diff options
| author |   Lee Chee Yang <lcyang92@gmail.com> | 2022-06-29 22:54:36 +0800 |
|---|---|---|
| committer |   Steve Sakoman <steve@sakoman.com> | 2022-06-29 07:32:29 -1000 |
| commit | 645a619524d04aa6a2029a2810e2d84dc751fc48 (patch) | |
| tree | 700a7aa610bbb76724943aa570390cb6418c77cf | |
| parent | 6a277ba7964c0ce029e1097f061007484f63bcf5 (diff) | |
| download | openembedded-core-contrib-645a619524d04aa6a2029a2810e2d84dc751fc48.tar.gz | |
ghostscript: fix CVE-2022-2085
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
| -rw-r--r-- | meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch | 44 | ||||
| -rw-r--r-- | meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb | 1 |
2 files changed, 45 insertions, 0 deletions
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch new file mode 100644 index 0000000000..58cb93727a --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch @@ -0,0 +1,44 @@ +From ae1061d948d88667bdf51d47d918c4684d0f67df Mon Sep 17 00:00:00 2001 +From: Robin Watts <Robin.Watts@artifex.com> +Date: Wed, 16 Feb 2022 15:22:50 +0000 +Subject: [PATCH] Bug 704945: Add init_device_procs entry for mem_x_device. + +When allocating a buffer device, we rely on an init_device_procs +being defined for the device we are using as a prototype. Which +device we use as a prototype depends upon the number of bits per +pixel we are using. For bpp > 64, we use mem_x_device, which does +not currently have an init_device_procs defined. + +This is a fairly hard case to tickle, as very few devices use +more than 64 bits per pixel. The DeviceN device is one of the +few that does, and then the problem only kicks in if the +MaxBitmap figure is high enough (or conversely the resolution is +low enough). + + +http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=ae1061d948d88667bdf51d47d918c4684d0f67df +Upstream-Status: Backport +CVE: CVE-2022-2085 +Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> +--- + base/gdevmx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/base/gdevmx.c b/base/gdevmx.c +index 08b0cbcfe..89e9ff774 100644 +--- a/base/gdevmx.c ++++ b/base/gdevmx.c +@@ -1,4 +1,4 @@ +-/* Copyright (C) 2001-2021 Artifex Software, Inc. ++/* Copyright (C) 2001-2022 Artifex Software, Inc. + All Rights Reserved. + + This software is provided AS-IS with no warranty, either express or +@@ -25,4 +25,4 @@ + + /* The device descriptor. */ + const gx_device_memory mem_x_device = +- mem_device("imagex", 256, 0, NULL); ++ mem_device("imagex", 256, 0, mem_initialize_device_procs); +-- +2.25.1 diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb index c28e62f089..365420fb64 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb @@ -33,6 +33,7 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d file://do-not-check-local-libpng-source.patch \ file://avoid-host-contamination.patch \ file://mkdir-p.patch \ + file://CVE-2022-2085.patch \ " SRC_URI = "${SRC_URI_BASE} \ |