diff --git a/debian/changelog b/debian/changelog index d611187..c326f46 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,21 @@ +ghostscript (10.05.1~dfsg-3deepin4) unstable; urgency=medium + + * fix(cve): CVE-2025-59801 + + -- deepin-ci-robot Thu, 13 Aug 2026 14:58:28 +0800 + +ghostscript (10.05.1~dfsg-3deepin3) unstable; urgency=medium + + * fix(cve): CVE-2025-59800 + + -- deepin-ci-robot Fri, 07 Aug 2026 13:08:23 +0800 + +ghostscript (10.05.1~dfsg-3deepin2) unstable; urgency=medium + + * fix(cve): CVE-2025-59798 + + -- deepin-ci-robot Fri, 07 Aug 2026 12:49:20 +0800 + ghostscript (10.05.1~dfsg-3deepin1) unstable; urgency=medium * Add libgs9-common transitional package for smooth upgrading diff --git a/debian/patches/CVE-2025-59798.patch b/debian/patches/CVE-2025-59798.patch new file mode 100644 index 0000000..25fb0ae --- /dev/null +++ b/debian/patches/CVE-2025-59798.patch @@ -0,0 +1,106 @@ +Description: CVE-2025-59798 - 安全修复 +Author: Ken Sharp +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/0cae41b23a9669e801211dd4cf97b6dadd6dbdd7 +Bug: https://security-tracker.debian.org/tracker/CVE-2025-59798 +Last-Update: Thu, 22 May 2025 12:25:41 +0100 +--- +diff --git a/devices/vector/gdevpdtw.c b/devices/vector/gdevpdtw.c +index ced15c9..fe24dd7 100644 +--- a/devices/vector/gdevpdtw.c ++++ b/devices/vector/gdevpdtw.c +@@ -703,7 +703,8 @@ static int + pdf_write_cid_system_info_to_stream(gx_device_pdf *pdev, stream *s, + const gs_cid_system_info_t *pcidsi, gs_id object_id) + { +- byte *Registry, *Ordering; ++ byte *Registry = NULL, *Ordering = NULL; ++ int code = 0; + + Registry = gs_alloc_bytes(pdev->pdf_memory, pcidsi->Registry.size, "temporary buffer for Registry"); + if (!Registry) +@@ -734,14 +735,19 @@ pdf_write_cid_system_info_to_stream(gx_device_pdf *pdev, stream *s, + } + s_arcfour_process_buffer(&sarc4, Ordering, pcidsi->Ordering.size); + } +- stream_puts(s, "<<\n/Registry"); ++ code = stream_puts(s, "<<\n/Registry"); ++ if (code < 0) ++ goto error; + s_write_ps_string(s, Registry, pcidsi->Registry.size, PRINT_HEX_NOT_OK); +- stream_puts(s, "\n/Ordering"); ++ code = stream_puts(s, "\n/Ordering"); ++ if(code < 0) ++ goto error; + s_write_ps_string(s, Ordering, pcidsi->Ordering.size, PRINT_HEX_NOT_OK); ++error: + pprintd1(s, "\n/Supplement %d\n>>\n", pcidsi->Supplement); + gs_free_object(pdev->pdf_memory, Registry, "free temporary Registry buffer"); + gs_free_object(pdev->pdf_memory, Ordering, "free temporary Ordering buffer"); +- return 0; ++ return code; + } + + int +@@ -786,31 +792,55 @@ pdf_write_cmap(gx_device_pdf *pdev, const gs_cmap_t *pcmap, + *ppres = writer.pres; + writer.pres->where_used = 0; /* CMap isn't a PDF resource. */ + if (!pcmap->ToUnicode) { +- byte buf[200]; ++ byte *buf = NULL; ++ uint64_t buflen = 0; + cos_dict_t *pcd = (cos_dict_t *)writer.pres->object; + stream s; + ++ /* We use 'buf' for the stream 's' below and that needs to have some extra ++ * space for the CIDSystemInfo. We also need an extra byte for the leading '/' ++ * 100 bytes is ample for the overhead. ++ */ ++ buflen = pcmap->CIDSystemInfo->Registry.size + pcmap->CIDSystemInfo->Ordering.size + pcmap->CMapName.size + 100; ++ if (buflen > max_uint) ++ return_error(gs_error_limitcheck); ++ ++ buf = gs_alloc_bytes(pdev->memory, buflen, "pdf_write_cmap"); ++ if (buf == NULL) ++ return_error(gs_error_VMerror); ++ + code = cos_dict_put_c_key_int(pcd, "/WMode", pcmap->WMode); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + buf[0] = '/'; + memcpy(buf + 1, pcmap->CMapName.data, pcmap->CMapName.size); + code = cos_dict_put_c_key_string(pcd, "/CMapName", + buf, pcmap->CMapName.size + 1); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + s_init(&s, pdev->memory); +- swrite_string(&s, buf, sizeof(buf)); ++ swrite_string(&s, buf, buflen); + code = pdf_write_cid_system_info_to_stream(pdev, &s, pcmap->CIDSystemInfo, 0); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + code = cos_dict_put_c_key_string(pcd, "/CIDSystemInfo", + buf, stell(&s)); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } + code = cos_dict_put_string_copy(pcd, "/Type", "/CMap"); +- if (code < 0) ++ if (code < 0) { ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + return code; ++ } ++ gs_free_object(pdev->memory, buf, "pdf_write_cmap"); + } + if (pcmap->CMapName.size == 0) { + /* Create an arbitrary name (for ToUnicode CMap). */ diff --git a/debian/patches/CVE-2025-59800.patch b/debian/patches/CVE-2025-59800.patch new file mode 100644 index 0000000..0a9c531 --- /dev/null +++ b/debian/patches/CVE-2025-59800.patch @@ -0,0 +1,25 @@ +Description: CVE-2025-59800 - 安全修复 +Author: Ken Sharp +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2025-59800 +Last-Update: Tue, 1 Jul 2025 10:31:17 +0100 +--- +diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c +index 1c1e8ea..7c9c12f 100644 +--- a/devices/gdevpdfocr.c ++++ b/devices/gdevpdfocr.c +@@ -521,9 +521,12 @@ ocr_line32(gx_device_pdf_image *dev, void *row) + static int + ocr_begin_page(gx_device_pdf_image *dev, int w, int h, int bpp) + { +- int raster = (w+3)&~3; ++ int64_t raster = (w + 3) & ~3; + +- dev->ocr.data = gs_alloc_bytes(dev->memory, raster * h, "ocr_begin_page"); ++ raster = raster * (int64_t)h; ++ if (raster < 0 || raster > max_size_t) ++ return gs_note_error(gs_error_VMerror); ++ dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page"); + if (dev->ocr.data == NULL) + return_error(gs_error_VMerror); + dev->ocr.w = w; diff --git a/debian/patches/CVE-2025-59801.patch b/debian/patches/CVE-2025-59801.patch new file mode 100644 index 0000000..d52ca9a --- /dev/null +++ b/debian/patches/CVE-2025-59801.patch @@ -0,0 +1,26 @@ +Description: CVE-2025-59801 - 安全修复 +Author: Ken Sharp +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/d12002b16c59e12d97f42fb2c70caded8b1b6aa8 +Bug: https://security-tracker.debian.org/tracker/CVE-2025-59801 +Last-Update: 2025-09-09 +--- +diff --git a/xps/xpstiff.c b/xps/xpstiff.c +index 484ed5b..83cb913 100644 +--- a/xps/xpstiff.c ++++ b/xps/xpstiff.c +@@ -1175,6 +1175,15 @@ xps_decode_tiff(xps_context_t *ctx, byte *buf, int len, xps_image_t *image) + if (tiff->rowsperstrip > tiff->imagelength) + tiff->rowsperstrip = tiff->imagelength; + ++ if (tiff->bitspersample != 1 && tiff->bitspersample != 4 && tiff->bitspersample != 8 && tiff->bitspersample != 16) ++ return gs_rethrow(error, "Illegal BitsPerSample in TIFF header"); ++ ++ if (tiff->samplesperpixel != 1 && tiff->samplesperpixel != 3 && tiff->samplesperpixel != 4 && tiff->samplesperpixel != 5) ++ return gs_rethrow(error, "Illegal SamplesPerPixel in TIFF header"); ++ ++ if (tiff->compression < 1 || (tiff->compression > 5 && (tiff->compression != 7 && tiff->compression != 32773))) ++ return gs_rethrow(error, "Illegal Compression in TIFF header"); ++ + error = xps_decode_tiff_strips(ctx, tiff, image); + if (error) + return gs_rethrow(error, "could not decode image data"); diff --git a/debian/patches/series b/debian/patches/series index 2d3f9ca..986cefb 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -14,3 +14,6 @@ 2010_add_build_timestamp_setting.patch 2011_disable_google_analytics.patch 2012_additional_gcc_15_fixes.patch +CVE-2025-59798.patch +CVE-2025-59800.patch +CVE-2025-59801.patch