From patchwork Mon Nov 10 07:06:02 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 74086 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15A8BCCF9E3 for ; Mon, 10 Nov 2025 07:06:22 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.42775.1762758373219452473 for ; Sun, 09 Nov 2025 23:06:13 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=jYNrNaPp; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-297ec50477aso8317195ad.1 for ; Sun, 09 Nov 2025 23:06:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762758372; x=1763363172; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=bh5A9InG7kq872PuT9SnHG2DJDaMKkGL64QykaJuD+k=; b=jYNrNaPpFAQoOhMSoKhpMRPNiMbuAtjBJJHfVinlqMy8ulNYCpBsw93sxQXOmzxxlF x52+W5nIEYurF3uid4FjbGGvicNtix+/ilMZs7etwExkhzPmtKA5mmPWE0jwZvtlY3ED ludGROkDiECUND04Gjwg9Ev2qOtUNRNpl2pm9HkQHnlTTc4QRCf94q0UeZhKH/9axSTL mTUZfBDAY1l44nlm14aJVRzhFoTRIAG0yV9AjXx8aUqvbctODr1l9z+CNwcKbkkXeB9O JadpFkLt3qKWFtCy42MEI7rCy6P12Ph/uAw3MMhuR9P/B0L/Dj2tqqfabLlML7oN8bEZ ff3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762758372; x=1763363172; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=bh5A9InG7kq872PuT9SnHG2DJDaMKkGL64QykaJuD+k=; b=QzjeqW0ZlAr1R5uKkQm8c7RsEDJDA5Y45HUMHpAIsGWgdjYQEZm1nF2qyrGxpKJRbX nCzSVfnNcEP3cVApirRQ6qd/Y0kIpZM/r/e26ogLLfk0vYxBjik+LnHy6MG8JFidPGZT WD7NneZUJKmMn4dnCag1pMhi1JyESwoyUc5P+AD07yHx8DjCgNFPERCGAo1mUyIjZ1SU /wuu02erhuWpW7REi4t8pWBtbJjAVRdQT/IDMatbH6SH28QKptuIyKROkycnOT4pYKGm QbLjmQLOFZ37R62xQK79kvybjSbctp+HLjQimwp6YiScup4K7gGRxxIpYtjSFZAHh4wv l3WA== X-Gm-Message-State: AOJu0Yy4TI2oy3tU7DE94Z38a2gzkg4W7E1P9xqsSE92lFDLMxUDRL0D YbxZyYTrHHpS9Q7VSwPLAOSVKNj+ECnlv+leB71c7TRThcmg+hcMX6yc3X6TMg== X-Gm-Gg: ASbGncvlUlBaiuqKcc4gKQ6Bnfk3yHf+a8uqf36PyLzZKedepyVER5kWZV7VqVOzNBL VVyVkyKQwwTZU7VBDidpzd2yW0U8A1ZU50xSSpU25QzVx5K8gCo618Bpe5laraz+v6bBO3/76ol vi8ndg7ixuyDqEbJztStLs0xuxBIavIHMEi8YnwursJLPZZZlp3L/NKfu4pLKgJXsATVFjg2Rg1 n2jJ0pJ9JIMV9OWKtwSma7EIu178SDKxxcUitTe+PwV7KQDmmyIYBFgu0/NrbXzGDpXntahtrft U14Fs9HgKQnaTH/Y/kXufwvBU+9qq3zci8cOdaeM5dwubPPo1+aHAi6nhhm6ityLEFzUXu/YY/B eyX93NUyXAX7zWMFp97OCV+3T1qB1TKKiga/Zz2tVKM0FkKtX0GSRPIE9BuyRLm7N3iNwedllNy ENL9bB5EDuNVOdstIpLMktmWLK X-Google-Smtp-Source: AGHT+IHZej8RQ7W8PupPzAe/SubjhY7pBGT+pv0N0hFVeoNm7LSJXyE22RbTCHBeL0zJRI0pu2gDTg== X-Received: by 2002:a17:903:ac4:b0:297:df99:6bd4 with SMTP id d9443c01a7336-297df996cbbmr95300905ad.18.1762758372216; Sun, 09 Nov 2025 23:06:12 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([147.161.216.248]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ba901c3817csm11511337a12.30.2025.11.09.23.06.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Nov 2025 23:06:11 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-core@lists.openembedded.org Cc: Ankur Tyagi Subject: [OE-core][walnascar][PATCH 1/3] ghostscript: patch CVE-2025-59798 Date: Mon, 10 Nov 2025 20:06:02 +1300 Message-ID: <20251110070604.444927-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 10 Nov 2025 07:06:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/226100 From: Ankur Tyagi Details https://nvd.nist.gov/vuln/detail/CVE-2025-59798 Signed-off-by: Ankur Tyagi --- .../ghostscript/CVE-2025-59798.patch | 135 ++++++++++++++++++ .../ghostscript/ghostscript_10.05.1.bb | 1 + 2 files changed, 136 insertions(+) create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59798.patch diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59798.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59798.patch new file mode 100644 index 0000000000..ac1db737b6 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59798.patch @@ -0,0 +1,135 @@ +From 50cb7bf8ec6cdfca650c16f60c10ee752d8e6efb Mon Sep 17 00:00:00 2001 +From: Ken Sharp +Date: Thu, 22 May 2025 12:25:41 +0100 +Subject: [PATCH] pdfwrite - avoid buffer overrun + +Bug #708539 "Buffer overflow in pdf_write_cmap" + +The proposed fix in the report solves the buffer overrun, but does not +tackle a number of other problems. + +This commit checks the result of stream_puts() in +pdf_write_cid_system_info_to_stream() and correctly signals an error to +the caller if that fails. + +In pdf_write_cid_system_info we replace a (rather small!) fixed size +buffer with a dynamically allocated one using the lengths of the strings +which pdf_write_cid_system_info_to_stream() will write, and a small +fixed overhead to deal with the keys and initial byte '/'. + +Because 'buf' is used in the stream 's', if it is too small to hold all +the CIDSystemInfo then we would get an error which was simply discarded +previously. + +We now should avoid the potential error by ensuring the buffer is large +enough for all the information, and if we do get an error we no longer +silently ignore it, which would write an invalid PDF file. + +CVE: CVE-2025-59798 +Upstream-Status: Backport [https://github.com/ArtifexSoftware/ghostpdl/commit/0cae41b23a9669e801211dd4cf97b6dadd6dbdd7] +(cherry picked from commit 0cae41b23a9669e801211dd4cf97b6dadd6dbdd7) +Signed-off-by: Ankur Tyagi +--- + devices/vector/gdevpdtw.c | 52 ++++++++++++++++++++++++++++++--------- + 1 file changed, 41 insertions(+), 11 deletions(-) + +diff --git a/devices/vector/gdevpdtw.c b/devices/vector/gdevpdtw.c +index ced15c9b2..fe24dd73a 100644 +--- a/devices/vector/gdevpdtw.c ++++ b/devices/vector/gdevpdtw.c +@@ -703,7 +703,8 @@ static int + pdf_write_cid_system_info_to_stream(gx_device_pdf *pdev, stream *s, + const gs_cid_system_info_t *pcidsi, gs_id object_id) + { +- byte *Registry, *Ordering; ++ byte *Registry = NULL, *Ordering = NULL; ++ int code = 0; + + Registry = gs_alloc_bytes(pdev->pdf_memory, pcidsi->Registry.size, "temporary buffer for Registry"); + if (!Registry) +@@ -734,14 +735,19 @@ pdf_write_cid_system_info_to_stream(gx_device_pdf *pdev, stream *s, + } + s_arcfour_process_buffer(&sarc4, Ordering, pcidsi->Ordering.size); + } +- stream_puts(s, "<<\n/Registry"); ++ code = stream_puts(s, "<<\n/Registry"); ++ if (code < 0) ++ goto error; + s_write_ps_string(s, Registry, pcidsi->Registry.size, PRINT_HEX_NOT_OK); +- stream_puts(s, "\n/Ordering"); ++ code = stream_puts(s, "\n/Ordering"); ++ if(code < 0) ++ goto error; + s_write_ps_string(s, Ordering, pcidsi->Ordering.size, PRINT_HEX_NOT_OK); ++error: + pprintd1(s, "\n/Supplement %d\n>>\n", pcidsi->Supplement); + gs_free_object(pdev->pdf_memory, Registry, "free temporary Registry buffer"); + gs_free_object(pdev->pdf_memory, Ordering, "free temporary Ordering buffer"); +- return 0; ++ return code; + } + + int +@@ -786,31 +792,55 @@ pdf_write_cmap(gx_device_pdf *pdev, const gs_cmap_t *pcmap, + *ppres = writer.pres; + writer.pres->where_used = 0; /* CMap isn't a PDF resource. */ + if (!pcmap->ToUnicode) { +- byte buf[200]; ++ byte *buf = NULL; ++ uint64_t buflen = 0; + cos_dict_t *pcd = (cos_dict_t *)writer.pres->object; + stream s; + ++ /* We use 'buf' for the stream 's' below and that needs to have some extra ++ * space for the CIDSystemInfo. We also need an extra byte for the leading '/' ++ * 100 bytes is ample for the overhead. ++ */ ++ buflen = pcmap->CIDSystemInfo->Registry.size + pcmap->CIDSystemInfo->Ordering.size + pcmap->CMapName.size + 100; ++ if (buflen > max_uint) ++ return_error(gs_error_limitcheck); ++ ++ buf = gs_alloc_bytes(pdev->memory, buflen, "pdf_write_cmap"); ++ if (buf == NULL) ++ return_error(gs_error_VMerror); ++ + code = cos_dict_put_c_key_int(pcd, "/WMode", pcmap->WMode); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + buf[0] = '/'; + memcpy(buf + 1, pcmap->CMapName.data, pcmap->CMapName.size); + code = cos_dict_put_c_key_string(pcd, "/CMapName", + buf, pcmap->CMapName.size + 1); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + s_init(&s, pdev->memory); +- swrite_string(&s, buf, sizeof(buf)); ++ swrite_string(&s, buf, buflen); + code = pdf_write_cid_system_info_to_stream(pdev, &s, pcmap->CIDSystemInfo, 0); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + code = cos_dict_put_c_key_string(pcd, "/CIDSystemInfo", + buf, stell(&s)); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + code = cos_dict_put_string_copy(pcd, "/Type", "/CMap"); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + } + if (pcmap->CMapName.size == 0) { + /* Create an arbitrary name (for ToUnicode CMap). */ diff --git a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb b/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb index fa6ead0cd8..f8454f82ba 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb @@ -25,6 +25,7 @@ def gs_verdir(v): SRC_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${@gs_verdir("${PV}")}/${BPN}-${PV}.tar.gz \ file://ghostscript-9.16-Werror-return-type.patch \ file://avoid-host-contamination.patch \ + file://CVE-2025-59798.patch \ " SRC_URI[sha256sum] = "121861b6d29b2461dec6575c9f3cab665b810bd408d4ec02c86719fa708b0a49" From patchwork Mon Nov 10 07:06:03 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 74087 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19988CD13D2 for ; Mon, 10 Nov 2025 07:06:22 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.42752.1762758375418164927 for ; Sun, 09 Nov 2025 23:06:15 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=RpFO5J0C; spf=pass (domain: gmail.com, ip: 209.85.216.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-3436d6ca17bso1752779a91.3 for ; Sun, 09 Nov 2025 23:06:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762758375; x=1763363175; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=r6KmOy72ev5kiNdg9VZMuRCxkkqXW/GlaB81Wm/Cwzo=; b=RpFO5J0CA/Hhz6Iiuk4OiBH8XyxcV6iJ7v59WA6uf0WszQmPSHzJuQcOIQyv6TUkeS 8wf6rYb/OlrYMU/yXD0CUDwd7y6980zmlroo66l+NfmnVaaaP0emy8yUVvjB9H7fjGnS JvM1E8k0G9cvGeqe/I8NYpr3wluVtXR/erLFYh6FW+drx+pUKcqpqK7QsXMJ+lAmFUaa LkCPmOiq//S7lt3zZVRHy8niKVr6RyadKfEWA/0wBLv+/c0vSVVfytuAIApFjkhceumL 2TimJuPJwGhQkdrCsTsTZ2ztS1Q8/pAnErexnZAkYFN7NGpVo3CARcc/ve5bTGn/cq8Y LspA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762758375; x=1763363175; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=r6KmOy72ev5kiNdg9VZMuRCxkkqXW/GlaB81Wm/Cwzo=; b=ghjcd/rQTFv8Rv2zfoE9WiTphD8B7jQCMUM3lFAu5dKbNcEqYl2DTSohfOak3wvqTi d8mPaLogUxx7CmZvaUTLD+fUMfLrSRcj/ud0oJTZRbC6pEn/c9HCjR9Hnu2PbchToxhx yC8okYs+6jk0Os4G4Gcql9Q6WHIEaRphrZod+868s6xuqgRNym727iufFzgUkfP2jB6A a0hjWpBGQc0yoykacDLhaGU7t+yASiptYD0V9CT6HkJPLIfEhF6YWLJUMPU3lONbBEAj SDP6WNf27q7hCTRuvvN5bfJvpN9F7yp/i6tLg8tOCR5DLHwLVFA3NW6CRLtJmEZPgtH0 hdsQ== X-Gm-Message-State: AOJu0YxG3sitRk8XCnkvhTVHz3039ItV2ihdSRZ3WhmSkFeMnt83UBMT ax2Cvj02M9J+3cD6c/jmHuuqRVUEZ6xg/BJhfxBy2EogH0ZmHx1FgRAZpE+FRQ== X-Gm-Gg: ASbGnctghbJZVv/9XeuFF6QE1VyPw4QwxJu4Do1IMpYbTpzRE+UTPMptQ5cAdZVl46x wPmze1GybKm7tCb7drCAMO7P8X/J0awlsU5hP2HEIodMbzsA6XkVVX9udmvwaNL1gfRIaGd9f6o 8VABY8QQ9zSokttlnLHh+pLqZ40DiISQWHxOjW8Z8Y7mb7FjSeVsH4BtEO+9lnx2chlkyPlYw+T 9hpvtf6cBF8XGj6+epQcqmIoOlMJvEy5kVOdbDqjlOgXM555tsCQfEt68SFrOPZulT9+S/sIB1P jSg1oskNMkFDIm4SEhyZZZAgjmVlerbiNl3DkDpvwQ1ngxGJrHV6dKg5LxngPk1GRKpg7KXOFns ChtEQ2FsUvxvCLx8aZUM0lk+CNO7whS3QGOOuGHtO6QGMOLXY6+mKnnWWtDU0CNAxcyqwXwWVzl R7KOm1QNJLZbVmlzQ5WsXpZ8GG X-Google-Smtp-Source: AGHT+IFRQtW29Czfa70+b78t5osIpql+E+4a62zAGT5DEZzeqUvuZZHwreYxri0liIQXmoeHWKFsow== X-Received: by 2002:a17:90b:4c4a:b0:340:ff7d:c26 with SMTP id 98e67ed59e1d1-3436cbb6581mr11109709a91.16.1762758374502; Sun, 09 Nov 2025 23:06:14 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([147.161.216.248]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ba901c3817csm11511337a12.30.2025.11.09.23.06.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Nov 2025 23:06:14 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-core@lists.openembedded.org Cc: Ankur Tyagi Subject: [OE-core][walnascar][PATCH 2/3] ghostscript: patch CVE-2025-59799 Date: Mon, 10 Nov 2025 20:06:03 +1300 Message-ID: <20251110070604.444927-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251110070604.444927-1-ankur.tyagi85@gmail.com> References: <20251110070604.444927-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 10 Nov 2025 07:06:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/226101 From: Ankur Tyagi Details https://nvd.nist.gov/vuln/detail/CVE-2025-59799 Signed-off-by: Ankur Tyagi --- .../ghostscript/CVE-2025-59799.patch | 42 +++++++++++++++++++ .../ghostscript/ghostscript_10.05.1.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59799.patch diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59799.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59799.patch new file mode 100644 index 0000000000..9b982c7a80 --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59799.patch @@ -0,0 +1,42 @@ +From 0acc06d00aaa267ae10cce6060e983eafb067d86 Mon Sep 17 00:00:00 2001 +From: Piotr Kajda +Date: Thu, 8 May 2025 11:37:09 +0100 +Subject: [PATCH] pdfwrite - bounds check some strings + +Bug #708517 + +This differs very slightly from the proposed patch in the bug report, I +had a quick scout through the C file and found another similar case. + +Both fixed here. + +CVE: CVE-2025-59799 +Upstream-Status: Backport [https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226c242ab7a83fa53e4b0ff781] +(cherry picked from commit 6dab38fb211f15226c242ab7a83fa53e4b0ff781) +Signed-off-by: Ankur Tyagi +--- + devices/vector/gdevpdfm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/devices/vector/gdevpdfm.c b/devices/vector/gdevpdfm.c +index d1237c91a..c120ba1ae 100644 +--- a/devices/vector/gdevpdfm.c ++++ b/devices/vector/gdevpdfm.c +@@ -199,6 +199,8 @@ pdfmark_coerce_dest(gs_param_string *dstr, char dest[MAX_DEST_STRING]) + { + const byte *data = dstr->data; + uint size = dstr->size; ++ if (size > MAX_DEST_STRING) ++ return_error(gs_error_limitcheck); + if (size == 0 || data[0] != '(') + return 0; + /****** HANDLE ESCAPES ******/ +@@ -859,6 +861,8 @@ pdfmark_put_ao_pairs(gx_device_pdf * pdev, cos_dict_t *pcd, + char buf[30]; + int d0, d1; + ++ if (Action[1].size > 29) ++ return_error(gs_error_rangecheck); + memcpy(buf, Action[1].data, Action[1].size); + buf[Action[1].size] = 0; + if (sscanf(buf, "%d %d R", &d0, &d1) == 2) diff --git a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb b/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb index f8454f82ba..a8347283be 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb @@ -26,6 +26,7 @@ SRC_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/downlo file://ghostscript-9.16-Werror-return-type.patch \ file://avoid-host-contamination.patch \ file://CVE-2025-59798.patch \ + file://CVE-2025-59799.patch \ " SRC_URI[sha256sum] = "121861b6d29b2461dec6575c9f3cab665b810bd408d4ec02c86719fa708b0a49" From patchwork Mon Nov 10 07:06:04 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 74088 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24702CCFA1A for ; Mon, 10 Nov 2025 07:06:22 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.42753.1762758377813208352 for ; Sun, 09 Nov 2025 23:06:17 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=JwbNULRQ; spf=pass (domain: gmail.com, ip: 209.85.214.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-29806bd47b5so5323445ad.3 for ; Sun, 09 Nov 2025 23:06:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762758377; x=1763363177; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bsG6ZZigudpiDUqZ+zH24vOQKopwCl3Ru+ahzEo3wog=; b=JwbNULRQPBAnn9VEkPmf2Yf6qDCJOulLJHLFoqJ3jJIQFF0+6PRny1/pPU/JYZ4LJR Kw3t71oyUFJAPBdK92L1xqIrnkabeu3C7YvsQWrHtJPYe+msIvzmpbNWE1Q9oi5x69kx LPkj7qzHRwHK3+vnY/QXhe+ErrmeYwyYcVen8E/s5xC85BdIOKSf6e7wekBGL3vktYz2 ge4mh7UeysB1veR5Y52cJgeKlI72r9unxppS8a+uQ9Juqj1QBUlRNFh8AVAiK26Blzzi o9ON7P0LbvaMP11f3CijrvcQa+NAHycVmyGW4g2QrtmJMhHsX3mgVlNmoZoRYwdEVfek t57Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762758377; x=1763363177; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=bsG6ZZigudpiDUqZ+zH24vOQKopwCl3Ru+ahzEo3wog=; b=SvRsiKudTLYixcW6uq9JsIk/jINyubSxbZDt+yPv128AEDrrirDgAlFzq2J+Games1 tOA4ol83ruj0GXyxm1juhuboZoaOcMFF8a4lf44L7dYNM5nkWWX95Btrn4PHnNpCsHSv DbXBH5eVmyhnhgaKnigPWUOtCvTXlV625mDLA9CNdwW8sMHOw+efO7JMlPgWQl60GDPK j8vxT5Pmp+vlaniByD1HFma3eHn6zRqgt/6nQ1FHlGcKiovp8KEKVQhpgPbWpx9UF3rm 6uHO2M6nA2EuCzQPYRz9lgDR0Fm2I/ZQAzGLlzaQ1Oqly+ZVtp2oBOKddy+1Z3IIHFrf iOQg== X-Gm-Message-State: AOJu0YwBGpSJFkkE929xvwAP3xG05cA+ZuDERjrFtt6J3ufTzw/Z9u7r vCS6AidktM6lXd/fdFPlfUebwXpmJyr7juqGyzALxaW6QIUK7GTs9g5uX2QjGw== X-Gm-Gg: ASbGnctsVtkZXtdDJq0p+gqpY+fNiQPoSHNJ3dPE9RRri3KBFBtaoAqRlEusr/zzULs qqwXj0AHnHzYG5Qun2zLUGmgXzDG204Zt7Z6FeieGhn2f9PgloqmrsO3GkqmMDwSAvSOa5NvKTh OCbtktkJpatVwWjSpC57OyWEbr5rosiSquxmJE5Im2QevNsN3JF1Te/XKYDZNDZuulwo9S+1evP Iw/P6OwZRA79JBGDEtL+qNG7Oan3s7H4CMcd5wwqBycOtLCM18JWSyWy0jMnbOFUuoB7UbeM/0L +Kni8wOpf0s/A7qCsBuwpFvpQV5oNdLnBMk3dH0UAVFf6MBK8uaNMov+6roCaM5R69L7qzl8FnQ 48B2JWqYkIKpLzEA+ekqav6FiNSe43Y80osD27TsYd5xT2yzxNwse1GKiGDsDClCoz2paLoMynC DEg6I0cmOg4b0CbQ== X-Google-Smtp-Source: AGHT+IERLvk8eQ40QjAn1vz6fqjuhC4UC5UbMovNzO/Ddb2JzIxERNFgUaYiL4YAXZX9UFCP6OZ1Rg== X-Received: by 2002:a17:902:e888:b0:295:8a21:155a with SMTP id d9443c01a7336-297e56d6144mr96160555ad.35.1762758376822; Sun, 09 Nov 2025 23:06:16 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([147.161.216.248]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ba901c3817csm11511337a12.30.2025.11.09.23.06.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 09 Nov 2025 23:06:16 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-core@lists.openembedded.org Cc: Ankur Tyagi Subject: [OE-core][walnascar][PATCH 3/3] ghostscript: patch CVE-2025-59800 Date: Mon, 10 Nov 2025 20:06:04 +1300 Message-ID: <20251110070604.444927-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251110070604.444927-1-ankur.tyagi85@gmail.com> References: <20251110070604.444927-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 10 Nov 2025 07:06:22 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/226102 From: Ankur Tyagi Details https://nvd.nist.gov/vuln/detail/CVE-2025-59800 Signed-off-by: Ankur Tyagi --- .../ghostscript/CVE-2025-59800.patch | 37 +++++++++++++++++++ .../ghostscript/ghostscript_10.05.1.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59800.patch diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59800.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59800.patch new file mode 100644 index 0000000000..1d0eca322d --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2025-59800.patch @@ -0,0 +1,37 @@ +From c7660900e280d55e86c842691a794911c671c30f Mon Sep 17 00:00:00 2001 +From: Ken Sharp +Date: Tue, 1 Jul 2025 10:31:17 +0100 +Subject: [PATCH] PDF OCR 8 bit device - avoid overflow + +Bug 708602 "Heap overflow in ocr_line8" + +Make sure the calculation of the required raster size does not overflow +an int. + +CVE: CVE-2025-59800 +Upstream-Status: Backport [https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350] +(cherry picked from commit 176cf0188a2294bc307b8caec876f39412e58350) +Signed-off-by: Ankur Tyagi +--- + devices/gdevpdfocr.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c +index 1c1e8eab8..7c9c12f8c 100644 +--- a/devices/gdevpdfocr.c ++++ b/devices/gdevpdfocr.c +@@ -521,9 +521,12 @@ ocr_line32(gx_device_pdf_image *dev, void *row) + static int + ocr_begin_page(gx_device_pdf_image *dev, int w, int h, int bpp) + { +- int raster = (w+3)&~3; ++ int64_t raster = (w + 3) & ~3; + +- dev->ocr.data = gs_alloc_bytes(dev->memory, raster * h, "ocr_begin_page"); ++ raster = raster * (int64_t)h; ++ if (raster < 0 || raster > max_size_t) ++ return gs_note_error(gs_error_VMerror); ++ dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page"); + if (dev->ocr.data == NULL) + return_error(gs_error_VMerror); + dev->ocr.w = w; diff --git a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb b/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb index a8347283be..57a1098521 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_10.05.1.bb @@ -27,6 +27,7 @@ SRC_URI = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/downlo file://avoid-host-contamination.patch \ file://CVE-2025-59798.patch \ file://CVE-2025-59799.patch \ + file://CVE-2025-59800.patch \ " SRC_URI[sha256sum] = "121861b6d29b2461dec6575c9f3cab665b810bd408d4ec02c86719fa708b0a49"