diff options
Diffstat (limited to 'meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch')
| -rw-r--r-- | meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch new file mode 100644 index 0000000000..84983c5aea --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch @@ -0,0 +1,61 @@ +From 671fd59eb657743aa86fbc1895cb15872a317caa Mon Sep 17 00:00:00 2001 +From: Chris Liddell <chris.liddell@artifex.com> +Date: Thu, 6 Jul 2017 14:54:02 +0100 +Subject: [PATCH] Bug 698158: prevent trying to reloc a freed object + +In the token reader, we pass the scanner state structure around as a +t_struct ref on the Postscript operand stack. + +But we explicitly free the scanner state when we're done, which leaves a +dangling reference on the operand stack and, unless that reference gets +overwritten before the next garbager run, we can end up with the garbager +trying to deal with an already freed object - that can cause a crash, or +memory corruption. +--- + psi/ztoken.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- end of original header + +CVE: CVE-2017-11714 + +Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git] + +Signed-off-by: Joe Slater <joe.slater@windriver.com> + +diff --git a/psi/ztoken.c b/psi/ztoken.c +index 4dba7c5..af1ceeb 100644 +--- a/psi/ztoken.c ++++ b/psi/ztoken.c +@@ -107,6 +107,12 @@ token_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save) + int code; + ref token; + ++ /* Since we might free pstate below, and we're dealing with ++ * gc memory referenced by the stack, we need to explicitly ++ * remove the reference to pstate from the stack, otherwise ++ * the garbager will fall over ++ */ ++ make_null(osp); + /* Note that gs_scan_token may change osp! */ + pop(1); /* remove the file or scanner state */ + again: +@@ -183,8 +189,14 @@ ztokenexec_continue(i_ctx_t *i_ctx_p) + static int + tokenexec_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save) + { +- os_ptr op; ++ os_ptr op = osp; + int code; ++ /* Since we might free pstate below, and we're dealing with ++ * gc memory referenced by the stack, we need to explicitly ++ * remove the reference to pstate from the stack, otherwise ++ * the garbager will fall over ++ */ ++ make_null(osp); + /* Note that gs_scan_token may change osp! */ + pop(1); + again: +-- +1.7.9.5 + |