bb1
2 files changed, 246 insertions, 0 deletions
diff --git a/meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch b/meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch
new file mode 100644
index 0000000000..7cc51629ed
--- /dev/null
+++ b/meta/recipes-extended/ghostscript/files/0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch
@@ -0,0 +1,245 @@
1From 9096beaa4451c12dd2a2caf000658fbac4a5bcdf Mon Sep 17 00:00:00 2001
2From: Ken Sharp <ken.sharp@artifex.com>
3Date: Mon, 5 Nov 2018 15:51:32 +0800
4Subject: [PATCH] Make .forceput unavailable from '.policyprocs' helper
5 dictionary
6
7Bug #69963 "1Policy is a dangerous operator, any callers should be odef"
8
9Leaving the .policyprocs dictionary with a procedure which is a simple
10wrapper for .forceput effectively leaves .forceput available.
11
12It seems that the only reason to have .policyprocs is to minimise the
13code in .applypolicies, so we can remove the dictionary and put the
14code straight into .applypolicies, which we can then bind and make
15executeonly, which hides the .forceput. Also, since we don't need
16.applypolicies after startup, we can undefine that from systemdict too.
17
18While we're here, review all the uses of .force* to make certain that
19there are no other similar cases. This showed a few places where we
20hadn't made a function executeonly, so do that too. Its probably not
21required, since I'm reasonably sure its impossible to load those
22functions as packed arrays (they are all defined as operators), but lets
23have a belt and braces approach, the additional time cost is negligible.
24
25CVE: CVE-2018-18284
26Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
27
28Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
29---
30 Resource/Init/gs_diskn.ps | 2 +-
31 Resource/Init/gs_dps.ps | 2 +-
32 Resource/Init/gs_epsf.ps | 2 +-
33 Resource/Init/gs_fonts.ps | 4 +-
34 Resource/Init/gs_init.ps | 2 +-
35 Resource/Init/gs_setpd.ps | 100 ++++++++++++++++++++++++----------------------
36 6 files changed, 58 insertions(+), 54 deletions(-)
37
38diff --git a/Resource/Init/gs_diskn.ps b/Resource/Init/gs_diskn.ps
39index 26ec0b5..fd694bc 100644
40--- a/Resource/Init/gs_diskn.ps
41+++ b/Resource/Init/gs_diskn.ps
42@@ -61,7 +61,7 @@ systemdict begin
43 % doesn't get run enough to justify the complication
44 //.putdevparams
45 //systemdict /.searchabledevs .forceundef
46-} .bind odef % must be bound and hidden for .forceundef
47+} .bind executeonly odef % must be bound and hidden for .forceundef
48
49 % ------ extend filenameforall to handle wildcards in %dev% part of pattern -------%
50 /filenameforall {
51diff --git a/Resource/Init/gs_dps.ps b/Resource/Init/gs_dps.ps
52index daf7b0f..00c14d5 100644
53--- a/Resource/Init/gs_dps.ps
54+++ b/Resource/Init/gs_dps.ps
55@@ -124,7 +124,7 @@
56 /savedinitialgstate .systemvar setgstate gsave
57 % Wrap up.
58 end .setglobal
59-} odef
60+} bind executeonly odef
61
62 % Check whether an object is a procedure.
63 /.proccheck { % <obj> .proccheck <bool>
64diff --git a/Resource/Init/gs_epsf.ps b/Resource/Init/gs_epsf.ps
65index e4037d9..2d0f677 100644
66--- a/Resource/Init/gs_epsf.ps
67+++ b/Resource/Init/gs_epsf.ps
68@@ -31,7 +31,7 @@
69 /EPSBoundingBoxState 5 def
70 /EPSBoundingBoxSetState {
71 //systemdict /EPSBoundingBoxState 3 -1 roll .forceput
72-} .bind odef % .forceput must be bound and hidden
73+} .bind executeonly odef % .forceput must be bound and hidden
74
75 % Parse 4 numbers for a bounding box
76 /EPSBoundingBoxParse { % (llx lly urx ury) -- llx lly urx ury true OR false
77diff --git a/Resource/Init/gs_fonts.ps b/Resource/Init/gs_fonts.ps
78index 72feff2..803faca 100644
79--- a/Resource/Init/gs_fonts.ps
80+++ b/Resource/Init/gs_fonts.ps
81@@ -583,7 +583,7 @@ buildfontdict 3 /.buildfont3 cvx put
82 } bind def
83 /.setloadingfont {
84 //systemdict /.loadingfont 3 -1 roll .forceput
85-} .bind odef % .forceput must be bound and hidden
86+} .bind executeonly odef % .forceput must be bound and hidden
87 /.loadfont
88 { % Some buggy fonts leave extra junk on the stack,
89 % so we have to make a closure that records the stack depth
90@@ -1012,7 +1012,7 @@ $error /SubstituteFont { } put
91 dup length string copy
92 .forceput setglobal
93 } ifelse
94-} .bind odef % must be bound and hidden for .forceput
95+} .bind executeonly odef % must be bound and hidden for .forceput
96
97 % Attempt to load a font from a file.
98 /.tryloadfont { % <fontname> .tryloadfont <font> true
99diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
100index f4c1053..07ee968 100644
101--- a/Resource/Init/gs_init.ps
102+++ b/Resource/Init/gs_init.ps
103@@ -2230,7 +2230,7 @@ SAFER { .setsafeglobal } if
104 /.localvmarray /.localvmdict /.localvmpackedarray /.localvmstring /.systemvmarray /.systemvmdict /.systemvmpackedarray /.systemvmstring /.systemvmfile /.systemvmlibfile
105 /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
106 /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
107- /.type /.writecvs /.setSMask /.currentSMask /.countexecstack /.execstack
108+ /.type /.writecvs /.setSMask /.currentSMask /.countexecstack /.execstack /.applypolicies
109
110 % Used by a free user in the Library of Congress. Apparently this is used to
111 % draw a partial page, which is then filled in by the results of a barcode
112diff --git a/Resource/Init/gs_setpd.ps b/Resource/Init/gs_setpd.ps
113index afb4ffa..7c076ad 100644
114--- a/Resource/Init/gs_setpd.ps
115+++ b/Resource/Init/gs_setpd.ps
116@@ -609,6 +609,23 @@ NOMEDIAATTRS {
117 % and we replace the key in the <merged> dictionary with its prior value
118 % (or remove it if it had no prior value).
119
120+% These procedures are called with the following on the stack:
121+% <orig> <merged> <failed> <Policies> <key> <policy>
122+% They are expected to consume the top 2 operands.
123+% NOTE: we currently treat all values other than 0, 1, or 7 (for PageSize)
124+% the same as 0, i.e., we signal an error.
125+/0Policy { % Set errorinfo and signal a configurationerror.
126+ NOMEDIAATTRS {
127+ % NOMEDIAATTRS means that the default policy is 7...
128+ pop 2 index exch 7 put
129+ } {
130+ pop dup 4 index exch get 2 array astore
131+ $error /errorinfo 3 -1 roll put
132+ cleartomark
133+ /setpagedevice .systemvar /configurationerror signalerror
134+ } ifelse
135+} bind executeonly odef
136+
137 % Making this an operator means we can properly hide
138 % the contents - specifically .forceput
139 /1Policy
140@@ -617,59 +634,46 @@ NOMEDIAATTRS {
141 SETPDDEBUG { (Rolling back.) = pstack flush } if
142 3 index 2 index 3 -1 roll .forceput
143 4 index 1 index .knownget
144- { 4 index 3 1 roll .forceput }
145- { 3 index exch .undef }
146+ { 4 index 3 1 roll .forceput }
147+ { 3 index exch .undef }
148 ifelse
149 } bind executeonly odef
150
151-/.policyprocs mark
152-% These procedures are called with the following on the stack:
153-% <orig> <merged> <failed> <Policies> <key> <policy>
154-% They are expected to consume the top 2 operands.
155-% NOTE: we currently treat all values other than 0, 1, or 7 (for PageSize)
156-% the same as 0, i.e., we signal an error.
157-%
158-% M. Sweet, Easy Software Products:
159-%
160-% Define NOMEDIAATTRS to turn off the default (but unimplementable) media
161-% selection policies for setpagedevice. This is used by CUPS to support
162-% the standard Adobe media attributes.
163- 0 { % Set errorinfo and signal a configurationerror.
164- NOMEDIAATTRS {
165- % NOMEDIAATTRS means that the default policy is 7...
166- pop 2 index exch 7 put
167- } {
168- pop dup 4 index exch get 2 array astore
169- $error /errorinfo 3 -1 roll put
170- cleartomark
171- /setpagedevice .systemvar /configurationerror signalerror
172- } ifelse
173- } bind
174- 1 /1Policy load
175- 7 { % For PageSize only, just impose the request.
176- 1 index /PageSize eq
177- { pop pop 1 index /PageSize 7 put }
178- { .policyprocs 0 get exec }
179- ifelse
180- } bind
181-.dicttomark readonly def
182-currentdict /1Policy undef
183+/7Policy { % For PageSize only, just impose the request.
184+ 1 index /PageSize eq
185+ { pop pop 1 index /PageSize 7 put }
186+ { .policyprocs 0 get exec }
187+ ifelse
188+} bind executeonly odef
189
190 /.applypolicies % <orig> <merged> <failed> .applypolicies
191 % <orig> <merged'> <failed'>
192- { 1 index /Policies get 1 index
193- { type /integertype eq
194- { pop % already processed
195- }
196- { 2 copy .knownget not { 1 index /PolicyNotFound get } if
197- % Stack: <orig> <merged> <failed> <Policies> <key>
198- % <policy>
199- .policyprocs 1 index .knownget not { .policyprocs 0 get } if exec
200- }
201- ifelse
202- }
203- forall pop
204- } bind def
205+{
206+ 1 index /Policies get 1 index
207+ { type /integertype eq
208+ {
209+ pop % already processed
210+ }{
211+ 2 copy .knownget not { 1 index /PolicyNotFound get } if
212+ % Stack: <orig> <merged> <failed> <Policies> <key>
213+ % <policy>
214+ dup 1 eq {
215+ 1Policy
216+ }{
217+ dup 7 eq {
218+ 7Policy
219+ }{
220+ 0Policy
221+ } ifelse
222+ } ifelse
223+ } ifelse
224+ }
225+ forall pop
226+} bind executeonly odef
227+
228+currentdict /0Policy undef
229+currentdict /1Policy undef
230+currentdict /7Policy undef
231
232 % Prepare to present parameters to the device, by spreading them onto the
233 % operand stack and removing any that shouldn't be presented.
234@@ -1006,7 +1010,7 @@ SETPDDEBUG { (Installing.) = pstack flush } if
235 .postinstall
236 } ifelse
237 setglobal % return to original VM allocation mode
238-} odef
239+} bind executeonly odef
240
241 % We break out the code after calling the Install procedure into a
242 % separate procedure, since it is executed even if Install causes an error.
243--
2442.7.4
245
diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.25.bb b/meta/recipes-extended/ghostscript/ghostscript_9.25.bb
index 28521f3c4b..fdca8a2ac9 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_9.25.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_9.25.bb
@@ -32,6 +32,7 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d
32 file://0005-Bug-699938-.loadfontloop-must-be-an-operator.patch \ 32 file://0005-Bug-699938-.loadfontloop-must-be-an-operator.patch \
33 file://0006-Undefine-some-additional-internal-operators.patch \ 33 file://0006-Undefine-some-additional-internal-operators.patch \
34 file://0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch \ 34 file://0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch \
35 file://0008-Make-.forceput-unavailable-from-.policyprocs-helper-.patch \
35" 36"
36 37
37SRC_URI = "${SRC_URI_BASE} \ 38SRC_URI = "${SRC_URI_BASE} \