File CVE-2017-8291.patch of Package ghostscript

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2017-8291.patch of Package ghostscript (Revision 016761196ad75d1361858db82dc061e7)

Currently displaying revision 016761196ad75d1361858db82dc061e7 , Show latest

commit 4f83478c88c2e05d6e8d79ca4557eb039354d2f3
Author: Chris Liddell <chris.liddell@artifex.com>
Date:   Thu Apr 27 13:03:33 2017 +0100

Bug 697799: have .eqproc check its parameters
    
    The Ghostscript custom operator .eqproc was not check the number or type of
    the parameters it was given.

commit 04b37bbce174eed24edec7ad5b920eb93db4d47d
Author: Chris Liddell <chris.liddell@artifex.com>
Date:   Thu Apr 27 13:21:31 2017 +0100

Bug 697799: have .rsdparams check its parameters
    
    The Ghostscript internal operator .rsdparams wasn't checking the number or
    type of the operands it was being passed. Do so.

Index: ghostscript-9.15/psi/zmisc3.c
===================================================================
--- ghostscript-9.15.orig/psi/zmisc3.c	2017-04-28 10:11:54.505043491 +0200
+++ ghostscript-9.15/psi/zmisc3.c	2017-04-28 10:11:55.677060655 +0200
@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p)
     ref2_t stack[MAX_DEPTH + 1];
     ref2_t *top = stack;
 
+    if (ref_stack_count(&o_stack) < 2)
+        return_error(e_stackunderflow);
+    if (!r_is_array(op - 1) || !r_is_array(op)) {
+        return_error(e_typecheck);
+    }
+
     make_array(&stack[0].proc1, 0, 1, op - 1);
     make_array(&stack[0].proc2, 0, 1, op);
     for (;;) {
Index: ghostscript-9.15/psi/zfrsd.c
===================================================================
--- ghostscript-9.15.orig/psi/zfrsd.c	2017-04-28 10:11:54.505043491 +0200
+++ ghostscript-9.15/psi/zfrsd.c	2017-04-28 10:13:34.082501541 +0200
@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p)
     ref *pFilter;
     ref *pDecodeParms;
     int Intent = 0;
-    bool AsyncRead;
+    bool AsyncRead = false;
     ref empty_array, filter1_array, parms1_array;
     uint i;
-    int code;
+    int code = 0;
+
+    if (ref_stack_count(&o_stack) < 1)
+        return_error(e_stackunderflow);
+    if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {
+        return_error(e_typecheck);
+    }
 
     make_empty_array(&empty_array, a_readonly);
-    if (dict_find_string(op, "Filter", &pFilter) > 0) {
+    if (r_has_type(op, t_dictionary)
+        && dict_find_string(op, "Filter", &pFilter) > 0) {
         if (!r_is_array(pFilter)) {
             if (!r_has_type(pFilter, t_name))
                 return_error(e_typecheck);
@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p)
                 return_error(e_typecheck);
         }
     }
-    code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
+    if (r_has_type(op, t_dictionary))
+        code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
     if (code < 0 && code != e_rangecheck) /* out-of-range int is ok, use 0 */
         return code;
-    if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0
-        )
-        return code;
+    if (r_has_type(op, t_dictionary))
+        if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0)
+            return code;
     push(1);
     op[-1] = *pFilter;
     if (pDecodeParms)

Places

File CVE-2017-8291.patch of Package ghostscript (Revision 016761196ad75d1361858db82dc061e7)

Places