code.ossystems Code Review - openembedded-core.git/blob

   1 From 1b516be5f6829ab6ce37835529ba08abd6d18663 Mon Sep 17 00:00:00 2001
   2 From: Chris Liddell <chris.liddell@artifex.com>
   3 Date: Tue, 21 Aug 2018 16:42:45 +0100
   4 Subject: [PATCH 2/5] Bug 699656: Handle LockDistillerParams not being a
   5  boolean
   6
   7 This caused a function call commented as "Can't fail" to fail, and resulted
   8 in memory correuption and a segfault.
   9
  10 CVE: CVE-2018-15910
  11 Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
  12
  13 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
  14 ---
  15  devices/vector/gdevpdfp.c | 2 +-
  16  psi/iparam.c              | 7 ++++---
  17  2 files changed, 5 insertions(+), 4 deletions(-)
  18
  19 diff --git a/devices/vector/gdevpdfp.c b/devices/vector/gdevpdfp.c
  20 index 522db7a..f2816b9 100644
  21 --- a/devices/vector/gdevpdfp.c
  22 +++ b/devices/vector/gdevpdfp.c
  23 @@ -364,7 +364,7 @@ gdev_pdf_put_params_impl(gx_device * dev, const gx_device_pdf * save_dev, gs_par
  24       * LockDistillerParams is read again, and reset if necessary, in
  25       * psdf_put_params.
  26       */
  27 -    ecode = param_read_bool(plist, "LockDistillerParams", &locked);
  28 +    ecode = param_read_bool(plist, (param_name = "LockDistillerParams"), &locked);
  29      if (ecode < 0)
  30          param_signal_error(plist, param_name, ecode);
  31
  32 diff --git a/psi/iparam.c b/psi/iparam.c
  33 index 68c20d4..0279455 100644
  34 --- a/psi/iparam.c
  35 +++ b/psi/iparam.c
  36 @@ -822,10 +822,11 @@ static int
  37  ref_param_read_signal_error(gs_param_list * plist, gs_param_name pkey, int code)
  38  {
  39      iparam_list *const iplist = (iparam_list *) plist;
  40 -    iparam_loc loc;
  41 +    iparam_loc loc = {0};
  42
  43 -    ref_param_read(iplist, pkey, &loc, -1);    /* can't fail */
  44 -    *loc.presult = code;
  45 +    ref_param_read(iplist, pkey, &loc, -1);
  46 +    if (loc.presult)
  47 +        *loc.presult = code;
  48      switch (ref_param_read_get_policy(plist, pkey)) {
  49          case gs_param_policy_ignore:
  50              return 0;
  51 --
  52 2.8.1
  53