!147 sync patch from openEuler-24.03-LTS

From: @li_ning_jie Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen
sync patch from openEuler-24.03-LTS
2024-11-18 09:30:38 +00:00 · 2024-11-14 18:18:50 +08:00 · 2024-11-01 08:19:21 +00:00 · 2024-10-30 08:20:04 +00:00 · 2024-10-30 08:07:48 +00:00 · 2024-10-29 17:00:24 +08:00
13 changed files with 532 additions and 10 deletions
--- a/Bug-707510-3-Bounds-checks-when-using-CIDFont-relate.patch
+++ b/Bug-707510-3-Bounds-checks-when-using-CIDFont-relate.patch
@ -1,8 +1,9 @@
 From 7745dbe24514710b0cfba925e608e607dee9eb0f Mon Sep 17 00:00:00 2001
 From: Chris Liddell <chris.liddell@artifex.com>
 Date: Wed, 24 Jan 2024 18:25:12 +0000
-Subject: [PATCH 3/6] Bug 707510(3): Bounds checks when using CIDFont related 
+Subject: [PATCH 3/7] Bug 707510(3): Bounds checks when using CIDFont related 
 params
 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=7745dbe24514
 Specifically, for CIDFont substitution.
 ---
--- a/Bug-707510-5-2-The-original-fix-was-overly-aggressive.patch
+++ b/Bug-707510-5-2-The-original-fix-was-overly-aggressive.patch
@ -0,0 +1,215 @@
 From 638159c43dbb48425a187d244ec288d252d0ecf4 Mon Sep 17 00:00:00 2001
 From: Chris Liddell <chris.liddell@artifex.com>
 Date: Wed, 31 Jan 2024 14:08:18 +0000
 Subject: [PATCH 6/7] Bug 707510(5)2: The original fix was overly aggressive
 https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=638159c43dbb48425a187d244ec288d252d0ecf4
 The way the default OCRLanguage value was set was for the relevant get_params
 methods to check if the value had been set, and if not return a default value.
 This could result in the first time the put_params seeing that value being after
 path control has been enabled, meaning it would throw an invalidaccess error.
 This changes how we set the default: they now uses an init_device method, so
 the string is populated from the device's creation. This works correctly for
 both the default value, and for values set on the command line.
 ---
 devices/gdevocr.c         | 17 ++++++++++++++++-
 devices/gdevpdfocr.c      | 28 ++++++++++++++++++++++------
 devices/vector/gdevpdf.c  | 15 +++++++++++++++
 devices/vector/gdevpdfp.c |  3 ++-
 4 files changed, 55 insertions(+), 8 deletions(-)
 diff --git a/devices/gdevocr.c b/devices/gdevocr.c
 index 7f2c6ea3b..b874525de 100644
 --- a/devices/gdevocr.c
 +++ b/devices/gdevocr.c
@@ -30,6 +30,7 @@
 #define X_DPI 72
 #define Y_DPI 72
 +static dev_proc_initialize_device(ocr_initialize_device);
 static dev_proc_print_page(ocr_print_page);
 static dev_proc_print_page(hocr_print_page);
 static dev_proc_get_params(ocr_get_params);
@@ -55,6 +56,7 @@ ocr_initialize_device_procs(gx_device *dev)
 {
     gdev_prn_initialize_device_procs_gray_bg(dev);
 +    set_dev_proc(dev, initialize_device, ocr_initialize_device);
     set_dev_proc(dev, open_device, ocr_open);
     set_dev_proc(dev, close_device, ocr_close);
     set_dev_proc(dev, get_params, ocr_get_params);
@@ -79,6 +81,7 @@ hocr_initialize_device_procs(gx_device *dev)
 {
     gdev_prn_initialize_device_procs_gray_bg(dev);
 +    set_dev_proc(dev, initialize_device, ocr_initialize_device);
     set_dev_proc(dev, open_device, ocr_open);
     set_dev_proc(dev, close_device, hocr_close);
     set_dev_proc(dev, get_params, ocr_get_params);
@@ -102,6 +105,17 @@ const gx_device_ocr gs_hocr_device =
 #define HOCR_HEADER "<html>\n <body>\n"
 #define HOCR_TRAILER " </body>\n</html>\n"
 +static int
 +ocr_initialize_device(gx_device *dev)
 +{
 +    gx_device_ocr *odev = (gx_device_ocr *)dev;
 +    const char *default_ocr_lang = "eng";
 +
 +    odev->language[0] = '\0';
 +    strcpy(odev->language, default_ocr_lang);
 +    return 0;
 +}
 +
 static int
 ocr_open(gx_device *pdev)
 {
@@ -185,7 +199,8 @@ ocr_put_params(gx_device *dev, gs_param_list *plist)
     switch (code = param_read_string(plist, (param_name = "OCRLanguage"), &langstr)) {
         case 0:
 -            if (pdev->memory->gs_lib_ctx->core->path_control_active) {
 +                if (pdev->memory->gs_lib_ctx->core->path_control_active
 +                && (strlen(pdev->language) != langstr.size || memcmp(pdev->language, langstr.data, langstr.size) != 0)) {
                 return_error(gs_error_invalidaccess);
             }
             else {
 diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c
 index 0d3c42d8b..f2bec1b49 100644
 --- a/devices/gdevpdfocr.c
 +++ b/devices/gdevpdfocr.c
@@ -33,9 +33,9 @@
 #include "gdevpdfimg.h"
 #include "tessocr.h"
 -int pdf_ocr_open(gx_device *pdev);
 -int pdf_ocr_close(gx_device *pdev);
 -
 +static dev_proc_initialize_device(pdf_ocr_initialize_device);
 +static dev_proc_open_device(pdf_ocr_open);
 +static dev_proc_close_device(pdf_ocr_close);
 static int
 pdfocr_put_some_params(gx_device * dev, gs_param_list * plist)
@@ -50,7 +50,8 @@ pdfocr_put_some_params(gx_device * dev, gs_param_list * plist)
     switch (code = param_read_string(plist, (param_name = "OCRLanguage"), &langstr)) {
         case 0:
 -            if (pdf_dev->memory->gs_lib_ctx->core->path_control_active) {
 +                if (pdf_dev->memory->gs_lib_ctx->core->path_control_active
 +                && (strlen(pdf_dev->ocr.language) != langstr.size || memcmp(pdf_dev->ocr.language, langstr.data, langstr.size) != 0)) {
                 return_error(gs_error_invalidaccess);
             }
             else {
@@ -152,6 +153,8 @@ pdfocr8_initialize_device_procs(gx_device *dev)
 {
     gdev_prn_initialize_device_procs_gray(dev);
 +    set_dev_proc(dev, initialize_device, pdf_ocr_initialize_device);
 +    set_dev_proc(dev, initialize_device, pdf_ocr_initialize_device);
     set_dev_proc(dev, open_device, pdf_ocr_open);
     set_dev_proc(dev, output_page, gdev_prn_output_page_seekable);
     set_dev_proc(dev, close_device, pdf_ocr_close);
@@ -185,6 +188,7 @@ pdfocr24_initialize_device_procs(gx_device *dev)
 {
     gdev_prn_initialize_device_procs_rgb(dev);
 +    set_dev_proc(dev, initialize_device, pdf_ocr_initialize_device);
     set_dev_proc(dev, open_device, pdf_ocr_open);
     set_dev_proc(dev, output_page, gdev_prn_output_page_seekable);
     set_dev_proc(dev, close_device, pdf_ocr_close);
@@ -216,6 +220,7 @@ pdfocr32_initialize_device_procs(gx_device *dev)
 {
     gdev_prn_initialize_device_procs_cmyk8(dev);
 +    set_dev_proc(dev, initialize_device, pdf_ocr_initialize_device);
     set_dev_proc(dev, open_device, pdf_ocr_open);
     set_dev_proc(dev, output_page, gdev_prn_output_page_seekable);
     set_dev_proc(dev, close_device, pdf_ocr_close);
@@ -703,7 +708,18 @@ ocr_end_page(gx_device_pdf_image *dev)
     return 0;
 }
 -int
 +static int
 +pdf_ocr_initialize_device(gx_device *dev)
 +{
 +    gx_device_pdf_image *ppdev = (gx_device_pdf_image *)dev;
 +    const char *default_ocr_lang = "eng";
 +
 +    ppdev->ocr.language[0] = '\0';
 +    strcpy(ppdev->ocr.language, default_ocr_lang);
 +    return 0;
 +}
 +
 +static int
 pdf_ocr_open(gx_device *pdev)
 {
     gx_device_pdf_image *ppdev;
@@ -726,7 +742,7 @@ pdf_ocr_open(gx_device *pdev)
     return 0;
 }
 -int
 +static int
 pdf_ocr_close(gx_device *pdev)
 {
     gx_device_pdf_image *pdf_dev;
 diff --git a/devices/vector/gdevpdf.c b/devices/vector/gdevpdf.c
 index 6e364d1c7..042e1b4e9 100644
 --- a/devices/vector/gdevpdf.c
 +++ b/devices/vector/gdevpdf.c
@@ -215,6 +215,7 @@ device_pdfwrite_finalize(const gs_memory_t *cmem, void *vpdev)
 }
 /* Driver procedures */
 +static dev_proc_initialize_device(pdfwrite_initialize_device);
 static dev_proc_open_device(pdf_open);
 static dev_proc_output_page(pdf_output_page);
 static dev_proc_close_device(pdf_close);
@@ -232,6 +233,7 @@ static dev_proc_close_device(pdf_close);
 static void
 pdfwrite_initialize_device_procs(gx_device *dev)
 {
 +    set_dev_proc(dev, initialize_device, pdfwrite_initialize_device);
     set_dev_proc(dev, open_device, pdf_open);
     set_dev_proc(dev, get_initial_matrix, gx_upright_get_initial_matrix);
     set_dev_proc(dev, output_page, pdf_output_page);
@@ -777,6 +779,19 @@ pdf_reset_text(gx_device_pdf * pdev)
     pdf_reset_text_state(pdev->text);
 }
 +static int
 +pdfwrite_initialize_device(gx_device *dev)
 +{
 +#if OCR_VERSION > 0
 +    gx_device_pdf *pdev = (gx_device_pdf *) dev;
 +    const char *default_ocr_lang = "eng";
 +    pdev->ocr_language[0] = '\0';
 +    strcpy(pdev->ocr_language, default_ocr_lang);
 +#endif
 +    return 0;
 +}
 +
 +
 /* Open the device. */
 static int
 pdf_open(gx_device * dev)
 diff --git a/devices/vector/gdevpdfp.c b/devices/vector/gdevpdfp.c
 index 1f7106c0b..1fdfeaef3 100644
 --- a/devices/vector/gdevpdfp.c
 +++ b/devices/vector/gdevpdfp.c
@@ -472,7 +472,8 @@ gdev_pdf_put_params_impl(gx_device * dev, const gx_device_pdf * save_dev, gs_par
         gs_param_string langstr;
         switch (code = param_read_string(plist, (param_name = "OCRLanguage"), &langstr)) {
             case 0:
 -                if (pdev->memory->gs_lib_ctx->core->path_control_active) {
 +                if (pdev->memory->gs_lib_ctx->core->path_control_active
 +                && (strlen(pdev->ocr_language) != langstr.size || memcmp(pdev->ocr_language, langstr.data, langstr.size) != 0)) {
                     return_error(gs_error_invalidaccess);
                 }
                 else {
 -- 
 2.34.1
--- a/Bug-707510-5-Reject-OCRLanguage-changes-after-SAFER-.patch
+++ b/Bug-707510-5-Reject-OCRLanguage-changes-after-SAFER-.patch
@ -1,8 +1,9 @@
 From 3d4cfdc1a44b1969a0f14c86673a372654d443c4 Mon Sep 17 00:00:00 2001
 From: Chris Liddell <chris.liddell@artifex.com>
 Date: Wed, 24 Jan 2024 17:06:01 +0000
-Subject: [PATCH 5/6] Bug 707510(5): Reject OCRLanguage changes after SAFER
+Subject: [PATCH 5/7] Bug 707510(5): Reject OCRLanguage changes after SAFER
 enabled
 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=3d4cfdc1a44
 In the devices that support OCR, OCRLanguage really ought never to be set from
 PostScript, so reject attempts to change it if path_control_active is true.
--- a/Bug-707510-don-t-allow-PDF-files-with-bad-Filters-to.patch
+++ b/Bug-707510-don-t-allow-PDF-files-with-bad-Filters-to.patch
@ -1,8 +1,9 @@
 From 77dc7f699beba606937b7ea23b50cf5974fa64b1 Mon Sep 17 00:00:00 2001
 From: Ken Sharp <Ken.Sharp@artifex.com>
 Date: Thu, 25 Jan 2024 11:55:49 +0000
-Subject: [PATCH 2/6] Bug 707510 - don't allow PDF files with bad Filters to 
+Subject: [PATCH 2/7] Bug 707510 - don't allow PDF files with bad Filters to 
 overflow the debug buffer
 http://www.ghostscript.com/cgi-bin/findgit.cgi?77dc7f699beba606937b7ea23b50cf5974fa64b1
 Item #2 of the report.
--- a/Bug-707510-don-t-use-strlen-on-passwords.patch
+++ b/Bug-707510-don-t-use-strlen-on-passwords.patch
@ -1,7 +1,8 @@
 From 917b3a71fb20748965254631199ad98210d6c2fb Mon Sep 17 00:00:00 2001
 From: Ken Sharp <Ken.Sharp@artifex.com>
 Date: Thu, 25 Jan 2024 11:58:22 +0000
-Subject: [PATCH 1/6] Bug 707510 - don't use strlen on passwords
+Subject: [PATCH 1/7] Bug 707510 - don't use strlen on passwords
 http://www.ghostscript.com/cgi-bin/findgit.cgi?917b3a71fb20748965254631199ad98210d6c2fb
 Item #1 of the report. This looks like an oversight when first coding
 the routine. We should use the PostScript string length, because
--- a/Bug-707510-fix-LIBIDN-usage.patch
+++ b/Bug-707510-fix-LIBIDN-usage.patch
@ -1,7 +1,8 @@
 From d99396635f3d6ac6a1168e1af21a669e5c8f695f Mon Sep 17 00:00:00 2001
 From: Ken Sharp <Ken.Sharp@artifex.com>
 Date: Thu, 25 Jan 2024 12:16:56 +0000
-Subject: [PATCH 6/6] Bug 707510 - fix LIBIDN usage
+Subject: [PATCH 7/7] Bug 707510 - fix LIBIDN usage
 http://www.ghostscript.com/cgi-bin/findgit.cgi?d99396635f3d6ac6a1168e1af21a669e5c8f695f
 This wasn't a reported fault, but it bears fixing anyway.
--- a/Bug-707510-review-printing-of-pointers.patch
+++ b/Bug-707510-review-printing-of-pointers.patch
@ -1,7 +1,8 @@
 From ff1013a0ab485b66783b70145e342a82c670906a Mon Sep 17 00:00:00 2001
 From: Ken Sharp <Ken.Sharp@artifex.com>
 Date: Thu, 25 Jan 2024 11:53:44 +0000
-Subject: [PATCH 4/6] Bug 707510 - review printing of pointers
+Subject: [PATCH 4/7] Bug 707510 - review printing of pointers
 http://www.ghostscript.com/cgi-bin/findgit.cgi?ff1013a0ab485b66783b70145e342a82c670906a
 This is for item 4 of the report, which is addressed by the change in
 gdevpdtb.c. That change uses a fixed name for fonts which have no name
--- a/backport-CVE-2024-46951.patch
+++ b/backport-CVE-2024-46951.patch
@ -0,0 +1,31 @@
 From ada21374f0c90cc3acf7ce0e96302394560c7aee Mon Sep 17 00:00:00 2001
 From: Zdenek Hutyra <zhutyra@centrum.cz>
 Date: Fri, 30 Aug 2024 13:16:39 +0100
 Subject: [PATCH] PS interpreter - check the type of the Pattern Implementation
 Bug #707991
 See bug report for details.
 CVE-2024-46951
 ---
 psi/zcolor.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/psi/zcolor.c b/psi/zcolor.c
 index d4e7a4438..d3384d75d 100644
 --- a/psi/zcolor.c
 +++ b/psi/zcolor.c
@@ -5276,6 +5276,9 @@ static int patterncomponent(i_ctx_t * i_ctx_p, ref *space, int *n)
             code = array_get(imemory, pImpl, 0, &pPatInst);
             if (code < 0)
                 return code;
 +
 +            if (!r_is_struct(&pPatInst) || (!r_has_stype(&pPatInst, imemory, st_pattern1_instance) && !r_has_stype(&pPatInst, imemory, st_pattern2_instance)))
 +                return_error(gs_error_typecheck);
             cc.pattern = r_ptr(&pPatInst, gs_pattern_instance_t);
             if (pattern_instance_uses_base_space(cc.pattern))
                 *n = n_comps;
 -- 
 2.34.1
--- a/backport-CVE-2024-46952.patch
+++ b/backport-CVE-2024-46952.patch
@ -0,0 +1,61 @@
 From 1fb76aaddac34530242dfbb9579d9997dae41264 Mon Sep 17 00:00:00 2001
 From: Ken Sharp <Ken.Sharp@artifex.com>
 Date: Mon, 2 Sep 2024 15:14:01 +0100
 Subject: [PATCH] PDF interpreter - sanitise W array values in Xref streams
 Bug #708001 "Buffer overflow in PDF XRef stream"
 See bug report. I've chosen to fix this by checking the values in the
 W array; these can (currently at least) only have certain relatively
 small values.
 As a future proofing fix I've also updated field_size in
 pdf_xref_stream_entries() to be a 64-bit integer. This is far bigger
 than required, but matches the W array values and so prevents the
 mismatch which could lead to a buffer overrun.
 CVE-2024-46952
 ---
 pdf/pdf_xref.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)
 diff --git a/pdf/pdf_xref.c b/pdf/pdf_xref.c
 index 7e61113..ad45852 100644
 --- a/pdf/pdf_xref.c
 +++ b/pdf/pdf_xref.c
@@ -53,7 +53,7 @@ static int resize_xref(pdf_context *ctx, uint64_t new_size)
 static int read_xref_stream_entries(pdf_context *ctx, pdf_c_stream *s, uint64_t first, uint64_t last, uint64_t *W)
 {
     uint i, j;
 -    uint field_width = 0;
 +    uint64_t field_width = 0;
     uint32_t type = 0;
     uint64_t objnum = 0, gen = 0;
     byte *Buffer;
@@ -297,6 +297,24 @@ static int pdfi_process_xref_stream(pdf_context *ctx, pdf_stream *stream_obj, pd
     }
     pdfi_countdown(a);
 +    /* W[0] is either:
 +     * 0 (no type field) or a single byte with the type.
 +     * W[1] is either:
 +     * The object number of the next free object, the byte offset of this object in the file or the object5 number of the object stream where this object is stored.
 +     * W[2] is either:
 +     * The generation number to use if this object is used again, the generation number of the object or the index of this object within the object stream.
 +     *
 +     * Object and generation numbers are limited to unsigned 64-bit values, as are bytes offsets in the file, indexes of objects within the stream likewise (actually
 +     * most of these are generally 32-bit max). So we can limit the field widths to 8 bytes, enough to hold a 64-bit number.
 +     * Even if a later version of the spec makes these larger (which seems unlikely!) we still cna't cope with integers > 64-bits.
 +     */
 +    if (W[0] > 1 || W[1] > 8 || W[2] > 8) {
 +        pdfi_close_file(ctx, XRefStrm);
 +        pdfi_countdown(ctx->xref_table);
 +        ctx->xref_table = NULL;
 +        return code;
 +    }
 +
     code = pdfi_dict_get_type(ctx, sdict, "Index", PDF_ARRAY, (pdf_obj **)&a);
     if (code == gs_error_undefined) {
         code = read_xref_stream_entries(ctx, XRefStrm, 0, size - 1, (uint64_t *)W);
 -- 
 2.43.0
--- a/backport-CVE-2024-46953.patch
+++ b/backport-CVE-2024-46953.patch
@ -0,0 +1,66 @@
 From 294a3755e33f453dd92e2a7c4cfceb087ac09d6a Mon Sep 17 00:00:00 2001
 From: Zdenek Hutyra <zhutyra@centrum.cz>
 Date: Mon, 27 May 2024 13:38:36 +0100
 Subject: [PATCH] Bug 707793: Check for overflow validating format string
 for the output file name
 CVE-2024-46953
 ---
 base/gsdevice.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)
 diff --git a/base/gsdevice.c b/base/gsdevice.c
 index 90e699ab4..c1eaedd85 100644
 --- a/base/gsdevice.c
 +++ b/base/gsdevice.c
@@ -1070,7 +1070,7 @@ static int
 gx_parse_output_format(gs_parsed_file_name_t *pfn, const char **pfmt)
 {
     bool have_format = false, field;
 -    int width[2], int_width = sizeof(int) * 3, w = 0;
 +    uint width[2], int_width = sizeof(int) * 3, w = 0;
     uint i;
     /* Scan the file name for a format string, and validate it if present. */
@@ -1099,6 +1099,8 @@ gx_parse_output_format(gs_parsed_file_name_t *pfn, const char **pfmt)
                         default: /* width (field = 0) and precision (field = 1) */
                             if (strchr("0123456789", pfn->fname[i])) {
                                 width[field] = width[field] * 10 + pfn->fname[i] - '0';
 +                                if (width[field] > max_int)
 +	                                return_error(gs_error_undefinedfilename);
                                 continue;
                             } else if (0 == field && '.' == pfn->fname[i]) {
                                 field++;
@@ -1127,8 +1129,10 @@ gx_parse_output_format(gs_parsed_file_name_t *pfn, const char **pfmt)
         /* Calculate a conservative maximum width. */
         w = max(width[0], width[1]);
         w = max(w, int_width) + 5;
 +        if (w > max_int)
 +            return_error(gs_error_undefinedfilename);
     }
 -    return w;
 +    return (int)w;
 }
 /*
@@ -1181,10 +1185,15 @@ gx_parse_output_file_name(gs_parsed_file_name_t *pfn, const char **pfmt,
     if (!pfn->fname)
         return 0;
     code = gx_parse_output_format(pfn, pfmt);
 -    if (code < 0)
 +    if (code < 0) {
         return code;
 -    if (strlen(pfn->iodev->dname) + pfn->len + code >= gp_file_name_sizeof)
 +    }
 +
 +    if (pfn->len >= gp_file_name_sizeof - strlen(pfn->iodev->dname) ||
 +        code >= gp_file_name_sizeof - strlen(pfn->iodev->dname) - pfn->len) {
         return_error(gs_error_undefinedfilename);
 +    }
 +
     return 0;
 }
 -- 
 2.34.1
--- a/backport-CVE-2024-46955.patch
+++ b/backport-CVE-2024-46955.patch
@ -0,0 +1,60 @@
 From ca1fc2aefe9796e321d0589afe7efb35063c8b2a Mon Sep 17 00:00:00 2001
 From: Zdenek Hutyra <zhutyra@centrum.cz>
 Date: Fri, 30 Aug 2024 13:11:53 +0100
 Subject: [PATCH] PS interpreter - check Indexed colour space index
 Bug #707990 "Out of bounds read when reading color in "Indexed" color space"
 Check the 'index' is in the valid range (0 to hival) for the colour
 space.
 Also a couple of additional checks on the type of the 'proc' for
 Indexed, DeviceN and Separation spaces. Make sure these really are
 procs in case the user changed the colour space array.
 CVE-2024-46955
 ---
 psi/zcolor.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/psi/zcolor.c b/psi/zcolor.c
 index c0d73c2..7d15ec7 100644
 --- a/psi/zcolor.c
 +++ b/psi/zcolor.c
@@ -3629,6 +3629,7 @@ static int septransform(i_ctx_t *i_ctx_p, ref *sepspace, int *usealternate, int
         code = array_get(imemory, sepspace, 3, &proc);
         if (code < 0)
             return code;
 +        check_proc(proc);
         *esp = proc;
         return o_push_estack;
     }
@@ -4450,6 +4451,7 @@ static int devicentransform(i_ctx_t *i_ctx_p, ref *devicenspace, int *usealterna
         code = array_get(imemory, devicenspace, 3, &proc);
         if (code < 0)
             return code;
 +        check_proc(proc);
         *esp = proc;
         return o_push_estack;
     }
@@ -4865,6 +4867,7 @@ static int indexedbasecolor(i_ctx_t * i_ctx_p, ref *space, int base, int *stage,
             code = array_get(imemory, space, 3, &proc);
             if (code < 0)
                 return code;
 +            check_proc(proc);
             *ep = proc;	/* lookup proc */
             return o_push_estack;
         } else {
@@ -4878,6 +4881,9 @@ static int indexedbasecolor(i_ctx_t * i_ctx_p, ref *space, int base, int *stage,
             if (!r_has_type(op, t_integer))
                 return_error (gs_error_typecheck);
             index = op->value.intval;
 +            /* Ensure it is in range. See bug #707990 */
 +            if (index < 0 || index > pcs->params.indexed.hival)
 +                return_error(gs_error_rangecheck);
             /* And remove it from the stack. */
             ref_stack_pop(&o_stack, 1);
             op = osp;
 -- 
 2.27.0
--- a/backport-CVE-2024-46956.patch
+++ b/backport-CVE-2024-46956.patch
@ -0,0 +1,30 @@
 From ea69a1388245ad959d31c272b5ba66d40cebba2c Mon Sep 17 00:00:00 2001
 From: Zdenek Hutyra <zhutyra@centrum.cz>
 Date: Tue, 23 Jul 2024 11:48:39 +0100
 Subject: [PATCH] PostScript interpreter - fix buffer length check
 Bug 707895
 See bug report for details.
 CVE-2024-46956
 ---
 psi/zfile.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/psi/zfile.c b/psi/zfile.c
 index fe3f7e9..027f412 100644
 --- a/psi/zfile.c
 +++ b/psi/zfile.c
@@ -440,7 +440,7 @@ file_continue(i_ctx_t *i_ctx_p)
         if (code == ~(uint) 0) {    /* all done */
             esp -= 5;               /* pop proc, pfen, devlen, iodev , mark */
             return o_pop_estack;
 -        } else if (code > len) {      /* overran string */
 +        } else if (code > len - devlen) {      /* overran string */
             return_error(gs_error_rangecheck);
         }
         else if (iodev != iodev_default(imemory)
 -- 
 2.27.0
--- a/ghostscript.spec
+++ b/ghostscript.spec
@ -9,7 +9,7 @@
 Name:             ghostscript
 Version:          9.56.1
-Release:          7
+Release:          13
 Summary:          An interpreter for PostScript and PDF files
 License:          AGPLv3+
 URL:              https://ghostscript.com/
@ -47,16 +47,28 @@ Patch108:  fix-CVE-2024-33870.patch
 Patch109:  fix-CVE-2024-33871.patch
 # https://bugs.ghostscript.com/show_bug.cgi?id=707510
 # CVE-2024-29506 CVE-2024-29507 CVE-2024-29508 CVE-2024-29509 CVE-2024-29511
 # CVE-2024-29509
 Patch110:  Bug-707510-don-t-use-strlen-on-passwords.patch
 # CVE-2024-29506
 Patch111:  Bug-707510-don-t-allow-PDF-files-with-bad-Filters-to.patch
 # CVE-2024-29507
 Patch112:  Bug-707510-3-Bounds-checks-when-using-CIDFont-relate.patch
 # CVE-2024-29508
 Patch113:  Bug-707510-review-printing-of-pointers.patch
 # CVE-2024-29511
 Patch114:  Bug-707510-5-Reject-OCRLanguage-changes-after-SAFER-.patch
-Patch115:  Bug-707510-fix-LIBIDN-usage.patch
+Patch115:  Bug-707510-5-2-The-original-fix-was-overly-aggressive.patch
 Patch116:  Bug-707510-fix-LIBIDN-usage.patch
 # See bug thread for details
 #This is the second part of the fix for CVE-2024-33869
-Patch116:  fix-CVE-2024-33869-second.patch
+Patch117:  fix-CVE-2024-33869-second.patch
 Patch118:   backport-CVE-2024-46953.patch
 Patch119:   backport-CVE-2024-46956.patch
 Patch120:   backport-CVE-2024-46951.patch
 Patch121:   backport-CVE-2024-46952.patch
 Patch122:   backport-CVE-2024-46955.patch
 BuildRequires:    automake gcc
 BuildRequires:    adobe-mappings-cmap-devel adobe-mappings-pdf-devel
@ -141,7 +153,12 @@ PDF files using Ghostscript and dvips
 %patch114 -p1
 %patch115 -p1
 %patch116 -p1
-
+%patch117 -p1
 %patch118 -p1
 %patch119 -p1
 %patch120 -p1
 %patch121 -p1
 %patch122 -p1
 # Libraries that we already have packaged(see Build Requirements):
 rm -rf cups/libs freetype ijs jbig2dec jpeg lcms2* libpng openjpeg tiff zlib
@ -235,6 +252,42 @@ install -m 0755 -d %{buildroot}%{_datadir}/%{name}/conf.d/
 %{_bindir}/dvipdf
 %changelog
 * Fri Nov 08 2024 liningjie <liningjie@xfusion.com> - 9.56.1-13
 - Type:CVE
 - ID:NA
 - SUG:NA
 - DECS: Fix CVE-2024-46955
 * Tue Nov 05 2024 liningjie <liningjie@xfusion.com> - 9.56.1-12
 - Type:CVE
 - ID:NA
 - SUG:NA
 - DECS: Fix CVE-2024-46952
 * Fri Nov 01 2024 liningjie <liningjie@xfusion.com> - 9.56.1-11
 - Type:CVE
 - ID:NA
 - SUG:NA
 - DECS: Fix CVE-2024-46951
 * Fri Oct 25 2024 liningjie <liningjie@xfusion.com> - 9.56.1-10
 - Type:CVE
 - ID:NA
 - SUG:NA
 - DECS: Fix CVE-2024-46956
 * Fri Oct 25 2024 liningjie <liningjie@xfusion.com> - 9.56.1-9
 - Type:CVE
 - ID:NA
 - SUG:NA
 - DECS: Fix CVE-2024-46953
 * Fri Jul 12 2024 zhangxianting <zhangxianting@uniontech.com> - 9.56.1-8
 - Type:CVE
 - ID:NA
 - SUG:NA
 - DECS: This is the second part of the fix for CVE-2024-29511
 * Fri Jul 12 2024 zhangxingrong-<zhangxingrong@uniontech.cn> - 9.56.1-7
 - Type:CVE
 - ID:NA
Author	SHA1	Message	Date
openeuler-ci-bot	e90d1911ef	!147 sync patch from openEuler-24.03-LTS From: @li_ning_jie Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen	2024-11-18 09:30:38 +00:00
liningjie	3937b54462	sync patch from openEuler-24.03-LTS	2024-11-14 18:18:50 +08:00
openeuler-ci-bot	255f6aca27	!128 Fix CVE-2024-46955 From: @li_ning_jie Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen	2024-11-01 08:19:21 +00:00
李宁杰	a0f65912c3	Fix CVE-2024-46955	2024-10-30 08:20:04 +00:00
openeuler-ci-bot	a2618ff083	!125 Fix CVE-2024-46956 From: @li_ning_jie Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen	2024-10-30 08:07:48 +00:00
liningjie	c7fbb0430c	Fix CVE-2024-46956	2024-10-29 17:00:24 +08:00
openeuler-ci-bot	67cb55343d	!120 [sync] PR-114: Fix CVE-2024-46953 From: @openeuler-sync-bot Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen	2024-10-29 08:32:28 +00:00
liningjie	66e9dee10c	Fix CVE-2024-46953 (cherry picked from commit 2713d387491bdd992865c8f00f9703cc8572ccb9)	2024-10-25 18:22:49 +08:00
openeuler-ci-bot	e2fc5059df	!104 [sync] PR-99: Fix CVE-2024-29511 From: @openeuler-sync-bot Reviewed-by: @dillon_chen Signed-off-by: @dillon_chen	2024-07-16 02:12:42 +00:00
zhangxianting	f6a32ad804	Fix CVE-2024-29511 (cherry picked from commit 4843a060331367cf1583665d1035f6b0f38e777d)	2024-07-12 18:49:23 +08:00