From 8f919c2df47ca93132f21160d919b6ee2207d9a6 Mon Sep 17 00:00:00 2001 From: Catalin Enache Date: Mon, 8 May 2017 16:42:59 +0300 Subject: ghostscript: CVE-2016-8602, CVE-2017-7975 The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack. Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of service (application crash) or possibly execution of arbitrary code. References: https://nvd.nist.gov/vuln/detail/CVE-2016-8602 https://nvd.nist.gov/vuln/detail/CVE-2017-7975 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=f5c7555c303 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5e57e483298 Signed-off-by: Catalin Enache Signed-off-by: Ross Burton --- .../ghostscript/ghostscript/CVE-2016-8602.patch | 47 ++++++++++++++++++++++ .../ghostscript/ghostscript/CVE-2017-7975.patch | 36 +++++++++++++++++ .../ghostscript/ghostscript_9.20.bb | 2 + 3 files changed, 85 insertions(+) create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2016-8602.patch create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2016-8602.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2016-8602.patch new file mode 100644 index 0000000000..e58567cfec --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2016-8602.patch @@ -0,0 +1,47 @@ +From f5c7555c30393e64ec1f5ab0dfae5b55b3b3fc78 Mon Sep 17 00:00:00 2001 +From: Chris Liddell +Date: Sat, 8 Oct 2016 16:10:27 +0100 +Subject: [PATCH] Bug 697203: check for sufficient params in .sethalftone5 + +and param types + +Upstream-Status: Backport +CVE: CVE-2016-8602 + +Signed-off-by: Catalin Enache +--- + psi/zht2.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/psi/zht2.c b/psi/zht2.c +index fb4a264..dfa27a4 100644 +--- a/psi/zht2.c ++++ b/psi/zht2.c +@@ -82,14 +82,22 @@ zsethalftone5(i_ctx_t *i_ctx_p) + gs_memory_t *mem; + uint edepth = ref_stack_count(&e_stack); + int npop = 2; +- int dict_enum = dict_first(op); ++ int dict_enum; + ref rvalue[2]; + int cname, colorant_number; + byte * pname; + uint name_size; + int halftonetype, type = 0; + gs_gstate *pgs = igs; +- int space_index = r_space_index(op - 1); ++ int space_index; ++ ++ if (ref_stack_count(&o_stack) < 2) ++ return_error(gs_error_stackunderflow); ++ check_type(*op, t_dictionary); ++ check_type(*(op - 1), t_dictionary); ++ ++ dict_enum = dict_first(op); ++ space_index = r_space_index(op - 1); + + mem = (gs_memory_t *) idmemory->spaces_indexed[space_index]; + +-- +2.10.2 + diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch new file mode 100644 index 0000000000..d0886c9120 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-7975.patch @@ -0,0 +1,36 @@ +From 5e57e483298dae8b8d4ec9aab37a526736ac2e97 Mon Sep 17 00:00:00 2001 +From: Shailesh Mistry +Date: Wed, 26 Apr 2017 22:12:14 +0100 +Subject: [PATCH] Bug 697693: Prevent SEGV due to integer overflow. + +While building a Huffman table, the start and end points were susceptible +to integer overflow. + +Thank you to Jiaqi for finding this issue and suggesting a patch. + +Upstream-Status: Backport +CVE: CVE-2017-7975 + +Signed-off-by: Catalin Enache +--- + jbig2dec/jbig2_huffman.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/jbig2dec/jbig2_huffman.c b/jbig2dec/jbig2_huffman.c +index 511e461..b4189a1 100644 +--- a/jbig2dec/jbig2_huffman.c ++++ b/jbig2dec/jbig2_huffman.c +@@ -421,8 +421,8 @@ jbig2_build_huffman_table(Jbig2Ctx *ctx, const Jbig2HuffmanParams *params) + + if (PREFLEN == CURLEN) { + int RANGELEN = lines[CURTEMP].RANGELEN; +- int start_j = CURCODE << shift; +- int end_j = (CURCODE + 1) << shift; ++ uint32_t start_j = CURCODE << shift; ++ uint32_t end_j = (CURCODE + 1) << shift; + byte eflags = 0; + + if (end_j > max_j) { +-- +2.10.2 + diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.20.bb b/meta/recipes-extended/ghostscript/ghostscript_9.20.bb index 3c8a2e6d3c..87a7a5539d 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_9.20.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_9.20.bb @@ -35,6 +35,8 @@ SRC_URI = "${SRC_URI_BASE} \ file://CVE-2016-10219.patch \ file://CVE-2016-10220.patch \ file://CVE-2017-5951.patch \ + file://CVE-2016-8602.patch \ + file://CVE-2017-7975.patch \ " SRC_URI_class-native = "${SRC_URI_BASE} \ -- cgit 1.2.3-korg