开源软件构建与测试

_service:tar_scm:ghostscript.spec Changed

@@ -17,6 +17,29 @@
 
 Patch0:  ghostscript-9.23-100-run-dvipdf-securely.patch
 
+# https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=37ed5022cecd
+# https://bugs.ghostscript.com/show_bug.cgi?id=706494
+# fix CVE-2023-28879 Buffer Overflow in s_xBCPE_process
+Patch101:  CVE-2023-28879.patch
+
+# https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=505eab7782b429017eb434b2b95120855f2b0e3c and
+# https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d
+# fix see https://bugs.ghostscript.com/show_bug.cgi?id=706761
+# "OS command injection in %pipe% access"
+# and https://bugs.ghostscript.com/show_bug.cgi?id=706778
+# "%pipe% allowed_path bypass"
+Patch102:  CVE-2023-36664.patch
+
+# https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1
+# CVE-2023-38559.patch fix
+# "out of bounds read devn_pcx_write_rle() could result in DoS"
+# and https://bugs.ghostscript.com/show_bug.cgi?id=706897
+# which is in base/gdevdevn.c the same issue
+# "ordering in if expression to avoid out-of-bounds access"
+# as the already fixed CVE-2020-16305 in devices/gdevpcx.c
+# see https://bugs.ghostscript.com/show_bug.cgi?id=701819
+Patch103:  CVE-2023-38559.patch
+
 BuildRequires:    automake gcc
 BuildRequires:    adobe-mappings-cmap-devel adobe-mappings-pdf-devel
 BuildRequires:    google-droid-sans-fonts urw-base35-fonts-devel
@@ -82,7 +105,11 @@
 PDF files using Ghostscript and dvips
 
 %prep
-%autosetup -n %{name}-%{version} -p1
+%setup -q -n %{name}-%{version}
+%patch0 -p1
+%patch101 -p0
+%patch102 -p0
+%patch103 -p0
 
 # Libraries that we already have packaged(see Build Requirements):
 rm -rf cups/libs freetype ijs jbig2dec jpeg lcms2* libpng openjpeg tiff zlib
@@ -176,6 +203,12 @@
 %{_bindir}/dvipdf
 
 %changelog
+* Wed Aug  2 2023 dillon chen <dillon.chen@gmail.com> - 9.56.1-2
+- Type:CVE
+- ID:NA
+- SUG:NA
+- DESC:fix CVE-2023-28879 CVE-2023-36664 CVE-2023-38559
+
 * Mon Jun 20 2022 dillon chen <dillon.chen@gmail.com> - 9.56.1-1
 - update vserion to 9.56.1

_service:tar_scm:CVE-2023-28879.patch Added

_service:tar_scm:CVE-2023-36664.patch Added

@@ -0,0 +1,116 @@
+--- base/gpmisc.c.orig	2022-04-04 15:48:49.000000000 +0200
++++ base/gpmisc.c	2023-07-04 08:13:02.173325373 +0200
+@@ -1076,16 +1076,29 @@ gp_validate_path_len(const gs_memory_t *
+              && !memcmp(path + cdirstrl, dirsepstr, dirsepstrl)) {
+           prefix_len = 0;
+     }
+-    rlen = len+1;
+-    bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path");
+-    if (bufferfull == NULL)
+-        return gs_error_VMerror;
+ 
+-    buffer = bufferfull + prefix_len;
+-    if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
+-        return gs_error_invalidfileaccess;
+-    bufferrlen = 0;
++    /* "%pipe%" do not follow the normal rules for path definitions, so we
++       don't "reduce" them to avoid unexpected results
++     */
++    if (path0 == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) {
++        bufferfull = buffer = (char *)gs_alloc_bytes(mem->thread_safe_memory, len + 1, "gp_validate_path");
++        if (buffer == NULL)
++            return gs_error_VMerror;
++        memcpy(buffer, path, len);
++        bufferlen = 0;
++        rlen = len;
++    }
++    else {
++        rlen = len+1;
++        bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path");
++        if (bufferfull == NULL)
++            return gs_error_VMerror;
+ 
++        buffer = bufferfull + prefix_len;
++        if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
++            return gs_error_invalidfileaccess;
++        bufferrlen = 0;
++    }
+     while (1) {
+         switch (mode0)
+         {
+--- base/gslibctx.c.orig	2022-04-04 15:48:49.000000000 +0200
++++ base/gslibctx.c	2023-07-04 08:09:47.834639430 +0200
+@@ -740,14 +740,28 @@ gs_add_control_path_len_flags(const gs_m
+             return gs_error_rangecheck;
+     }
+ 
+-    rlen = len+1;
+-    buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gp_validate_path");
+-    if (buffer == NULL)
+-        return gs_error_VMerror;
+-
+-    if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
+-        return gs_error_invalidfileaccess;
+-    bufferrlen = 0;
++    /* "%pipe%" do not follow the normal rules for path definitions, so we
++       don't "reduce" them to avoid unexpected results
++     */
++    if (path0 == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) {
++        buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_add_control_path_len");
++        if (buffer == NULL)
++            return gs_error_VMerror;
++        memcpy(buffer, path, len);
++        bufferlen = 0;
++        rlen = len;
++    }
++    else {
++        rlen = len + 1;
++
++        buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gs_add_control_path_len");
++        if (buffer == NULL)
++            return gs_error_VMerror;
++
++        if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
++            return gs_error_invalidfileaccess;
++        bufferrlen = 0;
++    }
+ 
+     n = control->num;
+     for (i = 0; i < n; i++)
+@@ -833,14 +847,28 @@ gs_remove_control_path_len_flags(const g
+             return gs_error_rangecheck;
+     }
+ 
+-    rlen = len+1;
+-    buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gp_validate_path");
+-    if (buffer == NULL)
+-        return gs_error_VMerror;
+-
+-    if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
+-        return gs_error_invalidfileaccess;
+-    bufferrlen = 0;
++    /* "%pipe%" do not follow the normal rules for path definitions, so we
++       don't "reduce" them to avoid unexpected results
++     */
++    if (path0 == '|' || (len > 5 && memcmp(path, "%pipe", 5) == 0)) {
++        buffer = (char *)gs_alloc_bytes(core->memory, len + 1, "gs_remove_control_path_len");
++        if (buffer == NULL)
++            return gs_error_VMerror;
++        memcpy(buffer, path, len);
++        bufferlen = 0;
++        rlen = len;
++    }
++    else {
++        rlen = len+1;
++
++        buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gs_remove_control_path_len");
++        if (buffer == NULL)
++            return gs_error_VMerror;
++
++        if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
++            return gs_error_invalidfileaccess;
++        bufferrlen = 0;
++    }
+ 
+     n = control->num;
+     for (i = 0; i < n; i++) {

_service:tar_scm:CVE-2023-38559.patch Added

Changes of Revision 10