From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DD6C8C433EF for ; Sat, 15 Jan 2022 11:07:21 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 9D96C814BB; Sat, 15 Jan 2022 11:07:21 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uAnHE5nyph7m; Sat, 15 Jan 2022 11:07:20 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by smtp1.osuosl.org (Postfix) with ESMTP id C3C7181770; Sat, 15 Jan 2022 11:07:19 +0000 (UTC) Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by ash.osuosl.org (Postfix) with ESMTP id 212E91BF95D for ; Sat, 15 Jan 2022 11:07:07 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 0D7ED400C8 for ; Sat, 15 Jan 2022 11:07:07 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id neKk6jJWmfK6 for ; Sat, 15 Jan 2022 11:07:06 +0000 (UTC) Received: from busybox.osuosl.org (busybox.osuosl.org [140.211.167.122]) by smtp2.osuosl.org (Postfix) with ESMTP id 15F6C400A6 for ; Sat, 15 Jan 2022 11:07:06 +0000 (UTC) Received: by busybox.osuosl.org (Postfix, from userid 4049) id 274EB813F0; Sat, 15 Jan 2022 11:00:38 +0000 (UTC) From: Yann E. MORIN To: buildroot@buildroot.org Date: Sat, 15 Jan 2022 12:05:31 +0100 X-Git-Refname: refs/heads/master X-Git-Oldrev: 488f92a1c368c842f9f6c1bbae0384cfa803a684 X-Git-Newrev: 70910c4092d9c9f359c26436fbc3c75918a90129 X-Patchwork-Hint: ignore Message-Id: <20220115110038.274EB813F0@busybox.osuosl.org> Subject: [Buildroot] [git commit] package/ghostscript: fix CVE-2021-45944 X-BeenThere: buildroot@buildroot.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: buildroot-bounces@buildroot.org Sender: "buildroot" commit: https://git.buildroot.net/buildroot/commit/?id=70910c4092d9c9f359c26436fbc3c75918a90129 branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). Signed-off-by: Fabrice Fontaine Signed-off-by: Yann E. MORIN --- ...ck-stack-limits-after-function-evaluation.patch | 52 ++++++++++++++++++++++ package/ghostscript/ghostscript.mk | 3 ++ 2 files changed, 55 insertions(+) diff --git a/package/ghostscript/0003-oss-fuzz-30715-Check-stack-limits-after-function-evaluation.patch b/package/ghostscript/0003-oss-fuzz-30715-Check-stack-limits-after-function-evaluation.patch new file mode 100644 index 0000000000..352f1754f6 --- /dev/null +++ b/package/ghostscript/0003-oss-fuzz-30715-Check-stack-limits-after-function-evaluation.patch @@ -0,0 +1,52 @@ +From 7861fcad13c497728189feafb41cd57b5b50ea25 Mon Sep 17 00:00:00 2001 +From: Chris Liddell +Date: Fri, 12 Feb 2021 10:34:23 +0000 +Subject: [PATCH] oss-fuzz 30715: Check stack limits after function evaluation. + +During function result sampling, after the callout to the Postscript +interpreter, make sure there is enough stack space available before pushing +or popping entries. + +In thise case, the Postscript procedure for the "function" is totally invalid +(as a function), and leaves the op stack in an unrecoverable state (as far as +function evaluation is concerned). We end up popping more entries off the +stack than are available. + +To cope, add in stack limit checking to throw an appropriate error when this +happens. + +[Retrieved from: +https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=7861fcad13c497728189feafb41cd57b5b50ea25] +Signed-off-by: Fabrice Fontaine +--- + psi/zfsample.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/psi/zfsample.c b/psi/zfsample.c +index 290809405..652ae02c6 100644 +--- a/psi/zfsample.c ++++ b/psi/zfsample.c +@@ -551,9 +551,17 @@ sampled_data_continue(i_ctx_t *i_ctx_p) + } else { + if (stack_depth_adjust) { + stack_depth_adjust -= num_out; +- push(O_STACK_PAD - stack_depth_adjust); +- for (i=0;i