[gs-commits] ghostpdl branch, master, updated. jbig2dec-0.14-1679-g8c5348a
[email protected] (Chris Liddell)
| Newsgroups | gmane.comp.printing.ghostscript.cvs |
|---|---|
| Message-ID | <[email protected]> |
The ghostpdl branch, master has been updated
via 8c5348ae5fc35b449aa68eb6668cb6cbc6f345e0 (commit)
via 955c431ab611efd9a74e62a762cdc1ab9f64e14a (commit)
via 2b3ed0ea5d07005e64badfb9212911a725fefb94 (commit)
via b3a1114d04a82e534d915b125eb34de21317993a (commit)
via 0350a0ab56e7b180d62af9423313d6c70345b386 (commit)
from 511260d72a4b6df9bd2ba48e022f7c3921b547cb (commit)
----------------------------------------------------------------------
commit 8c5348ae5fc35b449aa68eb6668cb6cbc6f345e0
Author: Chris Liddell <[email protected]>
Date: Tue Sep 17 11:42:13 2019 +0100
Fix file permissions interaction with '@' command line
If an options file (prefixed '@' on the command line) followed something that
required initialising the Postscript interpreter (such as a '-c' option),
opening the file would potentially fail because file permissions had been
activated by the interpreter.
Add and remove the file from the permit reading list before attempting to open
it.
diff --git a/base/gsargs.c b/base/gsargs.c
index 9e6ca14..24e9cce 100644
--- a/base/gsargs.c
+++ b/base/gsargs.c
@@ -357,7 +357,12 @@ arg_next(arg_list * pal, const char **argstr, const gs_memory_t *errmem)
return_error(gs_error_Fatal);
}
fname = (char *)*argstr + 1; /* skip @ */
+
+ if (gs_add_control_path(pal->memory, gs_permit_file_reading, fname) < 0)
+ return_error(gs_error_Fatal);
+
f = (*pal->arg_fopen) (fname, pal->fopen_data);
+ DISCARD(gs_remove_control_path(pal->memory, gs_permit_file_reading, fname));
if (f == NULL) {
errprintf(errmem, "Unable to open command line file %s\n", *argstr);
return_error(gs_error_Fatal);
----------------------------------------------------------------------
commit 955c431ab611efd9a74e62a762cdc1ab9f64e14a
Author: Chris Liddell <[email protected]>
Date: Mon Sep 16 15:10:46 2019 +0100
Add explicit "flush" after warning message.
The warning messages could get trampled on (due to buffering) by messages on
stderr, flushing ensures the warning is emitted as intended.
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
index 99ec0cb..d04e4f8 100644
--- a/Resource/Init/gs_init.ps
+++ b/Resource/Init/gs_init.ps
@@ -315,7 +315,7 @@ DELAYBIND
( have selected DELAYBIND. Unless you use this option with\n) print
( care \(and specifically, remember to call .bindnow\) it is\n) print
( possible that malicious code may be able to evade the\n) print
- ( limited security offered by the SAFER option.\n) print
+ ( limited security offered by the SAFER option.\n) print flush
} if
.currentglobal //false .setglobal
systemdict /.delaybind 2000 array .forceput
@@ -2679,7 +2679,7 @@ WRITESYSTEMDICT {
( care and specifically, remember to execute code like:\n) print
( "systemdict readonly pop"\n) print
( it is possible that malicious code may be able to evade the\n) print
- ( limited security offered by the SAFER option.\n) print
+ ( limited security offered by the SAFER option.\n) print flush
}if
}
{
----------------------------------------------------------------------
commit 2b3ed0ea5d07005e64badfb9212911a725fefb94
Author: Chris Liddell <[email protected]>
Date: Fri Sep 13 09:33:20 2019 +0100
Have .setsafe/.setsafeglobal undefine operators
In SAFER, we undefine certain delicate operators (mostly transparency related
ones), but we weren't doing so if SAFER was enabled using .setsafe
This means some rejigging to keep NOSAFER and DELAYBIND working.
diff --git a/Resource/Init/gs_init.ps b/Resource/Init/gs_init.ps
index b976d4f..99ec0cb 100644
--- a/Resource/Init/gs_init.ps
+++ b/Resource/Init/gs_init.ps
@@ -331,7 +331,7 @@ DELAYBIND
{ pop /.bind cvx exec
}
ifelse
- } .bind def
+ } .bind odef
} executeonly if
.currentglobal //true .setglobal
@@ -2201,6 +2201,23 @@ systemdict /EPSBoundingBoxInit .forceundef
readonly def
.setglobal
+/SAFERUndefinePostScriptOperators {
+ [
+ % Used by our own test suite files
+ /.pushpdf14devicefilter % transparency-example.ps
+ /.poppdf14devicefilter % transparency-example.ps
+ /.setopacityalpha % transparency-example.ps
+ /.setshapealpha % transparency-example.ps
+ /.endtransparencygroup % transparency-example.ps
+ /.setdotlength % Bug687720.ps
+ /.sort /.setdebug /.mementolistnewblocks /getenv
+ /unread
+ ]
+ {systemdict exch .forceundef} forall
+
+ //systemdict /SAFERUndefinePostScriptOperators .forceundef
+} .bind executeonly def % must be bound and hidden for .forceundef
+
/tempfilepaths
[
(TMPDIR) getenv not
@@ -2310,7 +2327,12 @@ currentdict /tempfilepaths undef
if
.locksafe
}
- {//.lockfileaccess exec}
+ {
+ //.lockfileaccess exec
+ DELAYBIND not {
+ //systemdict /SAFERUndefinePostScriptOperators get exec
+ } if
+ }
ifelse
} .bind executeonly odef
%% --- End documented extensions ---
@@ -2351,7 +2373,12 @@ currentdict /tempfilepaths undef
if
//.locksafeglobal exec
}
- {//.lockfileaccess exec}
+ {
+ //.lockfileaccess exec
+ DELAYBIND not {
+ //systemdict /SAFERUndefinePostScriptOperators get exec
+ } if
+ }
ifelse
} .bind def
@@ -2361,25 +2388,6 @@ currentdict /.locksafe_userparams .undef
currentdict /.setsafeglobal .undef
currentdict /.locksafeglobal .undef
-SAFER {
-/SAFERUndefinePostScriptOperators {
- [
- % Used by our own test suite files
- /.pushpdf14devicefilter % transparency-example.ps
- /.poppdf14devicefilter % transparency-example.ps
- /.setopacityalpha % transparency-example.ps
- /.setshapealpha % transparency-example.ps
- /.endtransparencygroup % transparency-example.ps
- /.setdotlength % Bug687720.ps
- /.sort /.setdebug /.mementolistnewblocks /getenv
- /unread
- ]
- {systemdict exch .forceundef} forall
-
- //systemdict /SAFERUndefinePostScriptOperators .forceundef
-} .bind executeonly def % must be bound and hidden for .forceundef
-} if
-
%% ---------------- SAFER stuff END -------------------%%
/UndefinePostScriptOperators {
@@ -2628,9 +2636,6 @@ FontDirectory readonly pop
% If we are using DELAYBIND we have to defer the undefinition
% until .bindnow.
DELAYBIND not {
- SAFER {
- //systemdict /SAFERUndefinePostScriptOperators get exec
- } if
//systemdict /UndefinePostScriptOperators get exec
} if
end
----------------------------------------------------------------------
commit b3a1114d04a82e534d915b125eb34de21317993a
Author: Chris Liddell <[email protected]>
Date: Thu Sep 12 14:23:10 2019 +0100
If set, add PCLFONTSOURCE value to permit_file_reading list
diff --git a/pcl/pl/pjparse.c b/pcl/pl/pjparse.c
index ab8f913..c0fd4e7 100644
--- a/pcl/pl/pjparse.c
+++ b/pcl/pl/pjparse.c
@@ -1791,12 +1791,24 @@ pjl_process_init(gs_memory_t * mem)
pathlen = 0;
if ((code = gp_getenv("PCLFONTSOURCE", (char *)0, &pathlen)) < 0) {
char *path =
- (char *)gs_alloc_bytes(mem, pathlen, "pjl_font_path");
+ (char *)gs_alloc_bytes(mem, pathlen + 1, "pjl_font_path");
/* if the allocation fails we use the pjl fontsource */
if (path == NULL)
pjlstate->environment_font_path = NULL;
else {
+ const char * const sepr = gp_file_name_separator();
+ const int lsepr = strlen(sepr);
gp_getenv("PCLFONTSOURCE", path, &pathlen); /* can't fail */
+
+ /* We want to ensure a trailing "/" is present */
+ if (gs_file_name_check_separator(path + (pathlen - (lsepr + 1)), lsepr, path + pathlen - 1) != 1) {
+ strncat(path, gp_file_name_separator(), pathlen + 1);
+ }
+ code = gs_add_control_path(mem, gs_permit_file_reading, path);
+ if (code < 0) {
+ gs_free_object(mem, path, "pjl_font_path");
+ goto fail1;
+ }
pjlstate->environment_font_path = path;
}
} else /* environmet variable does not exist use pjl fontsource */
----------------------------------------------------------------------
commit 0350a0ab56e7b180d62af9423313d6c70345b386
Author: Chris Liddell <[email protected]>
Date: Wed Sep 11 13:07:02 2019 +0100
Bug 701561: 'reduce' paths before adding to permit lists
Before attempting to open files, we pre-process the requested file name to
remove surplus/unnecessary elements: i.e. './././file' would be reduced to just
'./file', or '../dir/../dir/../dir/file' would be reduced to '../dir/file'.
The 'reduced' path is what we try to open, hence it is also what we check
against the file permissions list before we allow files to be accessed.
That being so, we should also 'reduce' paths as we add them to the permissions
lists - thus the permissions list creation and checking are consistent.
diff --git a/base/gslibctx.c b/base/gslibctx.c
index 0285651..a72a81d 100644
--- a/base/gslibctx.c
+++ b/base/gslibctx.c
@@ -23,6 +23,7 @@
#include "stdio_.h"
#include "string_.h" /* memset */
#include "gp.h"
+#include "gpmisc.h"
#include "gsicc_manage.h"
#include "gserrors.h"
#include "gscdefs.h" /* for gs_lib_device_list */
@@ -645,6 +646,8 @@ gs_add_control_path_len(const gs_memory_t *mem, gs_path_control_t type, const ch
gs_path_control_set_t *control;
unsigned int n, i;
gs_lib_ctx_core_t *core;
+ char *buffer;
+ uint rlen;
if (mem == NULL || mem->gs_lib_ctx == NULL ||
(core = mem->gs_lib_ctx->core) == NULL)
@@ -664,12 +667,23 @@ gs_add_control_path_len(const gs_memory_t *mem, gs_path_control_t type, const ch
return gs_error_rangecheck;
}
+ rlen = len+1;
+ buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gp_validate_path");
+ if (buffer == NULL)
+ return gs_error_VMerror;
+
+ if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
+ return gs_error_invalidfileaccess;
+ buffer[rlen] = 0;
+
n = control->num;
for (i = 0; i < n; i++)
{
- if (strncmp(control->paths[i], path, len) == 0 &&
- control->paths[i][len] == 0)
+ if (strncmp(control->paths[i], buffer, rlen) == 0 &&
+ control->paths[i][rlen] == 0) {
+ gs_free_object(core->memory, buffer, "gs_add_control_path_len");
return 0; /* Already there! */
+ }
}
if (control->num == control->max) {
@@ -681,17 +695,16 @@ gs_add_control_path_len(const gs_memory_t *mem, gs_path_control_t type, const ch
p = (char **)gs_alloc_bytes(core->memory, sizeof(*p)*n, "gs_lib_ctx(paths)");
} else
p = (char **)gs_resize_object(core->memory, control->paths, sizeof(*p)*n, "gs_lib_ctx(paths)");
- if (p == NULL)
+ if (p == NULL) {
+ gs_free_object(core->memory, buffer, "gs_add_control_path_len");
return gs_error_VMerror;
+ }
control->paths = p;
control->max = n;
}
n = control->num;
- control->paths[n] = (char *)gs_alloc_bytes(core->memory, len+1, "gs_lib_ctx(path)");
- if (control->paths[n] == NULL)
- return gs_error_VMerror;
- memcpy(control->paths[n], path, len);
+ control->paths[n] = buffer;
control->paths[n][len] = 0;
control->num++;
@@ -710,6 +723,8 @@ gs_remove_control_path_len(const gs_memory_t *mem, gs_path_control_t type, const
gs_path_control_set_t *control;
unsigned int n, i;
gs_lib_ctx_core_t *core;
+ char *buffer;
+ uint rlen;
if (mem == NULL || mem->gs_lib_ctx == NULL ||
(core = mem->gs_lib_ctx->core) == NULL)
@@ -729,12 +744,22 @@ gs_remove_control_path_len(const gs_memory_t *mem, gs_path_control_t type, const
return gs_error_rangecheck;
}
+ rlen = len+1;
+ buffer = (char *)gs_alloc_bytes(core->memory, rlen, "gp_validate_path");
+ if (buffer == NULL)
+ return gs_error_VMerror;
+
+ if (gp_file_name_reduce(path, (uint)len, buffer, &rlen) != gp_combine_success)
+ return gs_error_invalidfileaccess;
+ buffer[rlen] = 0;
+
n = control->num;
for (i = 0; i < n; i++) {
- if (strncmp(control->paths[i], path, len) == 0 &&
+ if (strncmp(control->paths[i], buffer, len) == 0 &&
control->paths[i][len] == 0)
break;
}
+ gs_free_object(core->memory, buffer, "gs_remove_control_path_len");
if (i == n)
return 0;
diff --git a/base/lib.mak b/base/lib.mak
index fc92aa5..5772b8d 100644
--- a/base/lib.mak
+++ b/base/lib.mak
@@ -340,18 +340,18 @@ $(GLOBJ)gsmisc.$(OBJ) : $(GLSRC)gsmisc.c $(AK) $(gx_h) $(gserrors_h)\
$(gdbflags_h) $(LIB_MAK) $(MAKEDIRS)
$(GLCC) $(GLO_)gsmisc.$(OBJ) $(C_) $(GLSRC)gsmisc.c
-$(AUX)gsmisc.$(OBJ) : $(GLSRC)gsmisc.c $(AK) $(gx_h) $(gserrors_h)\
+$(AUX)gsmisc.$(OBJ) : $(GLSRC)gsmisc.c $(AK) $(gx_h) $(gpmisc_h) $(gserrors_h)\
$(vmsmath_h) $(std_h) $(ctype__h) $(malloc__h) $(math__h) $(memory__h)\
$(string__h) $(gpcheck_h) $(gxfarith_h) $(gxfixed_h) $(stdint__h) $(stdio__h)\
$(gdbflags_h) $(LIB_MAK) $(MAKEDIRS)
$(GLCCAUX) $(C_) $(AUXO_)gsmisc.$(OBJ) $(GLSRC)gsmisc.c
-$(GLOBJ)gslibctx_1.$(OBJ) : $(GLSRC)gslibctx.c $(AK) $(gp_h) $(gsmemory_h)\
+$(GLOBJ)gslibctx_1.$(OBJ) : $(GLSRC)gslibctx.c $(AK) $(gp_h) $(gpmisc_h) $(gsmemory_h)\
$(gslibctx_h) $(stdio__h) $(string__h) $(gsicc_manage_h) $(gserrors_h)\
$(gscdefs_h) $(gsstruct_h)
$(GLCC) $(D_)WITH_CAL$(_D) $(I_)$(CALSRCDIR)$(_I) $(GLO_)gslibctx_1.$(OBJ) $(C_) $(GLSRC)gslibctx.c
-$(GLOBJ)gslibctx_0.$(OBJ) : $(GLSRC)gslibctx.c $(AK) $(gp_h) $(gsmemory_h)\
+$(GLOBJ)gslibctx_0.$(OBJ) : $(GLSRC)gslibctx.c $(AK) $(gp_h) $(gpmisc_h) $(gsmemory_h)\
$(gslibctx_h) $(stdio__h) $(string__h) $(gsicc_manage_h) $(gserrors_h)\
$(gscdefs_h) $(gsstruct_h)
$(GLCC) $(GLO_)gslibctx_0.$(OBJ) $(C_) $(GLSRC)gslibctx.c
Summary of changes:
Resource/Init/gs_init.ps | 59 ++++++++++++++++++++++++++----------------------
base/gsargs.c | 5 ++++
base/gslibctx.c | 41 ++++++++++++++++++++++++++-------
base/lib.mak | 6 ++---
pcl/pl/pjparse.c | 14 +++++++++++-
5 files changed, 86 insertions(+), 39 deletions(-)