Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:Update
ghostscript.28526
CVE-2021-3781.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2021-3781.patch of Package ghostscript.28526
--- base/gdevpipe.c.orig 2020-03-19 09:21:42.000000000 +0100 +++ base/gdevpipe.c 2021-09-10 08:35:22.681027130 +0200 @@ -66,8 +66,28 @@ pipe_fopen(gx_io_device * iodev, const c #else gs_lib_ctx_t *ctx = mem->gs_lib_ctx; gs_fs_list_t *fs = ctx->core->fs; + /* The pipe device can be reached in two ways, explicltly with %pipe% + or implicitly with "|", so we have to check for both + */ + char f[gp_file_name_sizeof]; + const char *pipestr = "|"; + const size_t pipestrlen = strlen(pipestr); + const size_t preflen = strlen(iodev->dname); + const size_t nlen = strlen(fname); + int code1; - if (gp_validate_path(mem, fname, access) != 0) + if (preflen + nlen >= gp_file_name_sizeof) + return_error(gs_error_invalidaccess); + + memcpy(f, iodev->dname, preflen); + memcpy(f + preflen, fname, nlen + 1); + + code1 = gp_validate_path(mem, f, access); + + memcpy(f, pipestr, pipestrlen); + memcpy(f + pipestrlen, fname, nlen + 1); + + if (code1 != 0 && gp_validate_path(mem, f, access) != 0 ) return gs_error_invalidfileaccess; /* --- base/gp_os2pr.c.orig 2020-03-19 09:21:42.000000000 +0100 +++ base/gp_os2pr.c 2021-09-10 08:35:22.681027130 +0200 @@ -107,9 +107,20 @@ os2_printer_fopen(gx_io_device * iodev, FILE ** pfile, char *rfname, uint rnamelen) { os2_printer_t *pr = (os2_printer_t *)iodev->state; - char driver_name[256]; + char driver_name[gp_file_name_sizeof]; gs_lib_ctx_t *ctx = mem->gs_lib_ctx; gs_fs_list_t *fs = ctx->core->fs; + const size_t preflen = strlen(iodev->dname); + const int size_t = strlen(fname); + + if (preflen + nlen >= gp_file_name_sizeof) + return_error(gs_error_invalidaccess); + + memcpy(driver_name, iodev->dname, preflen); + memcpy(driver_name + preflen, fname, nlen + 1); + + if (gp_validate_path(mem, driver_name, access) != 0) + return gs_error_invalidfileaccess; /* First we try the open_printer method. */ /* Note that the loop condition here ensures we don't --- base/gp_msprn.c.orig 2020-03-19 09:21:42.000000000 +0100 +++ base/gp_msprn.c 2021-09-10 08:35:22.681027130 +0200 @@ -168,8 +168,16 @@ mswin_printer_fopen(gx_io_device * iodev unsigned long *ptid = &((tid_t *)(iodev->state))->tid; gs_lib_ctx_t *ctx = mem->gs_lib_ctx; gs_fs_list_t *fs = ctx->core->fs; + const size_t preflen = strlen(iodev->dname); + const size_t nlen = strlen(fname); - if (gp_validate_path(mem, fname, access) != 0) + if (preflen + nlen >= gp_file_name_sizeof) + return_error(gs_error_invalidaccess); + + memcpy(pname, iodev->dname, preflen); + memcpy(pname + preflen, fname, nlen + 1); + + if (gp_validate_path(mem, pname, access) != 0) return gs_error_invalidfileaccess; /* First we try the open_printer method. */ --- base/gp_mshdl.c.orig 2020-03-19 09:21:42.000000000 +0100 +++ base/gp_mshdl.c 2021-09-10 08:35:22.681027130 +0200 @@ -95,8 +95,17 @@ mswin_handle_fopen(gx_io_device * iodev, long hfile; /* Correct for Win32, may be wrong for Win64 */ gs_lib_ctx_t *ctx = mem->gs_lib_ctx; gs_fs_list_t *fs = ctx->core->fs; + char f[gp_file_name_sizeof]; + const size_t preflen = strlen(iodev->dname); + const size_t nlen = strlen(fname); - if (gp_validate_path(mem, fname, access) != 0) + if (preflen + nlen >= gp_file_name_sizeof) + return_error(gs_error_invalidaccess); + + memcpy(f, iodev->dname, preflen); + memcpy(f + preflen, fname, nlen + 1); + + if (gp_validate_path(mem, f, access) != 0) return gs_error_invalidfileaccess; /* First we try the open_handle method. */ --- base/gslibctx.c.orig 2021-09-10 08:35:22.681027130 +0200 +++ base/gslibctx.c 2021-09-10 08:50:41.892424607 +0200 @@ -635,74 +635,39 @@ rewrite_percent_specifiers(char *s) int gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname) { - char *fp, f[gp_file_name_sizeof]; - const int pipe = 124; /* ASCII code for '|' */ - const int len = strlen(fname); - int i; + char f[gp_file_name_sizeof]; + int code; /* Be sure the string copy will fit */ - if (len >= gp_file_name_sizeof) + if (strlen(fname) >= gp_file_name_sizeof) return gs_error_rangecheck; strcpy(f, fname); - fp = f; /* Try to rewrite any %d (or similar) in the string */ rewrite_percent_specifiers(f); - for (i = 0; i < len; i++) { - if (f[i] == pipe) { - int code; - - fp = &f[i + 1]; - /* Because we potentially have to check file permissions at two levels - for the output file (gx_device_open_output_file and the low level - fopen API, if we're using a pipe, we have to add both the full string, - (including the '|', and just the command to which we pipe - since at - the pipe_fopen(), the leading '|' has been stripped. - */ - code = gs_add_control_path(mem, gs_permit_file_writing, f); - if (code < 0) - return code; - break; - } - if (!IS_WHITESPACE(f[i])) - break; - } - return gs_add_control_path(mem, gs_permit_file_writing, fp); + + code = gs_add_control_path(mem, gs_permit_file_control, f); + if (code < 0) + return code; + return gs_add_control_path(mem, gs_permit_file_writing, f); } int gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname) { - char *fp, f[gp_file_name_sizeof]; - const int pipe = 124; /* ASCII code for '|' */ - const int len = strlen(fname); - int i; + char f[gp_file_name_sizeof]; + int code; /* Be sure the string copy will fit */ - if (len >= gp_file_name_sizeof) + if (strlen(fname) >= gp_file_name_sizeof) return gs_error_rangecheck; strcpy(f, fname); - fp = f; /* Try to rewrite any %d (or similar) in the string */ - for (i = 0; i < len; i++) { - if (f[i] == pipe) { - int code; - - fp = &f[i + 1]; - /* Because we potentially have to check file permissions at two levels - for the output file (gx_device_open_output_file and the low level - fopen API, if we're using a pipe, we have to add both the full string, - (including the '|', and just the command to which we pipe - since at - the pipe_fopen(), the leading '|' has been stripped. - */ - code = gs_remove_control_path(mem, gs_permit_file_writing, f); - if (code < 0) - return code; - break; - } - if (!IS_WHITESPACE(f[i])) - break; - } - return gs_remove_control_path(mem, gs_permit_file_writing, fp); + rewrite_percent_specifiers(f); + + code = gs_remove_control_path(mem, gs_permit_file_control, f); + if (code < 0) + return code; + return gs_remove_control_path(mem, gs_permit_file_writing, f); } int
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
