Security patch for CVE-2018-10194 added

Resolves: #1569821

.cvsignore

@@ -1,16 +0,0 @@
-CIDFnmap-cjk-20030115.tar.gz
-acro5-cmaps-2001.tar.gz
-adobe-cmaps-200202.tar.gz
-eplaseren-1.0.2-550.tgz
-epson740.tgz
-gdevmd2k-0.2a.tar.gz
-ghostscript-7.05.tar.bz2
-gnu-drivers.tar.gz
-gs550j1.tar.gz
-gs6.51-cjk-M2-R3.tar.gz
-gs704-j-vlib.zip
-hpijs-1.3.tar.gz
-jpegsrc.v6b.tar.gz
-lexmarkgs990908.tar.gz
-lxm3200-0.4.1-gs5.50-src.tar.gz
-pcl3-3.3.tar.gz

.gitignore

@@ -0,0 +1,51 @@
+acro5-cmaps-2001.tar.gz
+adobe-cmaps-200202.tar.gz
+eplaser-3.1.4-705.tgz
+epson740.tgz
+gdevmd2k-0.2a.tar.gz
+ghostscript-7.07.tar.bz2
+gs550j1.tar.gz
+gs6.51-cjk-M2-R3.tar.gz
+gs704-j-vlib.zip
+lexmarkgs990908.tar.gz
+lxm3200-tweaked-20030501.tar.gz
+pcl3-3.3.tar.gz
+espgs-8.15rc3-source.tar.bz2
+adobe-cmaps-200204.tar.gz
+espgs-8.15rc4-source.tar.bz2
+espgs-8.15.1-source.tar.bz2
+adobe-cmaps-200406.tar.gz
+espgs-8.15.2-source.tar.bz2
+espgs-8.15.3-source.tar.bz2
+espgs-8.15.4-source.tar.bz2
+ghostscript-8.60-r8117.tar.bz2
+ghostscript-8.60.tar.bz2
+ghostscript-8.61.tar.bz2
+ghostscript-8.62.tar.bz2
+ghostscript-8.63.tar.bz2
+ghostscript-8.64.tar.bz2
+ghostscript-8.70.tar.xz
+ghostscript-8.71.tar.xz
+/ghostscript-9.00.tar.xz
+/ghostscript-9.01.tar.bz2
+/ghostscript-9.02.tar.bz2
+/ghostscript-9.04.tar.bz2
+/ghostscript-9.05.tar.bz2
+/ghostscript-9.06.tar.bz2
+/ghostscript-9.06-cleaned.tar.bz2
+/ghostscript-9.07.tar.bz2
+/ghostscript-9.07-cleaned.tar.bz2
+/ghostscript-9.08rc1.tar.gz
+/ghostscript-9.08.tar.bz2
+/ghostscript-9.09rc1.tar.gz
+/ghostscript-9.09.tar.bz2
+/ghostscript-9.10.tar.bz2
+/ghostscript-9.10-cleaned.tar.bz2
+/ghostscript-9.12-cleaned.tar.bz2
+/ghostscript-9.14-cleaned.tar.bz2
+/ghostscript-9.14-cleaned-1.tar.bz2
+/ghostscript-9.15-cleaned.tar.bz2
+/ghostscript-9.15-cleaned-1.tar.bz2
+/ghostscript-9.16-cleaned-1.tar.bz2
+/ghostscript-9.20.tar.xz
+/ghostscript-9.22.tar.xz

Makefile

@@ -1,6 +0,0 @@
-# Makefile for source rpm: ghostscript
-# $Id$
-NAME := ghostscript
-SPECFILE = $(firstword $(wildcard *.spec))
-
-include ../common/Makefile.common

ghostscript-9.20-run-dvipdf-securely.patch

@@ -0,0 +1,22 @@
+From 32d8df77bf3326f708c13d6913547c01ce6d728c Mon Sep 17 00:00:00 2001
+From: "David Kaspar [Dee'Kej]" <dkaspar@redhat.com>
+Date: Fri, 7 Oct 2016 13:57:01 +0200
+Subject: [PATCH] Make sure 'dvipdf' is being run securely
+
+---
+ lib/dvipdf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/dvipdf b/lib/dvipdf
+index 802aeab..c92dfb0 100755
+--- a/lib/dvipdf
++++ b/lib/dvipdf
+@@ -43,4 +43,4 @@ fi
+ 
+ # We have to include the options twice because -I only takes effect if it
+ # appears before other options.
+-exec dvips -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
++exec dvips -R -Ppdf $DVIPSOPTIONS -q -f "$infile" | $GS_EXECUTABLE $OPTIONS -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutputFile="$outfile" $OPTIONS -c .setpdfwrite -
+-- 
+2.7.4
+

ghostscript-9.22-CVE-2018-10194.patch

@@ -0,0 +1,43 @@
+From 7654b90e2b0025076adec33a16a1b18639fb2d63 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Wed, 18 Apr 2018 15:46:32 +0100
+Subject: [PATCH] pdfwrite - Guard against trying to output an infinite number
+
+Bug #699255 " Buffer overflow on pprintg1 due to mishandle postscript file data to pdf"
+
+The file uses an enormous parameter to xyxhow, causing an overflow in
+the calculation of text positioning (value > 1e39).
+
+Since this is basically a nonsense value, and PostScript only supports
+real values up to 1e38, this patch follows the same approach as for
+a degenerate CTM, and treats it as 0.
+
+Adobe Acrobat Distiller throws a limitcheck error, so we could do that
+instead if this approach proves to be a problem.
+---
+ devices/vector/gdevpdts.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/devices/vector/gdevpdts.c b/devices/vector/gdevpdts.c
+index f2807a8..a0b9d7e 100644
+--- a/devices/vector/gdevpdts.c
++++ b/devices/vector/gdevpdts.c
+@@ -103,9 +103,14 @@ append_text_move(pdf_text_state_t *pts, double dw)
+ static int
+ set_text_distance(gs_point *pdist, double dx, double dy, const gs_matrix *pmat)
+ {
+-    int code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
++    int code;
+     double rounded;
+ 
++    if (dx > 1e38 || dy > 1e38)
++        code = gs_error_undefinedresult;
++    else
++        code = gs_distance_transform_inverse(dx, dy, pmat, pdist);
++
+     if (code == gs_error_undefinedresult) {
+         /* The CTM is degenerate.
+            Can't know the distance in user space.
+-- 
+2.14.3
+

ghostscript-9.22-fix-Fontmap.GS.patch

@@ -0,0 +1,63 @@
+From efc24229b0ba4b2f6a39fe89a4c9c576dbe7e124 Mon Sep 17 00:00:00 2001
+From: "David Kaspar [Dee'Kej]" <dkaspar@redhat.com>
+Date: Mon, 27 Nov 2017 10:30:52 +0100
+Subject: [PATCH] Bug 698784: Fix the alias for Helvetica-Narrow-Bold-Oblique
+
+Init/Fontmap.GS:
+
+There was a misalignment between the filename of the
+NimbusSansNarrow-BdOblique and its /Fontname in the T1 font itself.
+
+Filename:   NimbusSansNarrow-BdOblique
+/Fontname: /NimbusSansNarrow-BoldOblique
+
+This worked correctly if the fonts were located directly in
+/usr/share/ghostcript/Resources/Font folder on the filesystem.
+
+However, on Fedora we are using /usr/share/fonts/urw-base35/ folder,
+which is part of Ghostscript's Search Path. In this case it was
+causing the Ghostscript being unable to locate the correct font, thus
+crashing while opening any document containing Helvetica Narrow Bold
+Oblique font...
+
+*In addition*, rename the font file so it matches.
+---
+ ...busSansNarrow-BdOblique => NimbusSansNarrow-BoldOblique} | Bin
+ Resource/Init/Fontmap.GS                                    |   2 +-
+ psi/psromfs.mak                                             |   2 +-
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+ rename Resource/Font/{NimbusSansNarrow-BdOblique => NimbusSansNarrow-BoldOblique} (100%)
+
+diff --git a/Resource/Font/NimbusSansNarrow-BdOblique b/Resource/Font/NimbusSansNarrow-BoldOblique
+similarity index 100%
+rename from Resource/Font/NimbusSansNarrow-BdOblique
+rename to Resource/Font/NimbusSansNarrow-BoldOblique
+diff --git a/Resource/Init/Fontmap.GS b/Resource/Init/Fontmap.GS
+index 7770c67..cbda218 100644
+--- a/Resource/Init/Fontmap.GS
++++ b/Resource/Init/Fontmap.GS
+@@ -96,7 +96,7 @@
+ /Helvetica-Bold			/NimbusSans-Bold ;
+ /Helvetica-BoldOblique		/NimbusSans-BoldItalic      ;
+ /Helvetica-Narrow-Bold		/NimbusSansNarrow-Bold    ;
+-/Helvetica-Narrow-BoldOblique	/NimbusSansNarrow-BdOblique        ;
++/Helvetica-Narrow-BoldOblique	/NimbusSansNarrow-BoldOblique        ;
+ /Helvetica-Narrow		/NimbusSansNarrow-Regular    ;
+ /Helvetica-Narrow-Oblique	/NimbusSansNarrow-Oblique        ;
+ /Helvetica			/NimbusSans-Regular ;
+diff --git a/psi/psromfs.mak b/psi/psromfs.mak
+index cbb1163..34e5b5f 100644
+--- a/psi/psromfs.mak
++++ b/psi/psromfs.mak
+@@ -333,7 +333,7 @@ PS_FONT_DEPS=\
+ 	$(PSRESDIR)$(D)Font$(D)NimbusRoman-Regular \
+ 	$(PSRESDIR)$(D)Font$(D)NimbusSans-Bold \
+ 	$(PSRESDIR)$(D)Font$(D)NimbusSans-BoldItalic \
+-	$(PSRESDIR)$(D)Font$(D)NimbusSansNarrow-BdOblique \
++	$(PSRESDIR)$(D)Font$(D)NimbusSansNarrow-BoldOblique \
+ 	$(PSRESDIR)$(D)Font$(D)NimbusSansNarrow-Bold \
+ 	$(PSRESDIR)$(D)Font$(D)NimbusSansNarrow-Oblique \
+ 	$(PSRESDIR)$(D)Font$(D)NimbusSansNarrow-Regular \
+-- 
+2.9.5
+

ghostscript-9.22-restore-flushpage.patch

@@ -0,0 +1,28 @@
+diff -up ghostscript-9.22/Resource/Init/gs_init.ps.restore-flushpage ghostscript-9.22/Resource/Init/gs_init.ps
+--- ghostscript-9.22/Resource/Init/gs_init.ps.restore-flushpage	2017-11-29 14:58:35.449534983 -0500
++++ ghostscript-9.22/Resource/Init/gs_init.ps	2017-11-29 14:59:25.903397616 -0500
+@@ -2163,7 +2163,7 @@ SAFER { .setsafeglobal } if
+ /.type1execchar /.type2execchar /.type42execchar /.setweightvector /.getuseciecolor /processcolors /.includecolorspace
+ /.execn /.instopped /.stop /.stopped /.setcolorrendering /.setdevicecolorrendering /.buildcolorrendering1 /.builddevicecolorrendering1
+ /.TransformPQR_scale_WB0 /.TransformPQR_scale_WB1 /.TransformPQR_scale_WB2 /.currentoverprintmode /.copydevice2
+-/.devicename /.doneshowpage /flushpage /.getbitsrect /.getdevice /.getdefaultdevice /.getdeviceparams /.gethardwareparams
++/.devicename /.doneshowpage /.getbitsrect /.getdevice /.getdefaultdevice /.getdeviceparams /.gethardwareparams
+ /makewordimagedevice /.outputpage /.putdeviceparams /.setdevice /.currentshowpagecount
+ /.setpagedevice /.currentpagedevice /.knownundef /.setmaxlength /.rectappend /.initialize_dsc_parser /.parse_dsc_comments
+ /.fillCIDMap /.fillIdentityCIDMap /.buildcmap /.filenamelistseparator /.libfile /.getfilename
+@@ -2181,6 +2181,15 @@ SAFER { .setsafeglobal } if
+ /.systemvmSFD /.settrapparams /.currentsystemparams /.currentuserparams /.getsystemparam /.getuserparam /.setsystemparams /.setuserparams
+ /.checkpassword /.locale_to_utf8 /.currentglobal /.gcheck /.imagepath
+ 
++% Used by a free user in the Library of Congress. Apparently this is used to
++% draw a partial page, which is then filled in by the results of a barcode
++% scanner and SQL database lookup. Its not clear to us exactly why this needs to be
++% done as a partial page, but its easiest to restore the operator, and it seems like
++% its a reasonably safe operator to restore, for the *very* few devices on which
++% it will have any effect. Currently this uses the 'sync_outptu' device method
++% to transfer the partial page, in future we may use a spec_op instead.
++%/flushpage
++
+ % Used by our own test suite files
+ %/.fileposition %image-qa.ps
+ %/.makeoperator /.setCPSImode % gs_cet.ps

sources

@@ -1,16 +1 @@
-75fbe1a1c474d67fbc71cc4b1dbfb833  CIDFnmap-cjk-20030115.tar.gz
-2fbae60417d42779f6488ab897dcaaf6  acro5-cmaps-2001.tar.gz
-e8fbffadb8d70ce5f92708a699ae7765  adobe-cmaps-200202.tar.gz
-911c7865a83a69135417989dee53f8fc  eplaseren-1.0.2-550.tgz
-2c6ebfe51cab34ee61e3dd524c8640cc  epson740.tgz
-5ed2b4218b8f77cb411f3d2e4509ed24  gdevmd2k-0.2a.tar.gz
-821caada7e265ea5b698a78e6b029734  ghostscript-7.05.tar.bz2
-9b25d4dd54d3297f33a8f7609fba70dd  gnu-drivers.tar.gz
-d202cd105c496b7f0eb5221316fb7b7f  gs550j1.tar.gz
-6f8e90effe12527a4c3b36ea4ce47b3c  gs6.51-cjk-M2-R3.tar.gz
-b32da7d61421384a0874037576033861  gs704-j-vlib.zip
-9d0b79d0fae39f3efc5b8db60f51a8fa  hpijs-1.3.tar.gz
-dbd5f3b47ed13132f04c685d608a7547  jpegsrc.v6b.tar.gz
-aea08da4e37ab68ed6f1dc451f24b30b  lexmarkgs990908.tar.gz
-ec11b9ef72ecaabb61eeba27e93f9f2b  lxm3200-0.4.1-gs5.50-src.tar.gz
-34e664c2a98b847598f8441f8cac7ab6  pcl3-3.3.tar.gz
+SHA512 (ghostscript-9.22.tar.xz) = 67739ace64090ab1951cba4cb011a5a6829ee60b32ba4157d0f17e744e345ea268335304db6722677ae33565ea5b696c2ff7b889d42a463acf2933c8230523d4