mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-21 12:32:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

ghostscript: fix CVE-2024-33871

Browse Source 
(From OE-Core rev: c28281b7e105536cdf61eef8fe81d85ff2a42e4f)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Archana Polampalli
2024-05-29 05:42:24 +00:00
committed by Steve Sakoman
parent 235050fbfa
commit 0c079e62fb
2 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
meta/recipes-extended/ghostscript/ghostscript/CVE-2024-33871.patch Normal file
View File

@@ -0,0 +1,43 @@
From 7145885041bb52cc23964f0aa2aec1b1c82b5908 Mon Sep 17 00:00:00 2001
From: Zdenek Hutyra <zhutyra@centrum.cz>
Date: Mon, 22 Apr 2024 13:33:47 +0100
Subject: [PATCH 4/5] OPVP device - prevent unsafe parameter change with SAFER
Bug #707754 "OPVP device - Arbitrary code execution via custom Driver library"
The "Driver" parameter for the "opvp"/"oprp" device specifies the name
of a dynamic library and allows any library to be loaded.
The patch does not allow changing this parameter after activating path
control.
This addresses CVE-2024-33871
CVE: CVE-2024-33871
Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc2396]
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
contrib/opvp/gdevopvp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/contrib/opvp/gdevopvp.c b/contrib/opvp/gdevopvp.c
index 74200cf..80eb23b 100644
--- a/contrib/opvp/gdevopvp.c
+++ b/contrib/opvp/gdevopvp.c
@@ -3456,6 +3456,12 @@ _put_params(gx_device *dev, gs_param_list *plist)
code = param_read_string(plist, pname, &vdps);
switch (code) {
case 0:
+ if (gs_is_path_control_active(dev->memory)
+ && (!opdev->globals.vectorDriver || strlen(opdev->globals.vectorDriver) != vdps.size
+ || memcmp(opdev->globals.vectorDriver, vdps.data, vdps.size) != 0)) {
+ param_signal_error(plist, pname, gs_error_invalidaccess);
+ return_error(gs_error_invalidaccess);
+ }
buff = realloc(buff, vdps.size + 1);
memcpy(buff, vdps.data, vdps.size);
buff[vdps.size] = 0;
--
2.40.0

1
meta/recipes-extended/ghostscript/ghostscript_10.02.1.bb
View File

@@ -29,6 +29,7 @@ SRC_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/downlo
file://CVE-2024-33870.patch \
file://CVE-2024-33869-0001.patch \
file://CVE-2024-33869-0002.patch \
file://CVE-2024-33871.patch \
"
SRC_URI[sha256sum] = "e429e4f5b01615a4f0f93a4128e8a1a4d932dff983b1774174c79c0630717ad9"