diff options
Diffstat (limited to 'gnu/packages/patches/mupdf-CVE-2016-7504.patch')
| -rw-r--r-- | gnu/packages/patches/mupdf-CVE-2016-7504.patch | 99 |
1 files changed, 99 insertions, 0 deletions
diff --git a/gnu/packages/patches/mupdf-CVE-2016-7504.patch b/gnu/packages/patches/mupdf-CVE-2016-7504.patch new file mode 100644 index 0000000000..4bbb4411c0 --- /dev/null +++ b/gnu/packages/patches/mupdf-CVE-2016-7504.patch @@ -0,0 +1,99 @@ +Fix CVE-2016-7504: +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7504 +http://bugs.ghostscript.com/show_bug.cgi?id=697142 + +Patch copied from upstream source repository: +http://git.ghostscript.com/?p=mujs.git;a=commitdiff;h=5c337af4b3df80cf967e4f9f6a21522de84b392a + +From 5c337af4b3df80cf967e4f9f6a21522de84b392a Mon Sep 17 00:00:00 2001 +From: Tor Andersson <tor.andersson@artifex.com> +Date: Wed, 21 Sep 2016 16:01:08 +0200 +Subject: [PATCH] Fix bug 697142: Stale string pointer stored in regexp object. + +Make sure to make a copy of the source pattern string. +A case we missed when adding short and memory strings to the runtime. +The code assumed all strings passed to it were either literal or interned. +--- + jsgc.c | 4 +++- + jsi.h | 1 + + jsregexp.c | 2 +- + jsrun.c | 8 ++++++++ + jsvalue.h | 2 +- + 5 files changed, 14 insertions(+), 3 deletions(-) + +diff --git a/jsgc.c b/jsgc.c +index 9bd6482..4f7e7dc 100644 +--- a/thirdparty/mujs/jsgc.c ++++ b/thirdparty/mujs/jsgc.c +@@ -44,8 +44,10 @@ static void jsG_freeobject(js_State *J, js_Object *obj) + { + if (obj->head) + jsG_freeproperty(J, obj->head); +- if (obj->type == JS_CREGEXP) ++ if (obj->type == JS_CREGEXP) { ++ js_free(J, obj->u.r.source); + js_regfree(obj->u.r.prog); ++ } + if (obj->type == JS_CITERATOR) + jsG_freeiterator(J, obj->u.iter.head); + if (obj->type == JS_CUSERDATA && obj->u.user.finalize) +diff --git a/jsi.h b/jsi.h +index 7d9f7c7..e855045 100644 +--- a/thirdparty/mujs/jsi.h ++++ b/thirdparty/mujs/jsi.h +@@ -79,6 +79,7 @@ typedef unsigned short js_Instruction; + + /* String interning */ + ++char *js_strdup(js_State *J, const char *s); + const char *js_intern(js_State *J, const char *s); + void jsS_dumpstrings(js_State *J); + void jsS_freestrings(js_State *J); +diff --git a/jsregexp.c b/jsregexp.c +index 2a056b7..a2d5156 100644 +--- a/thirdparty/mujs/jsregexp.c ++++ b/thirdparty/mujs/jsregexp.c +@@ -21,7 +21,7 @@ void js_newregexp(js_State *J, const char *pattern, int flags) + js_syntaxerror(J, "regular expression: %s", error); + + obj->u.r.prog = prog; +- obj->u.r.source = pattern; ++ obj->u.r.source = js_strdup(J, pattern); + obj->u.r.flags = flags; + obj->u.r.last = 0; + js_pushobject(J, obj); +diff --git a/jsrun.c b/jsrun.c +index 2648c4c..ee80845 100644 +--- a/thirdparty/mujs/jsrun.c ++++ b/thirdparty/mujs/jsrun.c +@@ -45,6 +45,14 @@ void *js_realloc(js_State *J, void *ptr, int size) + return ptr; + } + ++char *js_strdup(js_State *J, const char *s) ++{ ++ int n = strlen(s) + 1; ++ char *p = js_malloc(J, n); ++ memcpy(p, s, n); ++ return p; ++} ++ + void js_free(js_State *J, void *ptr) + { + J->alloc(J->actx, ptr, 0); +diff --git a/jsvalue.h b/jsvalue.h +index 6cfbd89..8fb5016 100644 +--- a/thirdparty/mujs/jsvalue.h ++++ b/thirdparty/mujs/jsvalue.h +@@ -71,7 +71,7 @@ struct js_String + struct js_Regexp + { + void *prog; +- const char *source; ++ char *source; + unsigned short flags; + unsigned short last; + }; +-- +2.10.2 + |