diff options
author | Minjae Kim <flowergom@gmail.com> | 2022-02-28 11:38:38 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-03-10 16:39:45 +0000 |
commit | f8d05252d1f99c49208e07133d8534fab70af37f (patch) | |
tree | f22934cbfc11aded4c6d6e7db9685ca26e0ebf31 /meta/recipes-extended/ghostscript/ghostscript/check-stack-limits-after-function-evalution.patch | |
parent | b2bd31b9cc10165719d132073ddaa8e93298f633 (diff) | |
download | poky-f8d05252d1f99c49208e07133d8534fab70af37f.tar.gz |
ghostscript: fix CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish
(called from sampled_data_continue and interp).
To apply this CVE-2021-45959 patch,
the check-stack-limits-after-function-evalution.patch should be applied first.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-45949
(From OE-Core rev: 5fb43ed64ae32abe4488f2eb37c1b82f97f83db0)
(From OE-Core rev: 9b0199a1d8ec3c7bbfd2022932d524d61f2c6832)
Signed-off-by: Minjae Kim <flowergom@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-extended/ghostscript/ghostscript/check-stack-limits-after-function-evalution.patch')
-rw-r--r-- | meta/recipes-extended/ghostscript/ghostscript/check-stack-limits-after-function-evalution.patch | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/meta/recipes-extended/ghostscript/ghostscript/check-stack-limits-after-function-evalution.patch b/meta/recipes-extended/ghostscript/ghostscript/check-stack-limits-after-function-evalution.patch new file mode 100644 index 0000000000..722bab4ddb --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/check-stack-limits-after-function-evalution.patch | |||
@@ -0,0 +1,51 @@ | |||
1 | From 7861fcad13c497728189feafb41cd57b5b50ea25 Mon Sep 17 00:00:00 2001 | ||
2 | From: Chris Liddell <chris.liddell@artifex.com> | ||
3 | Date: Fri, 12 Feb 2021 10:34:23 +0000 | ||
4 | Subject: [PATCH] oss-fuzz 30715: Check stack limits after function evaluation. | ||
5 | |||
6 | During function result sampling, after the callout to the Postscript | ||
7 | interpreter, make sure there is enough stack space available before pushing | ||
8 | or popping entries. | ||
9 | |||
10 | In thise case, the Postscript procedure for the "function" is totally invalid | ||
11 | (as a function), and leaves the op stack in an unrecoverable state (as far as | ||
12 | function evaluation is concerned). We end up popping more entries off the | ||
13 | stack than are available. | ||
14 | |||
15 | To cope, add in stack limit checking to throw an appropriate error when this | ||
16 | happens. | ||
17 | |||
18 | Upstream-Status: Backported [https://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=7861fcad13c497728189feafb41cd57b5b50ea25] | ||
19 | Signed-off-by: Minjae Kim <flowergom@gmail.com> | ||
20 | --- | ||
21 | psi/zfsample.c | 14 +++++++++++--- | ||
22 | 1 file changed, 11 insertions(+), 3 deletions(-) | ||
23 | |||
24 | diff --git a/psi/zfsample.c b/psi/zfsample.c | ||
25 | index 290809405..652ae02c6 100644 | ||
26 | --- a/psi/zfsample.c | ||
27 | +++ b/psi/zfsample.c | ||
28 | @@ -551,9 +551,17 @@ sampled_data_continue(i_ctx_t *i_ctx_p) | ||
29 | } else { | ||
30 | if (stack_depth_adjust) { | ||
31 | stack_depth_adjust -= num_out; | ||
32 | - push(O_STACK_PAD - stack_depth_adjust); | ||
33 | - for (i=0;i<O_STACK_PAD - stack_depth_adjust;i++) | ||
34 | - make_null(op - i); | ||
35 | + if ((O_STACK_PAD - stack_depth_adjust) < 0) { | ||
36 | + stack_depth_adjust = -(O_STACK_PAD - stack_depth_adjust); | ||
37 | + check_op(stack_depth_adjust); | ||
38 | + pop(stack_depth_adjust); | ||
39 | + } | ||
40 | + else { | ||
41 | + check_ostack(O_STACK_PAD - stack_depth_adjust); | ||
42 | + push(O_STACK_PAD - stack_depth_adjust); | ||
43 | + for (i=0;i<O_STACK_PAD - stack_depth_adjust;i++) | ||
44 | + make_null(op - i); | ||
45 | + } | ||
46 | } | ||
47 | } | ||
48 | |||
49 | -- | ||
50 | 2.25.1 | ||
51 | |||