fix(cve): CVE-2025-59801 and CVE-2025-59800

debian/changelog

@@ -1,3 +1,10 @@
+ghostscript (10.05.1~dfsg-3deepin2) unstable; urgency=medium
+
+  * fix(cve): CVE-2025-59801 - XPS 解释器在解析恶意 TIFF 文件时存在栈缓冲区溢出漏洞
+  * fix(cve): CVE-2025-59800 - PDF OCR 8 bit device - avoid overflow. 整数溢出漏洞，可能导致堆溢出
+
+ -- hudeng <hudeng@deepin.org>  Mon, 18 Aug 2025 13:55:00 +0800
+
 ghostscript (10.05.1~dfsg-3deepin1) unstable; urgency=medium
 
   * Add libgs9-common transitional package for smooth upgrading

debian/patches/CVE-2025-59800.patch

@@ -0,0 +1,25 @@
+Description: CVE-2025-59800 - 安全修复
+Author: Ken Sharp <Ken.Sharp@artifex.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2025-59800
+Last-Update: 2025-07-01
+---
+diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c
+index 1c1e8eab8..7c9c12f8c 100644
+--- a/devices/gdevpdfocr.c
++++ b/devices/gdevpdfocr.c
+@@ -521,9 +521,12 @@ ocr_line32(gx_device_pdf_image *dev, void *row)
+ static int
+ ocr_begin_page(gx_device_pdf_image *dev, int w, int h, int bpp)
+ {
+-    int raster = (w+3)&~3;
++    int64_t raster = (w + 3) & ~3;
+
+-    dev->ocr.data = gs_alloc_bytes(dev->memory, raster * h, "ocr_begin_page");
++    raster = raster * (int64_t)h;
++    if (raster < 0 || raster > max_size_t)
++        return gs_note_error(gs_error_VMerror);
++    dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page");
+     if (dev->ocr.data == NULL)
+         return_error(gs_error_VMerror);
+     dev->ocr.w = w;

debian/patches/CVE-2025-59801.patch

@@ -0,0 +1,26 @@
+Description: CVE-2025-59801 - 安全修复
+Author: Ken Sharp <Ken.Sharp@artifex.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/99727069197d548a8db69ba5d63f766bff40eaab
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2025-59801
+Last-Update: 2025-09-09
+---
+diff --git a/xps/xpstiff.c b/xps/xpstiff.c
+index 484ed5b3a..83cb913d1 100644
+--- a/xps/xpstiff.c
++++ b/xps/xpstiff.c
+@@ -1175,6 +1175,15 @@ xps_decode_tiff(xps_context_t *ctx, byte *buf, int len, xps_image_t *image)
+     if (tiff->rowsperstrip > tiff->imagelength)
+         tiff->rowsperstrip = tiff->imagelength;
+
++    if (tiff->bitspersample != 1 && tiff->bitspersample != 4 && tiff->bitspersample != 8 && tiff->bitspersample != 16)
++        return gs_rethrow(error, "Illegal BitsPerSample in TIFF header");
++
++    if (tiff->samplesperpixel != 1 && tiff->samplesperpixel != 3 && tiff->samplesperpixel != 4 && tiff->samplesperpixel != 5)
++        return gs_rethrow(error, "Illegal SamplesPerPixel in TIFF header");
++
++    if (tiff->compression < 1 || (tiff->compression > 5 && (tiff->compression != 7 && tiff->compression != 32773)))
++        return gs_rethrow(error, "Illegal Compression in TIFF header");
++
+     error = xps_decode_tiff_strips(ctx, tiff, image);
+     if (error)
+         return gs_rethrow(error, "could not decode image data");

debian/patches/series

@@ -14,3 +14,5 @@
 2010_add_build_timestamp_setting.patch
 2011_disable_google_analytics.patch
 2012_additional_gcc_15_fixes.patch
+CVE-2025-59801.patch
+CVE-2025-59800.patch