[dunfell] ghostscript: backport patch fix for CVE-2021-3781

Upstream advisory:
https://ghostscript.com/blog/CVE-2021-3781.html

Other than the CVE fix other two commits are backported
to fit the patch.

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
---
 .../ghostscript/CVE-2021-3781_1.patch         | 121 +++++++++
 .../ghostscript/CVE-2021-3781_2.patch         |  37 +++
 .../ghostscript/CVE-2021-3781_3.patch         | 238 ++++++++++++++++++
 .../ghostscript/ghostscript_9.52.bb           |   3 +
 4 files changed, 399 insertions(+)
 create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_1.patch
 create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_2.patch
 create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_3.patch

Thanks Davide!

I had to do a slight tweak to your patch since I've also got a patch
to the ghostscript recipe to fix a couple of CVE issues for
ghostscript-native.

You can check my work in my stable/dunfell-next branch:

https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut

I've done a local test build and it looks good.  Will be running the
full autobuilder test suite later today when infrastructure
maintenance is done.

Steve

On Fri, Mar 25, 2022 at 6:46 AM Davide Gardenal
<davidegarde2000@gmail.com> wrote:
>
> Upstream advisory:
> https://ghostscript.com/blog/CVE-2021-3781.html
>
> Other than the CVE fix other two commits are backported
> to fit the patch.
>
> Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
> ---
>  .../ghostscript/CVE-2021-3781_1.patch         | 121 +++++++++
>  .../ghostscript/CVE-2021-3781_2.patch         |  37 +++
>  .../ghostscript/CVE-2021-3781_3.patch         | 238 ++++++++++++++++++
>  .../ghostscript/ghostscript_9.52.bb           |   3 +
>  4 files changed, 399 insertions(+)
>  create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_1.patch
>  create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_2.patch
>  create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_3.patch
>
> diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_1.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_1.patch
> new file mode 100644
> index 0000000000..033ba77f9a
> --- /dev/null
> +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_1.patch
> @@ -0,0 +1,121 @@
> +From 3920a727fb19e19f597e518610ce2416d08cb75f Mon Sep 17 00:00:00 2001
> +From: Chris Liddell <chris.liddell@artifex.com>
> +Date: Thu, 20 Aug 2020 17:19:09 +0100
> +Subject: [PATCH] Fix pdfwrite "%d" mode with file permissions
> +
> +Firstly, in gx_device_delete_output_file the iodev pointer was being passed
> +to the delete_method incorrectly (passing a pointer to that pointer). Thus
> +when we attempted to use that to confirm permission to delete the file, it
> +crashed. Credit to Ken for finding that.
> +
> +Secondly, due to the way pdfwrite works, when running with an output file per
> +page, it creates the current output file immediately it has completed writing
> +the previous one. Thus, it has to delete that partial file on exit.
> +
> +Previously, the output file was not added to the "control" permission list,
> +so an attempt to delete it would result in an error. So add the output file
> +to the "control" as well as "write" list.
> +
> +CVE: CVE-2021-3781
> +
> +Upstream-Status: Backport:
> +https://git.ghostscript.com/?p=ghostpdl.git;a=commit;f=base/gslibctx.c;h=3920a727fb19e19f597e518610ce2416d08cb75f
> +
> +Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
> +---
> + base/gsdevice.c |  2 +-
> + base/gslibctx.c | 20 ++++++++++++++------
> + 2 files changed, 15 insertions(+), 7 deletions(-)
> +
> +diff --git a/base/gsdevice.c b/base/gsdevice.c
> +index 913119495..ac78af93f 100644
> +--- a/base/gsdevice.c
> ++++ b/base/gsdevice.c
> +@@ -1185,7 +1185,7 @@ int gx_device_delete_output_file(const gx_device * dev, const char *fname)
> +         parsed.len = strlen(parsed.fname);
> +     }
> +     if (parsed.iodev)
> +-        code = parsed.iodev->procs.delete_file((gx_io_device *)(&parsed.iodev), (const char *)parsed.fname);
> ++        code = parsed.iodev->procs.delete_file((gx_io_device *)(parsed.iodev), (const char *)parsed.fname);
> +     else
> +         code = gs_note_error(gs_error_invalidfileaccess);
> +
> +diff --git a/base/gslibctx.c b/base/gslibctx.c
> +index d726c58b5..ff8fc895e 100644
> +--- a/base/gslibctx.c
> ++++ b/base/gslibctx.c
> +@@ -647,7 +647,7 @@ gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +     char *fp, f[gp_file_name_sizeof];
> +     const int pipe = 124; /* ASCII code for '|' */
> +     const int len = strlen(fname);
> +-    int i;
> ++    int i, code;
> +
> +     /* Be sure the string copy will fit */
> +     if (len >= gp_file_name_sizeof)
> +@@ -658,8 +658,6 @@ gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +     rewrite_percent_specifiers(f);
> +     for (i = 0; i < len; i++) {
> +         if (f[i] == pipe) {
> +-           int code;
> +-
> +            fp = &f[i + 1];
> +            /* Because we potentially have to check file permissions at two levels
> +               for the output file (gx_device_open_output_file and the low level
> +@@ -671,10 +669,16 @@ gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +            if (code < 0)
> +                return code;
> +            break;
> ++           code = gs_add_control_path(mem, gs_permit_file_control, f);
> ++           if (code < 0)
> ++               return code;
> +         }
> +         if (!IS_WHITESPACE(f[i]))
> +             break;
> +     }
> ++    code = gs_add_control_path(mem, gs_permit_file_control, fp);
> ++    if (code < 0)
> ++        return code;
> +     return gs_add_control_path(mem, gs_permit_file_writing, fp);
> + }
> +
> +@@ -684,7 +688,7 @@ gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +     char *fp, f[gp_file_name_sizeof];
> +     const int pipe = 124; /* ASCII code for '|' */
> +     const int len = strlen(fname);
> +-    int i;
> ++    int i, code;
> +
> +     /* Be sure the string copy will fit */
> +     if (len >= gp_file_name_sizeof)
> +@@ -694,8 +698,6 @@ gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +     /* Try to rewrite any %d (or similar) in the string */
> +     for (i = 0; i < len; i++) {
> +         if (f[i] == pipe) {
> +-           int code;
> +-
> +            fp = &f[i + 1];
> +            /* Because we potentially have to check file permissions at two levels
> +               for the output file (gx_device_open_output_file and the low level
> +@@ -704,6 +706,9 @@ gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +               the pipe_fopen(), the leading '|' has been stripped.
> +             */
> +            code = gs_remove_control_path(mem, gs_permit_file_writing, f);
> ++           if (code < 0)
> ++               return code;
> ++           code = gs_remove_control_path(mem, gs_permit_file_control, f);
> +            if (code < 0)
> +                return code;
> +            break;
> +@@ -711,6 +716,9 @@ gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +         if (!IS_WHITESPACE(f[i]))
> +             break;
> +     }
> ++    code = gs_remove_control_path(mem, gs_permit_file_control, fp);
> ++    if (code < 0)
> ++        return code;
> +     return gs_remove_control_path(mem, gs_permit_file_writing, fp);
> + }
> +
> +--
> +2.25.1
> diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_2.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_2.patch
> new file mode 100644
> index 0000000000..beade79eef
> --- /dev/null
> +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_2.patch
> @@ -0,0 +1,37 @@
> +From 9daf042fd7bb19e93388d89d9686a2fa4496f382 Mon Sep 17 00:00:00 2001
> +From: Chris Liddell <chris.liddell@artifex.com>
> +Date: Mon, 24 Aug 2020 09:24:31 +0100
> +Subject: [PATCH] Coverity 361429: move "break" to correct place.
> +
> +We had to add the outputfile to the "control" file permission list (as well
> +as write), but for the "pipe" case, I accidentally added the call after the
> +break out of loop that checks for a pipe.
> +
> +CVE: CVE-2021-3781
> +
> +Upstream-Status: Backport:
> +https://git.ghostscript.com/?p=ghostpdl.git;a=commit;f=base/gslibctx.c;h=9daf042fd7bb19e93388d89d9686a2fa4496f382
> +
> +Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
> +---
> + base/gslibctx.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/base/gslibctx.c b/base/gslibctx.c
> +index ff8fc895e..63dfbe2e0 100644
> +--- a/base/gslibctx.c
> ++++ b/base/gslibctx.c
> +@@ -668,10 +668,10 @@ gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname)
> +            code = gs_add_control_path(mem, gs_permit_file_writing, f);
> +            if (code < 0)
> +                return code;
> +-           break;
> +            code = gs_add_control_path(mem, gs_permit_file_control, f);
> +            if (code < 0)
> +                return code;
> ++           break;
> +         }
> +         if (!IS_WHITESPACE(f[i]))
> +             break;
> +--
> +2.25.1
> diff --git a/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_3.patch b/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_3.patch
> new file mode 100644
> index 0000000000..e3f9e81c45
> --- /dev/null
> +++ b/meta/recipes-extended/ghostscript/ghostscript/CVE-2021-3781_3.patch
> @@ -0,0 +1,238 @@
> +From a9bd3dec9fde03327a4a2c69dad1036bf9632e20 Mon Sep 17 00:00:00 2001
> +From: Chris Liddell <chris.liddell@artifex.com>
> +Date: Tue, 7 Sep 2021 20:36:12 +0100
> +Subject: [PATCH] Bug 704342: Include device specifier strings in access
> + validation
> +
> +for the "%pipe%", %handle%" and %printer% io devices.
> +
> +We previously validated only the part after the "%pipe%" Postscript device
> +specifier, but this proved insufficient.
> +
> +This rebuilds the original file name string, and validates it complete. The
> +slight complication for "%pipe%" is it can be reached implicitly using
> +"|" so we have to check both prefixes.
> +
> +Addresses CVE-2021-3781
> +
> +CVE: CVE-2021-3781
> +
> +Upstream-Status: Backport:
> +https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a9bd3dec9fde
> +
> +Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
> +---
> + base/gdevpipe.c | 22 +++++++++++++++-
> + base/gp_mshdl.c | 11 +++++++-
> + base/gp_msprn.c | 10 ++++++-
> + base/gp_os2pr.c | 13 +++++++++-
> + base/gslibctx.c | 69 ++++++++++---------------------------------------
> + 5 files changed, 65 insertions(+), 60 deletions(-)
> +
> +diff --git a/base/gdevpipe.c b/base/gdevpipe.c
> +index 96d71f5d8..5bdc485be 100644
> +--- a/base/gdevpipe.c
> ++++ b/base/gdevpipe.c
> +@@ -72,8 +72,28 @@ pipe_fopen(gx_io_device * iodev, const char *fname, const char *access,
> + #else
> +     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
> +     gs_fs_list_t *fs = ctx->core->fs;
> ++    /* The pipe device can be reached in two ways, explicltly with %pipe%
> ++       or implicitly with "|", so we have to check for both
> ++     */
> ++    char f[gp_file_name_sizeof];
> ++    const char *pipestr = "|";
> ++    const size_t pipestrlen = strlen(pipestr);
> ++    const size_t preflen = strlen(iodev->dname);
> ++    const size_t nlen = strlen(fname);
> ++    int code1;
> ++
> ++    if (preflen + nlen >= gp_file_name_sizeof)
> ++        return_error(gs_error_invalidaccess);
> ++
> ++    memcpy(f, iodev->dname, preflen);
> ++    memcpy(f + preflen, fname, nlen + 1);
> ++
> ++    code1 = gp_validate_path(mem, f, access);
> ++
> ++    memcpy(f, pipestr, pipestrlen);
> ++    memcpy(f + pipestrlen, fname, nlen + 1);
> +
> +-    if (gp_validate_path(mem, fname, access) != 0)
> ++    if (code1 != 0 && gp_validate_path(mem, f, access) != 0 )
> +         return gs_error_invalidfileaccess;
> +
> +     /*
> +diff --git a/base/gp_mshdl.c b/base/gp_mshdl.c
> +index 2b964ed74..8d87ceadc 100644
> +--- a/base/gp_mshdl.c
> ++++ b/base/gp_mshdl.c
> +@@ -95,8 +95,17 @@ mswin_handle_fopen(gx_io_device * iodev, const char *fname, const char *access,
> +     long hfile;       /* Correct for Win32, may be wrong for Win64 */
> +     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
> +     gs_fs_list_t *fs = ctx->core->fs;
> ++    char f[gp_file_name_sizeof];
> ++    const size_t preflen = strlen(iodev->dname);
> ++    const size_t nlen = strlen(fname);
> +
> +-    if (gp_validate_path(mem, fname, access) != 0)
> ++    if (preflen + nlen >= gp_file_name_sizeof)
> ++        return_error(gs_error_invalidaccess);
> ++
> ++    memcpy(f, iodev->dname, preflen);
> ++    memcpy(f + preflen, fname, nlen + 1);
> ++
> ++    if (gp_validate_path(mem, f, access) != 0)
> +         return gs_error_invalidfileaccess;
> +
> +     /* First we try the open_handle method. */
> +diff --git a/base/gp_msprn.c b/base/gp_msprn.c
> +index ed4827968..746a974f7 100644
> +--- a/base/gp_msprn.c
> ++++ b/base/gp_msprn.c
> +@@ -168,8 +168,16 @@ mswin_printer_fopen(gx_io_device * iodev, const char *fname, const char *access,
> +     unsigned long *ptid = &((tid_t *)(iodev->state))->tid;
> +     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
> +     gs_fs_list_t *fs = ctx->core->fs;
> ++    const size_t preflen = strlen(iodev->dname);
> ++    const size_t nlen = strlen(fname);
> +
> +-    if (gp_validate_path(mem, fname, access) != 0)
> ++    if (preflen + nlen >= gp_file_name_sizeof)
> ++        return_error(gs_error_invalidaccess);
> ++
> ++    memcpy(pname, iodev->dname, preflen);
> ++    memcpy(pname + preflen, fname, nlen + 1);
> ++
> ++    if (gp_validate_path(mem, pname, access) != 0)
> +         return gs_error_invalidfileaccess;
> +
> +     /* First we try the open_printer method. */
> +diff --git a/base/gp_os2pr.c b/base/gp_os2pr.c
> +index f852c71fc..ba54cde66 100644
> +--- a/base/gp_os2pr.c
> ++++ b/base/gp_os2pr.c
> +@@ -107,9 +107,20 @@ os2_printer_fopen(gx_io_device * iodev, const char *fname, const char *access,
> +            FILE ** pfile, char *rfname, uint rnamelen)
> + {
> +     os2_printer_t *pr = (os2_printer_t *)iodev->state;
> +-    char driver_name[256];
> ++    char driver_name[gp_file_name_sizeof];
> +     gs_lib_ctx_t *ctx = mem->gs_lib_ctx;
> +     gs_fs_list_t *fs = ctx->core->fs;
> ++    const size_t preflen = strlen(iodev->dname);
> ++    const int size_t = strlen(fname);
> ++
> ++    if (preflen + nlen >= gp_file_name_sizeof)
> ++        return_error(gs_error_invalidaccess);
> ++
> ++    memcpy(driver_name, iodev->dname, preflen);
> ++    memcpy(driver_name + preflen, fname, nlen + 1);
> ++
> ++    if (gp_validate_path(mem, driver_name, access) != 0)
> ++        return gs_error_invalidfileaccess;
> +
> +     /* First we try the open_printer method. */
> +     /* Note that the loop condition here ensures we don't
> +diff --git a/base/gslibctx.c b/base/gslibctx.c
> +index 6dfed6cd5..318039fad 100644
> +--- a/base/gslibctx.c
> ++++ b/base/gslibctx.c
> +@@ -655,82 +655,39 @@ rewrite_percent_specifiers(char *s)
> + int
> + gs_add_outputfile_control_path(gs_memory_t *mem, const char *fname)
> + {
> +-    char *fp, f[gp_file_name_sizeof];
> +-    const int pipe = 124; /* ASCII code for '|' */
> +-    const int len = strlen(fname);
> +-    int i, code;
> ++    char f[gp_file_name_sizeof];
> ++    int code;
> +
> +     /* Be sure the string copy will fit */
> +-    if (len >= gp_file_name_sizeof)
> ++    if (strlen(fname) >= gp_file_name_sizeof)
> +         return gs_error_rangecheck;
> +     strcpy(f, fname);
> +-    fp = f;
> +     /* Try to rewrite any %d (or similar) in the string */
> +     rewrite_percent_specifiers(f);
> +-    for (i = 0; i < len; i++) {
> +-        if (f[i] == pipe) {
> +-           fp = &f[i + 1];
> +-           /* Because we potentially have to check file permissions at two levels
> +-              for the output file (gx_device_open_output_file and the low level
> +-              fopen API, if we're using a pipe, we have to add both the full string,
> +-              (including the '|', and just the command to which we pipe - since at
> +-              the pipe_fopen(), the leading '|' has been stripped.
> +-            */
> +-           code = gs_add_control_path(mem, gs_permit_file_writing, f);
> +-           if (code < 0)
> +-               return code;
> +-           code = gs_add_control_path(mem, gs_permit_file_control, f);
> +-           if (code < 0)
> +-               return code;
> +-           break;
> +-        }
> +-        if (!IS_WHITESPACE(f[i]))
> +-            break;
> +-    }
> +-    code = gs_add_control_path(mem, gs_permit_file_control, fp);
> ++
> ++    code = gs_add_control_path(mem, gs_permit_file_control, f);
> +     if (code < 0)
> +         return code;
> +-    return gs_add_control_path(mem, gs_permit_file_writing, fp);
> ++    return gs_add_control_path(mem, gs_permit_file_writing, f);
> + }
> +
> + int
> + gs_remove_outputfile_control_path(gs_memory_t *mem, const char *fname)
> + {
> +-    char *fp, f[gp_file_name_sizeof];
> +-    const int pipe = 124; /* ASCII code for '|' */
> +-    const int len = strlen(fname);
> +-    int i, code;
> ++    char f[gp_file_name_sizeof];
> ++    int code;
> +
> +     /* Be sure the string copy will fit */
> +-    if (len >= gp_file_name_sizeof)
> ++    if (strlen(fname) >= gp_file_name_sizeof)
> +         return gs_error_rangecheck;
> +     strcpy(f, fname);
> +-    fp = f;
> +     /* Try to rewrite any %d (or similar) in the string */
> +-    for (i = 0; i < len; i++) {
> +-        if (f[i] == pipe) {
> +-           fp = &f[i + 1];
> +-           /* Because we potentially have to check file permissions at two levels
> +-              for the output file (gx_device_open_output_file and the low level
> +-              fopen API, if we're using a pipe, we have to add both the full string,
> +-              (including the '|', and just the command to which we pipe - since at
> +-              the pipe_fopen(), the leading '|' has been stripped.
> +-            */
> +-           code = gs_remove_control_path(mem, gs_permit_file_writing, f);
> +-           if (code < 0)
> +-               return code;
> +-           code = gs_remove_control_path(mem, gs_permit_file_control, f);
> +-           if (code < 0)
> +-               return code;
> +-           break;
> +-        }
> +-        if (!IS_WHITESPACE(f[i]))
> +-            break;
> +-    }
> +-    code = gs_remove_control_path(mem, gs_permit_file_control, fp);
> ++    rewrite_percent_specifiers(f);
> ++
> ++    code = gs_remove_control_path(mem, gs_permit_file_control, f);
> +     if (code < 0)
> +         return code;
> +-    return gs_remove_control_path(mem, gs_permit_file_writing, fp);
> ++    return gs_remove_control_path(mem, gs_permit_file_writing, f);
> + }
> +
> + int
> +--
> +2.25.1
> diff --git a/meta/recipes-extended/ghostscript/ghostscript_9.52.bb b/meta/recipes-extended/ghostscript/ghostscript_9.52.bb
> index 32346e6811..0ee6ee0126 100644
> --- a/meta/recipes-extended/ghostscript/ghostscript_9.52.bb
> +++ b/meta/recipes-extended/ghostscript/ghostscript_9.52.bb
> @@ -33,6 +33,9 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d
>                  file://do-not-check-local-libpng-source.patch \
>                  file://avoid-host-contamination.patch \
>                  file://mkdir-p.patch \
> +                file://CVE-2021-3781_1.patch \
> +                file://CVE-2021-3781_2.patch \
> +                file://CVE-2021-3781_3.patch \
>  "
>
>  SRC_URI = "${SRC_URI_BASE} \
> --
> 2.32.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#163645): https://lists.openembedded.org/g/openembedded-core/message/163645
> Mute This Topic: https://lists.openembedded.org/mt/90026834/3620601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>