amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: ghostscript: Fix CVE-2020-15900.

Browse source 
* gnu/packages/patches/ghostscript-CVE-2020-15900.patch: New file.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
* gnu/packages/ghostscript.scm (ghostscript)[source](patches): Add it.
This commit is contained in:
Marius Bakke 2020-12-08 21:11:19 +01:00
parent 9337c16cb6
commit 3bd218e8d4
No known key found for this signature in database
GPG key ID: A2A06DF2A33A54FA
3 changed files with 38 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

36
gnu/packages/patches/ghostscript-CVE-2020-15900.patch Normal file
View file

@ -0,0 +1,36 @@
Fix CVE-2020-15900.
https://cve.circl.lu/cve/CVE-2020-15900
https://artifex.com/security-advisories/CVE-2020-15900
Taken from upstream:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5d499272b95a6b890a1397e11d20937de000d31b
diff --git a/psi/zstring.c b/psi/zstring.c
--- a/psi/zstring.c
+++ b/psi/zstring.c
@@ -142,13 +142,18 @@ search_impl(i_ctx_t *i_ctx_p, bool forward)
return 0;
found:
op->tas.type_attrs = op1->tas.type_attrs;
- op->value.bytes = ptr;
- r_set_size(op, size);
+ op->value.bytes = ptr; /* match */
+ op->tas.rsize = size; /* match */
push(2);
- op[-1] = *op1;
- r_set_size(op - 1, ptr - op[-1].value.bytes);
- op1->value.bytes = ptr + size;
- r_set_size(op1, count + (!forward ? (size - 1) : 0));
+ op[-1] = *op1; /* pre */
+ op[-3].value.bytes = ptr + size; /* post */
+ if (forward) {
+ op[-1].tas.rsize = ptr - op[-1].value.bytes; /* pre */
+ op[-3].tas.rsize = count; /* post */
+ } else {
+ op[-1].tas.rsize = count; /* pre */
+ op[-3].tas.rsize -= count + size; /* post */
+ }
make_true(op);
return 0;
}