From aebe8d11d414d22b2db10e3bf0708608920d2b9b Mon Sep 17 00:00:00 2001
From: "David Kaspar [Dee'Kej]" <dkaspar@redhat.com>
Date: Mon, 23 Apr 2018 14:10:22 +0200
Subject: [PATCH] Security patch for CVE-2018-10194 added

  Resolves: #1569821
---
 ghostscript-9.23-000-CVE-2018-10194.patch | 43 +++++++++++++++++++++++
 ghostscript.spec                          |  6 +++-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 ghostscript-9.23-000-CVE-2018-10194.patch

diff --git a/ghostscript-9.23-000-CVE-2018-10194.patch b/ghostscript-9.23-000-CVE-2018-10194.patch
new file mode 100644
index 0000000..142336e
--- /dev/null
+++ b/ghostscript-9.23-000-CVE-2018-10194.patch
@@ -0,0 +1,43 @@
+From 39b1e54b2968620723bf32e96764c88797714879 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Wed, 18 Apr 2018 15:46:32 +0100
+Subject: [PATCH] pdfwrite - Guard against trying to output an infinite number
+
+Bug #699255 " Buffer overflow on pprintg1 due to mishandle postscript file data to pdf"
+
+The file uses an enormous parameter to xyxhow, causing an overflow in
+the calculation of text positioning (value > 1e39).
+
+Since this is basically a nonsense value, and PostScript only supports
+real values up to 1e38, this patch follows the same approach as for
+a degenerate CTM, and treats it as 0.
+
+Adobe Acrobat Distiller throws a limitcheck error, so we could do that
+instead if this approach proves to be a problem.
+---
+ devices/vector/gdevpdts.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/devices/vector/gdevpdts.c b/devices/vector/gdevpdts.c
+index 848ad781f..172fe6bc3 100644
+--- a/devices/vector/gdevpdts.c
++++ b/devices/vector/gdevpdts.c
+@@ -103,9 +103,14 @@ append_text_move(pdf_text_state_t *pts, double dw)
+ static int
+ set_text_distance(gs_point *pdist, double dx, double dy, const gs_matrix *pmat)
+ {
+-    int code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
++    int code;
+     double rounded;
+ 
++    if (dx > 1e38 || dy > 1e38)
++        code = gs_error_undefinedresult;
++    else
++        code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
++
+     if (code == gs_error_undefinedresult) {
+         /* The CTM is degenerate.
+            Can't know the distance in user space.
+-- 
+2.14.3
+
diff --git a/ghostscript.spec b/ghostscript.spec
index 2a6329d..5f365e5 100644
--- a/ghostscript.spec
+++ b/ghostscript.spec
@@ -43,7 +43,7 @@
 Name:             ghostscript
 Summary:          Interpreter for PostScript language & PDF
 Version:          9.23
-Release:          1%{?dist}
+Release:          2%{?dist}
 
 License:          AGPLv3+
 
@@ -93,6 +93,7 @@ BuildRequires:    libXt-devel
 # Upstream patches -- official upstream patches released by upstream since the
 # ----------------    last rebase that are necessary for any reason:
 #Patch000: example000.patch
+Patch000: ghostscript-9.23-000-CVE-2018-10194.patch
 
 
 # Downstream patches -- these should be always included when doing rebase:
@@ -461,6 +462,9 @@ done
 # =============================================================================
 
 %changelog
+* Mon Apr 23 2018 David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.23-2
+- Fix for CVE-2018-10194 added (bug #1569821)
+
 * Wed Mar 21 2018 David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.23-1
 - Rebase to latest upstream version