!160 fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836
From: @fundawang Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen
This commit is contained in:
openeuler-ci-bot
Gitee
commit
fe4554b298
@ -1,5 +1,5 @@
|
||||
--- base/sbcp.c.orig 2020-03-19 09:21:42.000000000 +0100
|
||||
+++ base/sbcp.c 2023-04-03 12:36:26.024927229 +0200
|
||||
--- a/base/sbcp.c.orig 2020-03-19 09:21:42.000000000 +0100
|
||||
+++ b/base/sbcp.c 2023-04-03 12:36:26.024927229 +0200
|
||||
@@ -50,6 +50,14 @@ s_xBCPE_process(stream_state * st, strea
|
||||
byte ch = *++p;
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
--- base/gpmisc.c.orig 2022-04-04 15:48:49.000000000 +0200
|
||||
+++ base/gpmisc.c 2023-07-04 08:13:02.173325373 +0200
|
||||
--- a/base/gpmisc.c.orig 2022-04-04 15:48:49.000000000 +0200
|
||||
+++ b/base/gpmisc.c 2023-07-04 08:13:02.173325373 +0200
|
||||
@@ -1076,16 +1076,29 @@ gp_validate_path_len(const gs_memory_t *
|
||||
&& !memcmp(path + cdirstrl, dirsepstr, dirsepstrl)) {
|
||||
prefix_len = 0;
|
||||
@ -38,8 +38,8 @@
|
||||
while (1) {
|
||||
switch (mode[0])
|
||||
{
|
||||
--- base/gslibctx.c.orig 2022-04-04 15:48:49.000000000 +0200
|
||||
+++ base/gslibctx.c 2023-07-04 08:09:47.834639430 +0200
|
||||
--- a/base/gslibctx.c.orig 2022-04-04 15:48:49.000000000 +0200
|
||||
+++ b/base/gslibctx.c 2023-07-04 08:09:47.834639430 +0200
|
||||
@@ -740,14 +740,28 @@ gs_add_control_path_len_flags(const gs_m
|
||||
return gs_error_rangecheck;
|
||||
}
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
--- base/gdevdevn.c.orig 2022-04-04 15:48:49.000000000 +0200
|
||||
+++ base/gdevdevn.c 2023-07-26 11:31:03.873226054 +0200
|
||||
--- a/base/gdevdevn.c.orig 2022-04-04 15:48:49.000000000 +0200
|
||||
+++ b/base/gdevdevn.c 2023-07-26 11:31:03.873226054 +0200
|
||||
@@ -1950,7 +1950,7 @@ devn_pcx_write_rle(const byte * from, co
|
||||
byte data = *from;
|
||||
|
||||
|
||||
@ -28,4 +28,3 @@ index d4e7a4438..d3384d75d 100644
|
||||
*n = n_comps;
|
||||
--
|
||||
2.34.1
|
||||
|
||||
|
||||
72
backport-CVE-2025-27830.patch
Normal file
72
backport-CVE-2025-27830.patch
Normal file
@ -0,0 +1,72 @@
|
||||
From dc17ab3fe8cd43eeaf3f2da9bcaa30a2be69e57b Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Hutyra <zhutyra@centrum.cz>
|
||||
Date: Mon, 13 Jan 2025 09:15:01 +0000
|
||||
Subject: Bug 708241: Fix potential Buffer overflow with DollarBlend
|
||||
|
||||
During serializing a multiple master font for passing to Freetype.
|
||||
|
||||
Use CVE-2025-27830
|
||||
---
|
||||
base/write_t1.c | 9 +++++----
|
||||
psi/zfapi.c | 9 +++++++--
|
||||
2 files changed, 12 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/base/write_t1.c b/base/write_t1.c
|
||||
index 50af7ea..1b17aae 100644
|
||||
--- a/base/write_t1.c
|
||||
+++ b/base/write_t1.c
|
||||
@@ -628,6 +628,7 @@ write_main_dictionary(gs_fapi_font * a_fapi_font, WRF_output * a_output, int Wri
|
||||
WRF_wbyte(a_fapi_font->memory, a_output, '\n');
|
||||
if (is_MM_font(a_fapi_font)) {
|
||||
short x, x2;
|
||||
+ unsigned short ux;
|
||||
float x1;
|
||||
uint i, j, entries;
|
||||
char Buffer[255];
|
||||
@@ -759,16 +760,16 @@ write_main_dictionary(gs_fapi_font * a_fapi_font, WRF_output * a_output, int Wri
|
||||
*/
|
||||
code = a_fapi_font->get_word(a_fapi_font,
|
||||
gs_fapi_font_feature_DollarBlend_length,
|
||||
- 0, (unsigned short *)&x);
|
||||
+ 0, &ux);
|
||||
if (code < 0)
|
||||
return code;
|
||||
|
||||
- if (x > 0) {
|
||||
+ if (ux > 0) {
|
||||
int len;
|
||||
WRF_wstring(a_fapi_font->memory, a_output, "/$Blend {");
|
||||
|
||||
if (a_output->m_count)
|
||||
- a_output->m_count += x;
|
||||
+ a_output->m_count += ux;
|
||||
len = a_fapi_font->get_proc(a_fapi_font,
|
||||
gs_fapi_font_feature_DollarBlend, 0,
|
||||
(char *)a_output->m_pos);
|
||||
diff --git a/psi/zfapi.c b/psi/zfapi.c
|
||||
index 6927e60..05bf9dc 100644
|
||||
--- a/psi/zfapi.c
|
||||
+++ b/psi/zfapi.c
|
||||
@@ -683,7 +683,7 @@ FAPI_FF_get_word(gs_fapi_font *ff, gs_fapi_font_feature var_id, int index, unsig
|
||||
}
|
||||
for (i = 0; i < r_size(DBlend); i++) {
|
||||
if (array_get(ff->memory, DBlend, i, &Element) < 0) {
|
||||
- *ret = 0;
|
||||
+ length = 0;
|
||||
break;
|
||||
}
|
||||
switch (r_btype(&Element)) {
|
||||
@@ -710,7 +710,12 @@ FAPI_FF_get_word(gs_fapi_font *ff, gs_fapi_font_feature var_id, int index, unsig
|
||||
default:
|
||||
break;
|
||||
}
|
||||
- }
|
||||
+
|
||||
+ if (length > max_ushort) {
|
||||
+ length = 0;
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
*ret = length;
|
||||
break;
|
||||
}
|
||||
41
backport-CVE-2025-27832.patch
Normal file
41
backport-CVE-2025-27832.patch
Normal file
@ -0,0 +1,41 @@
|
||||
From 36ac25fca7ba65a2a24d96d553e8dd63990210b9 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Hutyra <zhutyra@centrum.cz>
|
||||
Date: Wed, 20 Nov 2024 11:42:31 +0000
|
||||
Subject: Bug 708133: Avoid integer overflow leading to buffer overflow
|
||||
|
||||
The calculation of the buffer size was being done with int values, and
|
||||
overflowing that data type. By leaving the total size calculation to the
|
||||
memory manager, the calculation ends up being done in size_t values, and
|
||||
avoiding the overflow in this case, but also meaning the memory manager
|
||||
overflow protection will be effective.
|
||||
|
||||
CVE-2025-27832
|
||||
---
|
||||
contrib/japanese/gdevnpdl.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/contrib/japanese/gdevnpdl.c b/contrib/japanese/gdevnpdl.c
|
||||
index 60065bacf..4967282bd 100644
|
||||
--- a/contrib/japanese/gdevnpdl.c
|
||||
+++ b/contrib/japanese/gdevnpdl.c
|
||||
@@ -587,7 +587,7 @@ npdl_print_page_copies(gx_device_printer * pdev, gp_file * prn_stream, int num_c
|
||||
int code;
|
||||
int maxY = lprn->BlockLine / lprn->nBh * lprn->nBh;
|
||||
|
||||
- if (!(lprn->CompBuf = gs_malloc(pdev->memory->non_gc_memory, line_size * maxY, sizeof(byte), "npdl_print_page_copies(CompBuf)")))
|
||||
+ if (!(lprn->CompBuf = gs_malloc(pdev->memory->non_gc_memory, line_size, maxY, "npdl_print_page_copies(CompBuf)")))
|
||||
return_error(gs_error_VMerror);
|
||||
|
||||
/* Initialize printer */
|
||||
@@ -683,7 +683,7 @@ npdl_print_page_copies(gx_device_printer * pdev, gp_file * prn_stream, int num_c
|
||||
/* Form Feed */
|
||||
gp_fputs("\014", prn_stream);
|
||||
|
||||
- gs_free(pdev->memory->non_gc_memory, lprn->CompBuf, line_size * maxY, sizeof(byte), "npdl_print_page_copies(CompBuf)");
|
||||
+ gs_free(pdev->memory->non_gc_memory, lprn->CompBuf, line_size, maxY, "npdl_print_page_copies(CompBuf)");
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
32
backport-CVE-2025-27833.patch
Normal file
32
backport-CVE-2025-27833.patch
Normal file
@ -0,0 +1,32 @@
|
||||
From 477e36cfa1faa0037069a22eeeb4fc750733f120 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Hutyra <zhutyra@centrum.cz>
|
||||
Date: Mon, 20 Jan 2025 09:38:59 +0000
|
||||
Subject: Bug 708259: Check TTF name size before copying to buffer.
|
||||
|
||||
CVE-2025-27833
|
||||
---
|
||||
pdf/pdf_fmap.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/pdf/pdf_fmap.c b/pdf/pdf_fmap.c
|
||||
index ee05af1..4458b5b 100644
|
||||
--- a/pdf/pdf_fmap.c
|
||||
+++ b/pdf/pdf_fmap.c
|
||||
@@ -539,7 +539,7 @@ static int pdfi_ttf_add_to_native_map(pdf_context *ctx, stream *f, byte magic[4]
|
||||
if (u16(rec + 6) == 6) {
|
||||
int nl = u16(rec + 8);
|
||||
int noffs = u16(rec + 10);
|
||||
- if (nl + noffs + storageOffset > table_len) {
|
||||
+ if (nl + noffs + storageOffset > table_len || nl >= pname_size) {
|
||||
break;
|
||||
}
|
||||
memcpy(pname, namet + storageOffset + noffs, nl);
|
||||
@@ -559,7 +559,7 @@ static int pdfi_ttf_add_to_native_map(pdf_context *ctx, stream *f, byte magic[4]
|
||||
if (u16(rec + 6) == 4) {
|
||||
int nl = u16(rec + 8);
|
||||
int noffs = u16(rec + 10);
|
||||
- if (nl + noffs + storageOffset > table_len) {
|
||||
+ if (nl + noffs + storageOffset > table_len || nl >= pname_size) {
|
||||
break;
|
||||
}
|
||||
memcpy(pname, namet + storageOffset + noffs, nl);
|
||||
53
backport-CVE-2025-27834.patch
Normal file
53
backport-CVE-2025-27834.patch
Normal file
@ -0,0 +1,53 @@
|
||||
From 3885f8307726fa7611b39fa1376403406bdbd55c Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Hutyra <zhutyra@centrum.cz>
|
||||
Date: Mon, 20 Jan 2025 16:13:46 +0000
|
||||
Subject: PDF interpreter - Guard against unsigned int overflow
|
||||
|
||||
Bug #708253 - see bug report for details.
|
||||
|
||||
CVE-2025-27834
|
||||
---
|
||||
pdf/pdf_func.c | 13 +++++++++++++
|
||||
1 file changed, 13 insertions(+)
|
||||
|
||||
diff --git a/pdf/pdf_func.c b/pdf/pdf_func.c
|
||||
index 635fdac54..93492c783 100644
|
||||
--- a/pdf/pdf_func.c
|
||||
+++ b/pdf/pdf_func.c
|
||||
@@ -153,6 +153,9 @@ pdfi_parse_type4_func_stream(pdf_context *ctx, pdf_c_stream *function_stream, in
|
||||
byte *p = (ops ? ops + *size : NULL);
|
||||
|
||||
while (1) {
|
||||
+ if (*size > max_uint / 2)
|
||||
+ return gs_note_error(gs_error_VMerror);
|
||||
+
|
||||
c = pdfi_read_byte(ctx, function_stream);
|
||||
if (c < 0)
|
||||
break;
|
||||
@@ -321,6 +324,11 @@ pdfi_build_function_4(pdf_context *ctx, gs_function_params_t * mnDR,
|
||||
if (code < 0)
|
||||
goto function_4_error;
|
||||
|
||||
+ if (size > max_uint - 1) {
|
||||
+ code = gs_note_error(gs_error_VMerror);
|
||||
+ goto function_4_error;
|
||||
+ }
|
||||
+
|
||||
ops = gs_alloc_string(ctx->memory, size + 1, "pdfi_build_function_4(ops)");
|
||||
if (ops == NULL) {
|
||||
code = gs_error_VMerror;
|
||||
@@ -825,6 +833,11 @@ int pdfi_build_halftone_function(pdf_context *ctx, gs_function_t ** ppfn, byte *
|
||||
if (code < 0)
|
||||
goto halftone_function_error;
|
||||
|
||||
+ if (size > max_uint - 1) {
|
||||
+ code = gs_note_error(gs_error_VMerror);
|
||||
+ goto halftone_function_error;
|
||||
+ }
|
||||
+
|
||||
ops = gs_alloc_string(ctx->memory, size + 1, "pdfi_build_halftone_function(ops)");
|
||||
if (ops == NULL) {
|
||||
code = gs_error_VMerror;
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
30
backport-CVE-2025-27835.patch
Normal file
30
backport-CVE-2025-27835.patch
Normal file
@ -0,0 +1,30 @@
|
||||
From 920fae688705b3a25a1f8925f3837219a6243565 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Hutyra <zhutyra@centrum.cz>
|
||||
Date: Wed, 20 Nov 2024 11:27:52 +0000
|
||||
Subject: Bug 708131: Fix confusion between bytes and shorts
|
||||
|
||||
We were copying data from a string in multiple of shorts, rather than multiple
|
||||
of bytes, leading to both an read (probably benign, given the memory manager)
|
||||
and write buffer overflow.
|
||||
|
||||
CVE-2025-27835
|
||||
---
|
||||
psi/zbfont.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/psi/zbfont.c b/psi/zbfont.c
|
||||
index acffb39ef..5850ab54d 100644
|
||||
--- a/psi/zbfont.c
|
||||
+++ b/psi/zbfont.c
|
||||
@@ -253,7 +253,7 @@ gs_font_map_glyph_to_unicode(gs_font *font, gs_glyph glyph, int ch, ushort *u, u
|
||||
if (l > length)
|
||||
return l;
|
||||
|
||||
- memcpy(unicode_return, v->value.const_bytes, l * sizeof(short));
|
||||
+ memcpy(unicode_return, v->value.const_bytes, l);
|
||||
return l;
|
||||
}
|
||||
if (r_type(v) == t_integer) {
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
60
backport-CVE-2025-27836.patch
Normal file
60
backport-CVE-2025-27836.patch
Normal file
@ -0,0 +1,60 @@
|
||||
From db77f4c0ce0298625f75059cb6b8c31e61350753 Mon Sep 17 00:00:00 2001
|
||||
From: Zdenek Hutyra <zhutyra@centrum.cz>
|
||||
Date: Mon, 13 Jan 2025 09:07:57 +0000
|
||||
Subject: Bug 708192: Fix potential print buffer overflow
|
||||
|
||||
CVE-2025-27836
|
||||
---
|
||||
contrib/japanese/gdev10v.c | 22 ++++++++++++++++------
|
||||
1 file changed, 16 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/contrib/japanese/gdev10v.c b/contrib/japanese/gdev10v.c
|
||||
index 0bd3cec02..9d27573dc 100644
|
||||
--- a/contrib/japanese/gdev10v.c
|
||||
+++ b/contrib/japanese/gdev10v.c
|
||||
@@ -199,17 +199,25 @@ bj10v_print_page(gx_device_printer *pdev, gp_file *prn_stream)
|
||||
int bytes_per_column = bits_per_column / 8;
|
||||
int x_skip_unit = bytes_per_column * (xres / 180);
|
||||
int y_skip_unit = (yres / 180);
|
||||
- byte *in = (byte *)gs_malloc(pdev->memory->non_gc_memory, 8, line_size, "bj10v_print_page(in)");
|
||||
- /* We need one extra byte in <out> for our sentinel. */
|
||||
- byte *out = (byte *)gs_malloc(pdev->memory->non_gc_memory, bits_per_column * line_size + 1, 1, "bj10v_print_page(out)");
|
||||
+ byte *in, *out;
|
||||
int lnum = 0;
|
||||
int y_skip = 0;
|
||||
int code = 0;
|
||||
int blank_lines = 0;
|
||||
int bytes_per_data = ((xres == 360) && (yres == 360)) ? 1 : 3;
|
||||
|
||||
- if ( in == 0 || out == 0 )
|
||||
- return -1;
|
||||
+ if (bits_per_column == 0 || line_size > (max_int - 1) / bits_per_column) {
|
||||
+ code = gs_note_error(gs_error_rangecheck);
|
||||
+ goto error;
|
||||
+ }
|
||||
+
|
||||
+ in = (byte *)gs_malloc(pdev->memory->non_gc_memory, 8, line_size, "bj10v_print_page(in)");
|
||||
+ /* We need one extra byte in <out> for our sentinel. */
|
||||
+ out = (byte *)gs_malloc(pdev->memory->non_gc_memory, bits_per_column * line_size + 1, 1, "bj10v_print_page(out)");
|
||||
+ if ( in == NULL || out == NULL ) {
|
||||
+ code = gs_note_error(gs_error_VMerror);
|
||||
+ goto error;
|
||||
+ }
|
||||
|
||||
/* Initialize the printer. */
|
||||
prn_puts(pdev, "\033@");
|
||||
@@ -320,8 +328,10 @@ notz:
|
||||
}
|
||||
|
||||
/* Eject the page */
|
||||
-xit: prn_putc(pdev, 014); /* form feed */
|
||||
+xit:
|
||||
+ prn_putc(pdev, 014); /* form feed */
|
||||
prn_flush(pdev);
|
||||
+error:
|
||||
gs_free(pdev->memory->non_gc_memory, (char *)out, bits_per_column, line_size, "bj10v_print_page(out)");
|
||||
gs_free(pdev->memory->non_gc_memory, (char *)in, 8, line_size, "bj10v_print_page(in)");
|
||||
return code;
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
@ -9,7 +9,7 @@
|
||||
|
||||
Name: ghostscript
|
||||
Version: 9.56.1
|
||||
Release: 13
|
||||
Release: 14
|
||||
Summary: An interpreter for PostScript and PDF files
|
||||
License: AGPLv3+
|
||||
URL: https://ghostscript.com/
|
||||
@ -69,6 +69,12 @@ Patch119: backport-CVE-2024-46956.patch
|
||||
Patch120: backport-CVE-2024-46951.patch
|
||||
Patch121: backport-CVE-2024-46952.patch
|
||||
Patch122: backport-CVE-2024-46955.patch
|
||||
Patch124: backport-CVE-2025-27830.patch
|
||||
Patch125: backport-CVE-2025-27832.patch
|
||||
Patch126: backport-CVE-2025-27833.patch
|
||||
Patch127: backport-CVE-2025-27834.patch
|
||||
Patch128: backport-CVE-2025-27835.patch
|
||||
Patch129: backport-CVE-2025-27836.patch
|
||||
|
||||
BuildRequires: automake gcc
|
||||
BuildRequires: adobe-mappings-cmap-devel adobe-mappings-pdf-devel
|
||||
@ -135,30 +141,7 @@ This package provides the utility 'dvipdf' for converting of TeX DVI files into
|
||||
PDF files using Ghostscript and dvips
|
||||
|
||||
%prep
|
||||
%setup -q -n %{name}-%{version}
|
||||
%patch0 -p1
|
||||
%patch101 -p0
|
||||
%patch102 -p0
|
||||
%patch103 -p0
|
||||
%patch104 -p1
|
||||
%patch105 -p1
|
||||
%patch106 -p1
|
||||
%patch107 -p1
|
||||
%patch108 -p1
|
||||
%patch109 -p1
|
||||
%patch110 -p1
|
||||
%patch111 -p1
|
||||
%patch112 -p1
|
||||
%patch113 -p1
|
||||
%patch114 -p1
|
||||
%patch115 -p1
|
||||
%patch116 -p1
|
||||
%patch117 -p1
|
||||
%patch118 -p1
|
||||
%patch119 -p1
|
||||
%patch120 -p1
|
||||
%patch121 -p1
|
||||
%patch122 -p1
|
||||
%autosetup -p1 -n %{name}-%{version}
|
||||
|
||||
# Libraries that we already have packaged(see Build Requirements):
|
||||
rm -rf cups/libs freetype ijs jbig2dec jpeg lcms2* libpng openjpeg tiff zlib
|
||||
@ -252,6 +235,12 @@ install -m 0755 -d %{buildroot}%{_datadir}/%{name}/conf.d/
|
||||
%{_bindir}/dvipdf
|
||||
|
||||
%changelog
|
||||
* Thu Mar 27 2025 Funda Wang <fundawang@yeah.net> - 9.56.1-14
|
||||
- Type:CVE
|
||||
- ID:NA
|
||||
- SUG:NA
|
||||
- DECS: Fix CVE-2025-27830, CVE-2025-27832, CVE-2025-27833, CVE-2025-27834, CVE-2025-27835, CVE-2025-27836
|
||||
|
||||
* Fri Nov 08 2024 liningjie <liningjie@xfusion.com> - 9.56.1-13
|
||||
- Type:CVE
|
||||
- ID:NA
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user