From: Lee Chee Yang <lcyan...@gmail.com> Signed-off-by: Chee Yang Lee <chee.yang....@intel.com> --- .../ghostscript/CVE-2022-2085.patch | 44 +++++++++++++++++++ .../ghostscript/ghostscript_9.55.0.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch
diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch new file mode 100644 index 0000000000..58cb93727a --- /dev/null +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2022-2085.patch @@ -0,0 +1,44 @@ +From ae1061d948d88667bdf51d47d918c4684d0f67df Mon Sep 17 00:00:00 2001 +From: Robin Watts <robin.wa...@artifex.com> +Date: Wed, 16 Feb 2022 15:22:50 +0000 +Subject: [PATCH] Bug 704945: Add init_device_procs entry for mem_x_device. + +When allocating a buffer device, we rely on an init_device_procs +being defined for the device we are using as a prototype. Which +device we use as a prototype depends upon the number of bits per +pixel we are using. For bpp > 64, we use mem_x_device, which does +not currently have an init_device_procs defined. + +This is a fairly hard case to tickle, as very few devices use +more than 64 bits per pixel. The DeviceN device is one of the +few that does, and then the problem only kicks in if the +MaxBitmap figure is high enough (or conversely the resolution is +low enough). + + +http://git.ghostscript.com/?p=ghostpdl.git;a=patch;h=ae1061d948d88667bdf51d47d918c4684d0f67df +Upstream-Status: Backport +CVE: CVE-2022-2085 +Signed-off-by: Chee Yang Lee <chee.yang....@intel.com> +--- + base/gdevmx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/base/gdevmx.c b/base/gdevmx.c +index 08b0cbcfe..89e9ff774 100644 +--- a/base/gdevmx.c ++++ b/base/gdevmx.c +@@ -1,4 +1,4 @@ +-/* Copyright (C) 2001-2021 Artifex Software, Inc. ++/* Copyright (C) 2001-2022 Artifex Software, Inc. + All Rights Reserved. + + This software is provided AS-IS with no warranty, either express or +@@ -25,4 +25,4 @@ + + /* The device descriptor. */ + const gx_device_memory mem_x_device = +- mem_device("imagex", 256, 0, NULL); ++ mem_device("imagex", 256, 0, mem_initialize_device_procs); +-- +2.25.1 diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb index c28e62f089..365420fb64 100644 --- a/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb +++ b/meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb @@ -33,6 +33,7 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d file://do-not-check-local-libpng-source.patch \ file://avoid-host-contamination.patch \ file://mkdir-p.patch \ + file://CVE-2022-2085.patch \ " SRC_URI = "${SRC_URI_BASE} \ -- 2.36.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#167379): https://lists.openembedded.org/g/openembedded-core/message/167379 Mute This Topic: https://lists.openembedded.org/mt/92066496/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
