74 lines
2.5 KiB
Diff
74 lines
2.5 KiB
Diff
|
Fix CVE-2017-8291:
|
||
|
|
|
||
|
|
https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-8291
|
||
|
|
|
||
|
|
This patch is adapted from these two Artifex Ghostscript commits by Leo
|
||
|
|
Famulari <leo@famulari.name>:
|
||
|
|
|
||
|
|
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce174eed24edec7ad5b920eb93db4d47d;hp=4f83478c88c2e05d6e8d79ca4557eb039354d2f3
|
||
|
|
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3;hp=5603e8fc3e59c435318877efe627967ee6baebb8
|
||
|
|
|
||
|
|
diff --git a/psi/zfrsd.c b/psi/zfrsd.c
|
||
|
|
index fb4bce9..2629afa 100644
|
||
|
|
--- a/psi/zfrsd.c
|
||
|
|
+++ b/psi/zfrsd.c
|
||
|
|
@@ -49,13 +49,20 @@ zrsdparams(i_ctx_t *i_ctx_p)
|
||
|
|
ref *pFilter;
|
||
|
|
ref *pDecodeParms;
|
||
|
|
int Intent = 0;
|
||
|
|
- bool AsyncRead;
|
||
|
|
+ bool AsyncRead = false;
|
||
|
|
ref empty_array, filter1_array, parms1_array;
|
||
|
|
uint i;
|
||
|
|
- int code;
|
||
|
|
+ int code = 0;
|
||
|
|
+
|
||
|
|
+ if (ref_stack_count(&o_stack) < 1)
|
||
|
|
+ return_error(e_stackunderflow);
|
||
|
|
+ if (!r_has_type(op, t_dictionary) && !r_has_type(op, t_null)) {
|
||
|
|
+ return_error(e_typecheck);
|
||
|
|
+ }
|
||
|
|
|
||
|
|
make_empty_array(&empty_array, a_readonly);
|
||
|
|
- if (dict_find_string(op, "Filter", &pFilter) > 0) {
|
||
|
|
+ if (r_has_type(op, t_dictionary)
|
||
|
|
+ && dict_find_string(op, "Filter", &pFilter) > 0) {
|
||
|
|
if (!r_is_array(pFilter)) {
|
||
|
|
if (!r_has_type(pFilter, t_name))
|
||
|
|
return_error(e_typecheck);
|
||
|
|
@@ -94,12 +101,13 @@ zrsdparams(i_ctx_t *i_ctx_p)
|
||
|
|
return_error(e_typecheck);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
- code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
|
||
|
|
+ if (r_has_type(op, t_dictionary))
|
||
|
|
+ code = dict_int_param(op, "Intent", 0, 3, 0, &Intent);
|
||
|
|
if (code < 0 && code != e_rangecheck) /* out-of-range int is ok, use 0 */
|
||
|
|
return code;
|
||
|
|
- if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0
|
||
|
|
- )
|
||
|
|
- return code;
|
||
|
|
+ if (r_has_type(op, t_dictionary))
|
||
|
|
+ if ((code = dict_bool_param(op, "AsyncRead", false, &AsyncRead)) < 0)
|
||
|
|
+ return code;
|
||
|
|
push(1);
|
||
|
|
op[-1] = *pFilter;
|
||
|
|
if (pDecodeParms)
|
||
|
|
diff --git a/psi/zmisc3.c b/psi/zmisc3.c
|
||
|
|
index 54b3042..0d357f1 100644
|
||
|
|
--- a/psi/zmisc3.c
|
||
|
|
+++ b/psi/zmisc3.c
|
||
|
|
@@ -56,6 +56,12 @@ zeqproc(i_ctx_t *i_ctx_p)
|
||
|
|
ref2_t stack[MAX_DEPTH + 1];
|
||
|
|
ref2_t *top = stack;
|
||
|
|
|
||
|
|
+ if (ref_stack_count(&o_stack) < 2)
|
||
|
|
+ return_error(e_stackunderflow);
|
||
|
|
+ if (!r_is_array(op - 1) || !r_is_array(op)) {
|
||
|
|
+ return_error(e_typecheck);
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
make_array(&stack[0].proc1, 0, 1, op - 1);
|
||
|
|
make_array(&stack[0].proc2, 0, 1, op);
|
||
|
|
for (;;) {
|