summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch')
-rw-r--r--meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch61
1 files changed, 0 insertions, 61 deletions
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch
deleted file mode 100644
index 84983c5aea..0000000000
--- a/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 671fd59eb657743aa86fbc1895cb15872a317caa Mon Sep 17 00:00:00 2001
-From: Chris Liddell <chris.liddell@artifex.com>
-Date: Thu, 6 Jul 2017 14:54:02 +0100
-Subject: [PATCH] Bug 698158: prevent trying to reloc a freed object
-
-In the token reader, we pass the scanner state structure around as a
-t_struct ref on the Postscript operand stack.
-
-But we explicitly free the scanner state when we're done, which leaves a
-dangling reference on the operand stack and, unless that reference gets
-overwritten before the next garbager run, we can end up with the garbager
-trying to deal with an already freed object - that can cause a crash, or
-memory corruption.
----
- psi/ztoken.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
---- end of original header
-
-CVE: CVE-2017-11714
-
-Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
-
-Signed-off-by: Joe Slater <joe.slater@windriver.com>
-
-diff --git a/psi/ztoken.c b/psi/ztoken.c
-index 4dba7c5..af1ceeb 100644
---- a/psi/ztoken.c
-+++ b/psi/ztoken.c
-@@ -107,6 +107,12 @@ token_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save)
- int code;
- ref token;
-
-+ /* Since we might free pstate below, and we're dealing with
-+ * gc memory referenced by the stack, we need to explicitly
-+ * remove the reference to pstate from the stack, otherwise
-+ * the garbager will fall over
-+ */
-+ make_null(osp);
- /* Note that gs_scan_token may change osp! */
- pop(1); /* remove the file or scanner state */
- again:
-@@ -183,8 +189,14 @@ ztokenexec_continue(i_ctx_t *i_ctx_p)
- static int
- tokenexec_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save)
- {
-- os_ptr op;
-+ os_ptr op = osp;
- int code;
-+ /* Since we might free pstate below, and we're dealing with
-+ * gc memory referenced by the stack, we need to explicitly
-+ * remove the reference to pstate from the stack, otherwise
-+ * the garbager will fall over
-+ */
-+ make_null(osp);
- /* Note that gs_scan_token may change osp! */
- pop(1);
- again:
---
-1.7.9.5
-