diff options
Diffstat (limited to 'poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch')
-rw-r--r-- | poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch | 61 |
1 files changed, 0 insertions, 61 deletions
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch deleted file mode 100644 index 84983c5ae..000000000 --- a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2017-11714.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 671fd59eb657743aa86fbc1895cb15872a317caa Mon Sep 17 00:00:00 2001 -From: Chris Liddell <chris.liddell@artifex.com> -Date: Thu, 6 Jul 2017 14:54:02 +0100 -Subject: [PATCH] Bug 698158: prevent trying to reloc a freed object - -In the token reader, we pass the scanner state structure around as a -t_struct ref on the Postscript operand stack. - -But we explicitly free the scanner state when we're done, which leaves a -dangling reference on the operand stack and, unless that reference gets -overwritten before the next garbager run, we can end up with the garbager -trying to deal with an already freed object - that can cause a crash, or -memory corruption. ---- - psi/ztoken.c | 14 +++++++++++++- - 1 file changed, 13 insertions(+), 1 deletion(-) - ---- end of original header - -CVE: CVE-2017-11714 - -Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git] - -Signed-off-by: Joe Slater <joe.slater@windriver.com> - -diff --git a/psi/ztoken.c b/psi/ztoken.c -index 4dba7c5..af1ceeb 100644 ---- a/psi/ztoken.c -+++ b/psi/ztoken.c -@@ -107,6 +107,12 @@ token_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save) - int code; - ref token; - -+ /* Since we might free pstate below, and we're dealing with -+ * gc memory referenced by the stack, we need to explicitly -+ * remove the reference to pstate from the stack, otherwise -+ * the garbager will fall over -+ */ -+ make_null(osp); - /* Note that gs_scan_token may change osp! */ - pop(1); /* remove the file or scanner state */ - again: -@@ -183,8 +189,14 @@ ztokenexec_continue(i_ctx_t *i_ctx_p) - static int - tokenexec_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save) - { -- os_ptr op; -+ os_ptr op = osp; - int code; -+ /* Since we might free pstate below, and we're dealing with -+ * gc memory referenced by the stack, we need to explicitly -+ * remove the reference to pstate from the stack, otherwise -+ * the garbager will fall over -+ */ -+ make_null(osp); - /* Note that gs_scan_token may change osp! */ - pop(1); - again: --- -1.7.9.5 - |