| Summary: | Buffer overflow on pprintg1 due to mishandle postscript file data to pdf | ||
|---|---|---|---|
| Product: | Ghostscript | Reporter: | Vítor Hugo Silva <vitorhg20080> |
| Component: | General | Assignee: | Ken Sharp <ken.sharp> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | chris.liddell, deekej, vitorhg20080 |
| Priority: | P4 | ||
| Version: | unspecified | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| Customer: | Word Size: | --- | |
| Attachments: |
Use case that causes buffer overflow
Unmodified file before mutate |
||
|
Description
Vítor Hugo Silva
2018-04-18 04:21:43 UTC
Indirectly you have fixed the issue with 9.20 and newer. I've contacted distro's to make sure their repo is up to date. Is worth the effort to create a specific patch for this case if 9.18 migration to 9.20 or newer brake anything? (In reply to Vítor Hugo Silva from comment #1) > Indirectly you have fixed the issue with 9.20 and newer. No, we certainly have not! The problem is easily reproducible in current code. I have a fix which I'm testing. > I've contacted distro's to make sure their repo is up to date. > Is worth the effort to create a specific patch for this case if 9.18 > migration to 9.20 or newer brake anything? We don't do patches for older versions of Ghostscript, for free users (we only do limited backwards patching for commercial customers). This leads me to a couple of comments I was going to make: Could you please test against the current version of Ghostscript ? The line numbers in the trace don't match up with the current code. Could you please either supply simpler files, or indicate where in the file the change has been made, or at the very least supply the file before and after fuzzing. This file has 10 pages, and the error only occurs on page 4. It was quite awkward to find what had been modified in such a large file. Commit 39b1e54b2968620723bf32e96764c88797714879 guards against excessively large numbers under these conditions. I can provide you the basefile.ps that I use to mutate and you can diff. I see you marked as resolved. Can I ask you some time to test on the latest code again? I'm attaching the basecase.ps (unmodified file). Created attachment 15046 [details]
Unmodified file before mutate
This has been assigned as CVE-2018-10194 (In reply to Vítor Hugo Silva from comment #4) > I can provide you the basefile.ps that I use to mutate and you can diff. I meant for future reference, I already worked out what changes had been made to the file, it just took time because I didn't have the original as reference. > I see you marked as resolved. Can I ask you some time to test on the latest > code again? For what reason ? I debugged the problem through the code at HEAD~2 (SHA1 fb4c58a0e097e39547dde3d46893ce1b05d19539) and then again with the commit I referenced above. Tested on Windows and Linux and the problem no longer exhibits for me, because we clamp the rogue value to 0. So what would I be looking for if I ran it again ? (In reply to Ken Sharp from comment #7) > (In reply to Vítor Hugo Silva from comment #4) > > I can provide you the basefile.ps that I use to mutate and you can diff. > > I meant for future reference, I already worked out what changes had been > made to the file, it just took time because I didn't have the original as > reference. > > > I see you marked as resolved. Can I ask you some time to test on the latest > > code again? > > For what reason ? I debugged the problem through the code at HEAD~2 (SHA1 > fb4c58a0e097e39547dde3d46893ce1b05d19539) and then again with the commit I > referenced above. Tested on Windows and Linux and the problem no longer > exhibits for me, because we clamp the rogue value to 0. > > So what would I be looking for if I ran it again ? Ok sure, you are right. You have the base file, the muted one that triggers the bug for future reference. Thank you for the fix! (In reply to Vítor Hugo Silva from comment #8) > Thank you for the fix! Thanks for the report :-) Hey, can you make this public? Sorry to ask so late. Thanks (In reply to Vítor Hugo Silva from comment #10) > Hey, can you make this public? Sorry to ask so late. > Thanks Done |