mirror of
https://gitlab.alpinelinux.org/alpine/aports.git
synced 2026-05-05 20:36:40 +02:00
51 lines
2.0 KiB
Diff
51 lines
2.0 KiB
Diff
Patch-Source: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=37ed5022cecd584de868933b5b60da2e995b3179;hp=afec45259049d3940abb0134c67abf8869123b74#patch1
|
|
--
|
|
From: Ken Sharp <ken.sharp@artifex.com>
|
|
Date: Fri, 24 Mar 2023 13:19:57 +0000 (+0000)
|
|
Subject: Graphics library - prevent buffer overrun in (T)BCP encoding
|
|
X-Git-Tag: ghostpdl-10.02.0-test-base-001~6
|
|
X-Git-Url: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff_plain;h=37ed5022cecd584de868933b5b60da2e995b3179;hp=afec45259049d3940abb0134c67abf8869123b74
|
|
|
|
Graphics library - prevent buffer overrun in (T)BCP encoding
|
|
|
|
Bug #706494 "Buffer Overflow in s_xBCPE_process"
|
|
|
|
As described in detail in the bug report, if the write buffer is filled
|
|
to one byte less than full, and we then try to write an escaped
|
|
character, we overrun the buffer because we don't check before
|
|
writing two bytes to it.
|
|
|
|
This just checks if we have two bytes before starting to write an
|
|
escaped character and exits if we don't (replacing the consumed byte
|
|
of the input).
|
|
|
|
Up for further discussion; why do we even permit a BCP encoding filter
|
|
anyway ? I think we should remove this, at least when SAFER is true.
|
|
---
|
|
|
|
diff --git a/base/sbcp.c b/base/sbcp.c
|
|
index 979ae0992..47fc233ec 100644
|
|
--- a/base/sbcp.c
|
|
+++ b/base/sbcp.c
|
|
@@ -1,4 +1,4 @@
|
|
-/* Copyright (C) 2001-2021 Artifex Software, Inc.
|
|
+/* Copyright (C) 2001-2023 Artifex Software, Inc.
|
|
All Rights Reserved.
|
|
|
|
This software is provided AS-IS with no warranty, either express or
|
|
@@ -50,6 +50,14 @@ s_xBCPE_process(stream_state * st, stream_cursor_read * pr,
|
|
byte ch = *++p;
|
|
|
|
if (ch <= 31 && escaped[ch]) {
|
|
+ /* Make sure we have space to store two characters in the write buffer,
|
|
+ * if we don't then exit without consuming the input character, we'll process
|
|
+ * that on the next time round.
|
|
+ */
|
|
+ if (pw->limit - q < 2) {
|
|
+ p--;
|
|
+ break;
|
|
+ }
|
|
if (p == rlimit) {
|
|
p--;
|
|
break;
|