62 lines
2.0 KiB
Diff
62 lines
2.0 KiB
Diff
From 671fd59eb657743aa86fbc1895cb15872a317caa Mon Sep 17 00:00:00 2001
|
|
From: Chris Liddell <chris.liddell@artifex.com>
|
|
Date: Thu, 6 Jul 2017 14:54:02 +0100
|
|
Subject: [PATCH] Bug 698158: prevent trying to reloc a freed object
|
|
|
|
In the token reader, we pass the scanner state structure around as a
|
|
t_struct ref on the Postscript operand stack.
|
|
|
|
But we explicitly free the scanner state when we're done, which leaves a
|
|
dangling reference on the operand stack and, unless that reference gets
|
|
overwritten before the next garbager run, we can end up with the garbager
|
|
trying to deal with an already freed object - that can cause a crash, or
|
|
memory corruption.
|
|
---
|
|
psi/ztoken.c | 14 +++++++++++++-
|
|
1 file changed, 13 insertions(+), 1 deletion(-)
|
|
|
|
--- end of original header
|
|
|
|
CVE: CVE-2017-11714
|
|
|
|
Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
|
|
|
|
Signed-off-by: Joe Slater <joe.slater@windriver.com>
|
|
|
|
diff --git a/psi/ztoken.c b/psi/ztoken.c
|
|
index 4dba7c5..af1ceeb 100644
|
|
--- a/psi/ztoken.c
|
|
+++ b/psi/ztoken.c
|
|
@@ -107,6 +107,12 @@ token_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save)
|
|
int code;
|
|
ref token;
|
|
|
|
+ /* Since we might free pstate below, and we're dealing with
|
|
+ * gc memory referenced by the stack, we need to explicitly
|
|
+ * remove the reference to pstate from the stack, otherwise
|
|
+ * the garbager will fall over
|
|
+ */
|
|
+ make_null(osp);
|
|
/* Note that gs_scan_token may change osp! */
|
|
pop(1); /* remove the file or scanner state */
|
|
again:
|
|
@@ -183,8 +189,14 @@ ztokenexec_continue(i_ctx_t *i_ctx_p)
|
|
static int
|
|
tokenexec_continue(i_ctx_t *i_ctx_p, scanner_state * pstate, bool save)
|
|
{
|
|
- os_ptr op;
|
|
+ os_ptr op = osp;
|
|
int code;
|
|
+ /* Since we might free pstate below, and we're dealing with
|
|
+ * gc memory referenced by the stack, we need to explicitly
|
|
+ * remove the reference to pstate from the stack, otherwise
|
|
+ * the garbager will fall over
|
|
+ */
|
|
+ make_null(osp);
|
|
/* Note that gs_scan_token may change osp! */
|
|
pop(1);
|
|
again:
|
|
--
|
|
1.7.9.5
|
|
|