summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-extended/ghostscript/ghostscript/0001-pdfwrite-Guard-against-trying-to-output-an-infinite-.patch49
-rw-r--r--meta/recipes-extended/ghostscript/ghostscript_9.23.bb1
2 files changed, 50 insertions, 0 deletions
diff --git a/meta/recipes-extended/ghostscript/ghostscript/0001-pdfwrite-Guard-against-trying-to-output-an-infinite-.patch b/meta/recipes-extended/ghostscript/ghostscript/0001-pdfwrite-Guard-against-trying-to-output-an-infinite-.patch
new file mode 100644
index 0000000000..bac7365f3c
--- /dev/null
+++ b/meta/recipes-extended/ghostscript/ghostscript/0001-pdfwrite-Guard-against-trying-to-output-an-infinite-.patch
@@ -0,0 +1,49 @@
1From 39b1e54b2968620723bf32e96764c88797714879 Mon Sep 17 00:00:00 2001
2From: Ken Sharp <ken.sharp@artifex.com>
3Date: Wed, 18 Apr 2018 15:46:32 +0100
4Subject: [PATCH] pdfwrite - Guard against trying to output an infinite number
5
6Bug #699255 " Buffer overflow on pprintg1 due to mishandle postscript file data to pdf"
7
8The file uses an enormous parameter to xyxhow, causing an overflow in
9the calculation of text positioning (value > 1e39).
10
11Since this is basically a nonsense value, and PostScript only supports
12real values up to 1e38, this patch follows the same approach as for
13a degenerate CTM, and treats it as 0.
14
15Adobe Acrobat Distiller throws a limitcheck error, so we could do that
16instead if this approach proves to be a problem.
17
18Upstream-Status: Backport
19git://git.ghostscript.com/ghostpdl.git
20CVE: CVE-2018-10194
21Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
22
23---
24 devices/vector/gdevpdts.c | 7 ++++++-
25 1 file changed, 6 insertions(+), 1 deletion(-)
26
27diff --git a/devices/vector/gdevpdts.c b/devices/vector/gdevpdts.c
28index 848ad78..172fe6b 100644
29--- a/devices/vector/gdevpdts.c
30+++ b/devices/vector/gdevpdts.c
31@@ -103,9 +103,14 @@ append_text_move(pdf_text_state_t *pts, double dw)
32 static int
33 set_text_distance(gs_point *pdist, double dx, double dy, const gs_matrix *pmat)
34 {
35- int code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
36+ int code;
37 double rounded;
38
39+ if (dx > 1e38 || dy > 1e38)
40+ code = gs_error_undefinedresult;
41+ else
42+ code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
43+
44 if (code == gs_error_undefinedresult) {
45 /* The CTM is degenerate.
46 Can't know the distance in user space.
47--
482.7.4
49
diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.23.bb b/meta/recipes-extended/ghostscript/ghostscript_9.23.bb
index 4b3b370af7..019d99b021 100644
--- a/meta/recipes-extended/ghostscript/ghostscript_9.23.bb
+++ b/meta/recipes-extended/ghostscript/ghostscript_9.23.bb
@@ -33,6 +33,7 @@ SRC_URI = "${SRC_URI_BASE} \
33 file://ghostscript-9.02-genarch.patch \ 33 file://ghostscript-9.02-genarch.patch \
34 file://objarch.h \ 34 file://objarch.h \
35 file://cups-no-gcrypt.patch \ 35 file://cups-no-gcrypt.patch \
36 file://0001-pdfwrite-Guard-against-trying-to-output-an-infinite-.patch \
36 " 37 "
37 38
38SRC_URI_class-native = "${SRC_URI_BASE} \ 39SRC_URI_class-native = "${SRC_URI_BASE} \