[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
01/01: gnu: ghostscript: Add fix for CVE-2015-3228.
From: |
Mark H. Weaver |
Subject: |
01/01: gnu: ghostscript: Add fix for CVE-2015-3228. |
Date: |
Sun, 26 Jul 2015 03:56:45 +0000 |
mhw pushed a commit to branch ghostscript-update
in repository guix.
commit add49e6eec36f6bd7103e4ca64fe477a6e97f7c7
Author: Mark H Weaver <address@hidden>
Date: Sat Jul 25 23:48:54 2015 -0400
gnu: ghostscript: Add fix for CVE-2015-3228.
* gnu/packages/patches/ghostscript-CVE-2015-3228.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/ghostscript.scm (ghostscript)[source]: Add patch.
---
gnu-system.am | 1 +
gnu/packages/ghostscript.scm | 5 ++-
.../patches/ghostscript-CVE-2015-3228.patch | 32 ++++++++++++++++++++
3 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/gnu-system.am b/gnu-system.am
index d6635fe..8241b4e 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -443,6 +443,7 @@ dist_patch_DATA =
\
gnu/packages/patches/gcc-libvtv-runpath.patch \
gnu/packages/patches/gcc-5.0-libvtv-runpath.patch \
gnu/packages/patches/geoclue-config.patch \
+ gnu/packages/patches/ghostscript-CVE-2015-3228.patch \
gnu/packages/patches/ghostscript-runpath.patch \
gnu/packages/patches/gitolite-openssh-6.8-compat.patch \
gnu/packages/patches/glib-tests-desktop.patch \
diff --git a/gnu/packages/ghostscript.scm b/gnu/packages/ghostscript.scm
index 09306e9..bd57889 100644
--- a/gnu/packages/ghostscript.scm
+++ b/gnu/packages/ghostscript.scm
@@ -1,6 +1,6 @@
;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2013 Andreas Enge <address@hidden>
-;;; Copyright © 2014 Mark H Weaver <address@hidden>
+;;; Copyright © 2014, 2015 Mark H Weaver <address@hidden>
;;; Copyright © 2015 Ricardo Wurmus <address@hidden>
;;; Copyright © 2015 Ludovic Courtès <address@hidden>
;;;
@@ -129,7 +129,8 @@ printing, and psresize, for adjusting page sizes.")
(sha256
(base32
"0q4jj41p0qbr4mgcc9q78f5zs8cm1g57wgryhsm2yq4lfslm3ib1"))
- (patches (list (search-patch "ghostscript-runpath.patch")))
+ (patches (map search-patch '("ghostscript-CVE-2015-3228.patch"
+ "ghostscript-runpath.patch")))
(modules '((guix build utils)))
(snippet
;; Honor --docdir.
diff --git a/gnu/packages/patches/ghostscript-CVE-2015-3228.patch
b/gnu/packages/patches/ghostscript-CVE-2015-3228.patch
new file mode 100644
index 0000000..c19fdb1
--- /dev/null
+++ b/gnu/packages/patches/ghostscript-CVE-2015-3228.patch
@@ -0,0 +1,32 @@
+The file names in the upstream patch below were modified to apply to GNU
+ghostscript.
+
+From 0c0b0859ae1aba64861599f0e7f74f143f305932 Mon Sep 17 00:00:00 2001
+From: Chris Liddell <address@hidden>
+Date: Tue, 7 Jul 2015 16:57:41 +0100
+Subject: [PATCH] Bug 696041: sanity check for memory allocation.
+
+In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the
+variable holding the actual number of bytes we allocate.
+
+No cluster differences
+---
+ gs/base/gsmalloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/base/gsmalloc.c b/base/gsmalloc.c
+index 624552d..cad79c2 100644
+--- a/base/gsmalloc.c
++++ b/base/gsmalloc.c
+@@ -178,7 +178,7 @@ gs_heap_alloc_bytes(gs_memory_t * mem, uint size,
client_name_t cname)
+ } else {
+ uint added = size + sizeof(gs_malloc_block_t);
+
+- if (mmem->limit - added < mmem->used)
++ if (added <= size || mmem->limit - added < mmem->used)
+ set_msg("exceeded limit");
+ else if ((ptr = (byte *) Memento_label(malloc(added), cname)) == 0)
+ set_msg("failed");
+--
+2.4.6
+