fix(cve): CVE-2025-59798 - pdfwrite - avoid buffer overrun

debian/changelog

@@ -1,3 +1,21 @@
+ghostscript (10.05.1~dfsg-3deepin4) unstable; urgency=medium
+
+  * fix(cve): CVE-2025-59801
+
+ -- deepin-ci-robot <packages@deepin.org>  Thu, 13 Aug 2026 14:58:28 +0800
+
+ghostscript (10.05.1~dfsg-3deepin3) unstable; urgency=medium
+
+  * fix(cve): CVE-2025-59800
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 07 Aug 2026 13:08:23 +0800
+
+ghostscript (10.05.1~dfsg-3deepin2) unstable; urgency=medium
+
+  * fix(cve): CVE-2025-59798
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 07 Aug 2026 12:49:20 +0800
+
 ghostscript (10.05.1~dfsg-3deepin1) unstable; urgency=medium
 
   * Add libgs9-common transitional package for smooth upgrading

debian/patches/CVE-2025-59798.patch

@@ -0,0 +1,106 @@
+Description: CVE-2025-59798 - 安全修复
+Author: Ken Sharp <Ken.Sharp@artifex.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/0cae41b23a9669e801211dd4cf97b6dadd6dbdd7
+Bug: https://security-tracker.debian.org/tracker/CVE-2025-59798
+Last-Update: Thu, 22 May 2025 12:25:41 +0100
+---
+diff --git a/devices/vector/gdevpdtw.c b/devices/vector/gdevpdtw.c
+index ced15c9..fe24dd7 100644
+--- a/devices/vector/gdevpdtw.c
++++ b/devices/vector/gdevpdtw.c
+@@ -703,7 +703,8 @@ static int
+ pdf_write_cid_system_info_to_stream(gx_device_pdf *pdev, stream *s,
+                           const gs_cid_system_info_t *pcidsi, gs_id object_id)
+ {
+-    byte *Registry, *Ordering;
++    byte *Registry = NULL, *Ordering = NULL;
++    int code = 0;
+
+     Registry = gs_alloc_bytes(pdev->pdf_memory, pcidsi->Registry.size, "temporary buffer for Registry");
+     if (!Registry)
+@@ -734,14 +735,19 @@ pdf_write_cid_system_info_to_stream(gx_device_pdf *pdev, stream *s,
+         }
+         s_arcfour_process_buffer(&sarc4, Ordering, pcidsi->Ordering.size);
+     }
+-    stream_puts(s, "<<\n/Registry");
++    code = stream_puts(s, "<<\n/Registry");
++    if (code < 0)
++        goto error;
+     s_write_ps_string(s, Registry, pcidsi->Registry.size, PRINT_HEX_NOT_OK);
+-    stream_puts(s, "\n/Ordering");
++    code = stream_puts(s, "\n/Ordering");
++    if(code < 0)
++        goto error;
+     s_write_ps_string(s, Ordering, pcidsi->Ordering.size, PRINT_HEX_NOT_OK);
++error:
+     pprintd1(s, "\n/Supplement %d\n>>\n", pcidsi->Supplement);
+     gs_free_object(pdev->pdf_memory, Registry, "free temporary Registry buffer");
+     gs_free_object(pdev->pdf_memory, Ordering, "free temporary Ordering buffer");
+-    return 0;
++    return code;
+ }
+
+ int
+@@ -786,31 +792,55 @@ pdf_write_cmap(gx_device_pdf *pdev, const gs_cmap_t *pcmap,
+     *ppres = writer.pres;
+     writer.pres->where_used = 0; /* CMap isn't a PDF resource. */
+     if (!pcmap->ToUnicode) {
+-        byte buf[200];
++        byte *buf = NULL;
++        uint64_t buflen = 0;
+         cos_dict_t *pcd = (cos_dict_t *)writer.pres->object;
+         stream s;
+
++        /* We use 'buf' for the stream 's' below and that needs to have some extra
++         * space for the CIDSystemInfo. We also need an extra byte for the leading '/'
++         * 100 bytes is ample for the overhead.
++         */
++        buflen = pcmap->CIDSystemInfo->Registry.size + pcmap->CIDSystemInfo->Ordering.size + pcmap->CMapName.size + 100;
++        if (buflen > max_uint)
++            return_error(gs_error_limitcheck);
++
++        buf = gs_alloc_bytes(pdev->memory, buflen, "pdf_write_cmap");
++        if (buf == NULL)
++            return_error(gs_error_VMerror);
++
+         code = cos_dict_put_c_key_int(pcd, "/WMode", pcmap->WMode);
+-        if (code < 0)
++        if (code < 0) {
++            gs_free_object(pdev->memory, buf, "pdf_write_cmap");
+             return code;
++        }
+         buf[0] = '/';
+         memcpy(buf + 1, pcmap->CMapName.data, pcmap->CMapName.size);
+         code = cos_dict_put_c_key_string(pcd, "/CMapName",
+                         buf, pcmap->CMapName.size + 1);
+-        if (code < 0)
++        if (code < 0) {
++            gs_free_object(pdev->memory, buf, "pdf_write_cmap");
+             return code;
++        }
+         s_init(&s, pdev->memory);
+-        swrite_string(&s, buf, sizeof(buf));
++        swrite_string(&s, buf, buflen);
+         code = pdf_write_cid_system_info_to_stream(pdev, &s, pcmap->CIDSystemInfo, 0);
+-        if (code < 0)
++        if (code < 0) {
++            gs_free_object(pdev->memory, buf, "pdf_write_cmap");
+             return code;
++        }
+         code = cos_dict_put_c_key_string(pcd, "/CIDSystemInfo",
+                         buf, stell(&s));
+-        if (code < 0)
++        if (code < 0) {
++            gs_free_object(pdev->memory, buf, "pdf_write_cmap");
+             return code;
++        }
+         code = cos_dict_put_string_copy(pcd, "/Type", "/CMap");
+-        if (code < 0)
++        if (code < 0) {
++            gs_free_object(pdev->memory, buf, "pdf_write_cmap");
+             return code;
++        }
++        gs_free_object(pdev->memory, buf, "pdf_write_cmap");
+     }
+     if (pcmap->CMapName.size == 0) {
+         /* Create an arbitrary name (for ToUnicode CMap). */

debian/patches/CVE-2025-59800.patch

@@ -0,0 +1,25 @@
+Description: CVE-2025-59800 - 安全修复
+Author: Ken Sharp <Ken.Sharp@artifex.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2025-59800
+Last-Update: Tue, 1 Jul 2025 10:31:17 +0100
+---
+diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c
+index 1c1e8ea..7c9c12f 100644
+--- a/devices/gdevpdfocr.c
++++ b/devices/gdevpdfocr.c
+@@ -521,9 +521,12 @@ ocr_line32(gx_device_pdf_image *dev, void *row)
+ static int
+ ocr_begin_page(gx_device_pdf_image *dev, int w, int h, int bpp)
+ {
+-    int raster = (w+3)&~3;
++    int64_t raster = (w + 3) & ~3;
+
+-    dev->ocr.data = gs_alloc_bytes(dev->memory, raster * h, "ocr_begin_page");
++    raster = raster * (int64_t)h;
++    if (raster < 0 || raster > max_size_t)
++        return gs_note_error(gs_error_VMerror);
++    dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page");
+     if (dev->ocr.data == NULL)
+         return_error(gs_error_VMerror);
+     dev->ocr.w = w;

debian/patches/CVE-2025-59801.patch

@@ -0,0 +1,26 @@
+Description: CVE-2025-59801 - 安全修复
+Author: Ken Sharp <Ken.Sharp@artifex.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/d12002b16c59e12d97f42fb2c70caded8b1b6aa8
+Bug: https://security-tracker.debian.org/tracker/CVE-2025-59801
+Last-Update: 2025-09-09
+---
+diff --git a/xps/xpstiff.c b/xps/xpstiff.c
+index 484ed5b..83cb913 100644
+--- a/xps/xpstiff.c
++++ b/xps/xpstiff.c
+@@ -1175,6 +1175,15 @@ xps_decode_tiff(xps_context_t *ctx, byte *buf, int len, xps_image_t *image)
+     if (tiff->rowsperstrip > tiff->imagelength)
+         tiff->rowsperstrip = tiff->imagelength;
+
++    if (tiff->bitspersample != 1 && tiff->bitspersample != 4 && tiff->bitspersample != 8 && tiff->bitspersample != 16)
++        return gs_rethrow(error, "Illegal BitsPerSample in TIFF header");
++
++    if (tiff->samplesperpixel != 1 && tiff->samplesperpixel != 3 && tiff->samplesperpixel != 4 && tiff->samplesperpixel != 5)
++        return gs_rethrow(error, "Illegal SamplesPerPixel in TIFF header");
++
++    if (tiff->compression < 1 || (tiff->compression > 5 && (tiff->compression != 7 && tiff->compression != 32773)))
++        return gs_rethrow(error, "Illegal Compression in TIFF header");
++
+     error = xps_decode_tiff_strips(ctx, tiff, image);
+     if (error)
+         return gs_rethrow(error, "could not decode image data");

debian/patches/series

@@ -14,3 +14,6 @@
 2010_add_build_timestamp_setting.patch
 2011_disable_google_analytics.patch
 2012_additional_gcc_15_fixes.patch
+CVE-2025-59798.patch
+CVE-2025-59800.patch
+CVE-2025-59801.patch