nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gnu: ghostscript: Add fix for CVE-2015-3228. 

* gnu/packages/patches/ghostscript-CVE-2015-3228.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/ghostscript.scm (ghostscript)[source]: Add patch.
This commit is contained in:
Mark H Weaver 2015-07-25 23:48:54 -04:00
parent 6d7a0eeded
commit 35a12b4719
3 changed files with 36 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
gnu-system.am
View File

@ -444,6 +444,7 @@ dist_patch_DATA = \
gnu/packages/patches/gcc-libvtv-runpath.patch \
gnu/packages/patches/gcc-5.0-libvtv-runpath.patch \
gnu/packages/patches/geoclue-config.patch \
gnu/packages/patches/ghostscript-CVE-2015-3228.patch \
gnu/packages/patches/ghostscript-runpath.patch \
gnu/packages/patches/gitolite-openssh-6.8-compat.patch \
gnu/packages/patches/glib-tests-desktop.patch \

5
gnu/packages/ghostscript.scm
View File

@ -1,6 +1,6 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
;;;
@ -129,7 +129,8 @@ printing, and psresize, for adjusting page sizes.")
(sha256
(base32
"0q4jj41p0qbr4mgcc9q78f5zs8cm1g57wgryhsm2yq4lfslm3ib1"))
(patches (list (search-patch "ghostscript-runpath.patch")))
(patches (map search-patch '("ghostscript-CVE-2015-3228.patch"
"ghostscript-runpath.patch")))
(modules '((guix build utils)))
(snippet
;; Honor --docdir.

32
gnu/packages/patches/ghostscript-CVE-2015-3228.patch Normal file
View File

@ -0,0 +1,32 @@
The file names in the upstream patch below were modified to apply to GNU
ghostscript.
From 0c0b0859ae1aba64861599f0e7f74f143f305932 Mon Sep 17 00:00:00 2001
From: Chris Liddell <chris.liddell@artifex.com>
Date: Tue, 7 Jul 2015 16:57:41 +0100
Subject: [PATCH] Bug 696041: sanity check for memory allocation.
In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the
variable holding the actual number of bytes we allocate.
No cluster differences
---
gs/base/gsmalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/base/gsmalloc.c b/base/gsmalloc.c
index 624552d..cad79c2 100644
--- a/base/gsmalloc.c
+++ b/base/gsmalloc.c
@@ -178,7 +178,7 @@ gs_heap_alloc_bytes(gs_memory_t * mem, uint size, client_name_t cname)
} else {
uint added = size + sizeof(gs_malloc_block_t);
- if (mmem->limit - added < mmem->used)
+ if (added <= size || mmem->limit - added < mmem->used)
set_msg("exceeded limit");
else if ((ptr = (byte *) Memento_label(malloc(added), cname)) == 0)
set_msg("failed");
--
2.4.6