amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: ghostscript: Fix CVE-2023-36664.

Browse source 
* gnu/packages/ghostscript.scm (ghostscript/fixed): New variable.
(ghostscript)[replacement]: Assign it to new field.
* gnu/packages/patches/ghostscript-CVE-2023-36664.patch,
gnu/packages/patches/ghostscript-CVE-2023-36664-fixup.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
This commit is contained in:
Tobias Geerinckx-Rice 2023-07-09 02:00:01 +02:00
parent b29bd4d35e
commit 67fb8efdf7
No known key found for this signature in database
GPG key ID: 0DB0FF884F556D79
4 changed files with 207 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

56
gnu/packages/patches/ghostscript-CVE-2023-36664-fixup.patch Normal file
View file

@ -0,0 +1,56 @@
From 0974e4f2ac0005d3731e0b5c13ebc7e965540f4d Mon Sep 17 00:00:00 2001
From: Chris Liddell <chris.liddell@artifex.com>
Date: Wed, 14 Jun 2023 09:08:12 +0100
Subject: [PATCH] Bug 706778: 706761 revisit
Two problems with the original commit. The first a silly typo inverting the
logic of a test.
The second was forgetting that we actually actually validate two candidate
strings for pipe devices. One with the expected "%pipe%" prefix, the other
using the pipe character prefix: "|".
This addresses both those.
---
base/gpmisc.c | 2 +-
base/gslibctx.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/base/gpmisc.c b/base/gpmisc.c
index 58511270e..2b0064bea 100644
--- a/base/gpmisc.c
+++ b/base/gpmisc.c
@@ -1081,7 +1081,7 @@ gp_validate_path_len(const gs_memory_t *mem,
/* "%pipe%" do not follow the normal rules for path definitions, so we
don't "reduce" them to avoid unexpected results
*/
- if (len > 5 && memcmp(path, "%pipe", 5) != 0) {
+ if (path[0] == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) {
bufferfull = buffer = (char *)gs_alloc_bytes(mem->thread_safe_memory, len + 1, "gp_validate_path");
if (buffer == NULL)
return gs_error_VMerror;
diff --git a/base/gslibctx.c b/base/gslibctx.c
index d2a1aa91d..42af99090 100644
--- a/base/gslibctx.c
+++ b/base/gslibctx.c
@@ -743,7 +743,7 @@ gs_add_control_path_len_flags(const gs_memory_t *mem, gs_path_control_t type, co
/* "%pipe%" do not follow the normal rules for path definitions, so we
don't "reduce" them to avoid unexpected results
*/
- if (len > 5 && memcmp(path, "%pipe", 5) != 0) {
+ if (path[0] == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) {
buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_add_control_path_len");
if (buffer == NULL)
return gs_error_VMerror;
@@ -850,7 +850,7 @@ gs_remove_control_path_len_flags(const gs_memory_t *mem, gs_path_control_t type,
/* "%pipe%" do not follow the normal rules for path definitions, so we
don't "reduce" them to avoid unexpected results
*/
- if (len > 5 && memcmp(path, "%pipe", 5) != 0) {
+ if (path[0] == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) {
buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_remove_control_path_len");
if (buffer == NULL)
return gs_error_VMerror;
--
2.34.1