File CVE-2021-3781.patch of Package ghostscript

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2021-3781.patch of Package ghostscript (Revision d07299f731e14a5baa5b72b3753344b4)

Currently displaying revision d07299f731e14a5baa5b72b3753344b4 , Show latest

--- base/gdevpipe.c.orig	2020-03-19 09:21:42.000000000 +0100
+++ base/gdevpipe.c	2021-09-10 08:35:22.681027130 +0200
@@ -66,8 +66,28 @@ pipe_fopen(gx_io_device * iodev, const c
 #else
     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
     gs_fs_list_t *fs = ctx->core->fs;
+    /* The pipe device can be reached in two ways, explicltly with %pipe%
+       or implicitly with "|", so we have to check for both
+     */
+    char f[gp_file_name_sizeof];
+    const char *pipestr = "|";
+    const size_t pipestrlen = strlen(pipestr);
+    const size_t preflen = strlen(iodev->dname);
+    const size_t nlen = strlen(fname);
+    int code1;
 
-    if (gp_validate_path(mem, fname, access) != 0)
+    if (preflen + nlen >= gp_file_name_sizeof)
+        return_error(gs_error_invalidaccess);
+
+    memcpy(f, iodev->dname, preflen);
+    memcpy(f + preflen, fname, nlen + 1);
+
+    code1 = gp_validate_path(mem, f, access);
+
+    memcpy(f, pipestr, pipestrlen);
+    memcpy(f + pipestrlen, fname, nlen + 1);
+
+    if (code1 != 0 && gp_validate_path(mem, f, access) != 0 )
         return gs_error_invalidfileaccess;
 
     /*
--- base/gp_os2pr.c.orig	2020-03-19 09:21:42.000000000 +0100
+++ base/gp_os2pr.c	2021-09-10 08:35:22.681027130 +0200
@@ -107,9 +107,20 @@ os2_printer_fopen(gx_io_device * iodev,
            FILE ** pfile, char *rfname, uint rnamelen)
 {
     os2_printer_t *pr = (os2_printer_t *)iodev->state;
-    char driver_name[256];
+    char driver_name[gp_file_name_sizeof];
     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
     gs_fs_list_t *fs = ctx->core->fs;
+    const size_t preflen = strlen(iodev->dname);
+    const int size_t = strlen(fname);
+
+    if (preflen + nlen >= gp_file_name_sizeof)
+        return_error(gs_error_invalidaccess);
+
+    memcpy(driver_name, iodev->dname, preflen);
+    memcpy(driver_name + preflen, fname, nlen + 1);
+
+    if (gp_validate_path(mem, driver_name, access) != 0)
+        return gs_error_invalidfileaccess;
 
     /* First we try the open_printer method. */
     /* Note that the loop condition here ensures we don't
--- base/gp_msprn.c.orig	2020-03-19 09:21:42.000000000 +0100
+++ base/gp_msprn.c	2021-09-10 08:35:22.681027130 +0200
@@ -168,8 +168,16 @@ mswin_printer_fopen(gx_io_device * iodev
     unsigned long *ptid = &((tid_t *)(iodev->state))->tid;
     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
     gs_fs_list_t *fs = ctx->core->fs;
+    const size_t preflen = strlen(iodev->dname);
+    const size_t nlen = strlen(fname);
 
-    if (gp_validate_path(mem, fname, access) != 0)
+    if (preflen + nlen >= gp_file_name_sizeof)
+        return_error(gs_error_invalidaccess);
+
+    memcpy(pname, iodev->dname, preflen);
+    memcpy(pname + preflen, fname, nlen + 1);
+
+    if (gp_validate_path(mem, pname, access) != 0)
         return gs_error_invalidfileaccess;
 
     /* First we try the open_printer method. */
--- base/gp_mshdl.c.orig	2020-03-19 09:21:42.000000000 +0100
+++ base/gp_mshdl.c	2021-09-10 08:35:22.681027130 +0200
@@ -95,8 +95,17 @@ mswin_handle_fopen(gx_io_device * iodev,
     long hfile;	/* Correct for Win32, may be wrong for Win64 */
     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
     gs_fs_list_t *fs = ctx->core->fs;
+    char f[gp_file_name_sizeof];
+    const size_t preflen = strlen(iodev->dname);
+    const size_t nlen = strlen(fname);
 
-    if (gp_validate_path(mem, fname, access) != 0)
+    if (preflen + nlen >= gp_file_name_sizeof)
+        return_error(gs_error_invalidaccess);
+
+    memcpy(f, iodev->dname, preflen);
+    memcpy(f + preflen, fname, nlen + 1);
+
+    if (gp_validate_path(mem, f, access) != 0)
         return gs_error_invalidfileaccess;
 
     /* First we try the open_handle method. */
--- base/gslibctx.c.orig	2021-09-10 08:35:22.681027130 +0200
+++ base/gslibctx.c	2021-09-10 08:50:41.892424607 +0200
@@ -635,74 +635,39 @@ rewrite_percent_specifiers(char *s)
 int
 gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname)
 {
-    char *fp, f[gp_file_name_sizeof];
-    const int pipe = 124; /* ASCII code for '|' */
-    const int len = strlen(fname);
-    int i;
+    char f[gp_file_name_sizeof];
+    int code;
 
     /* Be sure the string copy will fit */
-    if (len >= gp_file_name_sizeof)
+    if (strlen(fname) >= gp_file_name_sizeof)
         return gs_error_rangecheck;
     strcpy(f, fname);
-    fp = f;
     /* Try to rewrite any %d (or similar) in the string */
     rewrite_percent_specifiers(f);
-    for (i = 0; i < len; i++) {
-        if (f[i] == pipe) {
-           int code;
-
-           fp = &f[i + 1];
-           /* Because we potentially have to check file permissions at two levels
-              for the output file (gx_device_open_output_file and the low level
-              fopen API, if we're using a pipe, we have to add both the full string,
-              (including the '|', and just the command to which we pipe - since at
-              the pipe_fopen(), the leading '|' has been stripped.
-            */
-           code = gs_add_control_path(mem, gs_permit_file_writing, f);
-           if (code < 0)
-               return code;
-           break;
-        }
-        if (!IS_WHITESPACE(f[i]))
-            break;
-    }
-    return gs_add_control_path(mem, gs_permit_file_writing, fp);
+
+    code = gs_add_control_path(mem, gs_permit_file_control, f);
+    if (code < 0)
+        return code;
+    return gs_add_control_path(mem, gs_permit_file_writing, f);
 }
 
 int
 gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname)
 {
-    char *fp, f[gp_file_name_sizeof];
-    const int pipe = 124; /* ASCII code for '|' */
-    const int len = strlen(fname);
-    int i;
+    char f[gp_file_name_sizeof];
+    int code;
 
     /* Be sure the string copy will fit */
-    if (len >= gp_file_name_sizeof)
+    if (strlen(fname) >= gp_file_name_sizeof)
         return gs_error_rangecheck;
     strcpy(f, fname);
-    fp = f;
     /* Try to rewrite any %d (or similar) in the string */
-    for (i = 0; i < len; i++) {
-        if (f[i] == pipe) {
-           int code;
-
-           fp = &f[i + 1];
-           /* Because we potentially have to check file permissions at two levels
-              for the output file (gx_device_open_output_file and the low level
-              fopen API, if we're using a pipe, we have to add both the full string,
-              (including the '|', and just the command to which we pipe - since at
-              the pipe_fopen(), the leading '|' has been stripped.
-            */
-           code = gs_remove_control_path(mem, gs_permit_file_writing, f);
-           if (code < 0)
-               return code;
-           break;
-        }
-        if (!IS_WHITESPACE(f[i]))
-            break;
-    }
-    return gs_remove_control_path(mem, gs_permit_file_writing, fp);
+    rewrite_percent_specifiers(f);
+
+    code = gs_remove_control_path(mem, gs_permit_file_control, f);
+    if (code < 0)
+        return code;
+    return gs_remove_control_path(mem, gs_permit_file_writing, f);
 }
 
 int

Places

File CVE-2021-3781.patch of Package ghostscript (Revision d07299f731e14a5baa5b72b3753344b4)

Places